Take the 2-minute tour ×
Bitcoin Stack Exchange is a question and answer site for Bitcoin crypto-currency enthusiasts. It's 100% free, no registration required.

With bitcoin 0.4.0 I have encrypted my wallet. Now when I would want to use bitcoind, the only way to send money is to provide my wallet decryption key on the cmd line first. I do not want to do that as my password will show up in the shell history.

Is there a way to let bitcoind ask for the wallet passphrase?

share|improve this question

3 Answers 3

Anything you can do from the command line you can also do from the JSON API which means that the same unlock command could be sent from within code just as easily. To my knowledge there is no pre-built utility capable of this, but the API is simple enough that I can't imagine it being terribly difficult to actually build such a tool.


Edit: It was much easier than expected to do this in Python. Assuming you have Python's JSON-RPC module installed just use this code:

from jsonrpc import ServiceProxy
from getpass import getpass
access = ServiceProxy("http://127.0.0.1:8332")
pwd = getpass("Enter wallet passphrase: ")
access.walletpassphrase(pwd, 60)

Similarly you could call access.walletlock() to lock the wallet on demand and walletpassphrasechange(old, new) to change the passphrase without ever having it see the command line.


Edit 2: I also submitted an issue to the devs on github on your behalf.

Edit 3: A pull request containing my python scripts has been accepted. Downloading the bitcoin source from github now includes scripts for this purpose in contrib/wallettools

Edit 4: A new bug report was filed to request that the builtin command behaves properly.

share|improve this answer

You can avoid having the password show up in the shell history like this:

$ read x
password goes here
$ bitcoind walletpassphrase "$x" 60
$ x=
$ 

The read x command reads the next line of text you type and puts it into a shell variable x.

The x= command overwrites the shell variable; otherwise $x will hold your password until you exit the current shell.

It shows up in the history like this:

2032  read x
2033  bitcoind walletpassphrase "$x" 60
2034  x=
2035  history

I expect the password will show up in /proc/ while the bitcoind command is running, but that should be only for a fraction of a second.

share|improve this answer
    
While this hides the passphrase from the shell history it will still show up in other places (ps -ax or ps -ef, for example, will show the bitcoind command as invoked, including the value of $x) –  voretaq7 May 2 at 21:22
    
@voretaq7 no it doesnt show up in ps, see this updated question. –  vertoe May 3 at 7:35
    
It shows up in ps output for me, but only for as long as the bitcoind command takes to run, which is approximately no time at all. Try "sleep $x" where x is 999, then 'ps -ef | grep sleep' in another window to see it. –  Chris Moore May 4 at 5:47

While in command prompt press ALT+F7 to delete all commands stored in memory for the current history buffer.

share|improve this answer
4  
That solves the problem for now but it's really not acceptable for the passphrase to appear in the buffer in the first place. Also, is the buffer held solely in memory or is it at some point written to disk? If so, does Alt+F7 securely destroy the contents of such files or simply delete them? –  David Perry Oct 3 '11 at 17:08
    
The buffer is held solely in memory, and assuming user won't forget to clear history, I don't see how it's less secure then having additional prompt for password. Because if a malicious program have access to cmd memory buffer that also means it can intercept password input directly from keyboard. –  Serith Oct 3 '11 at 21:23
    
I don't think it's memory-grabbing malware we're concerned with here so much as multi-user PCs and forgetting to clear the buffer. –  David Perry Oct 3 '11 at 23:14
    
What operating system does this keyboard shortcut work in? –  akaihola Oct 8 '11 at 4:22
    
@akaihola, Windows Command Prompt –  Serith Oct 8 '11 at 15:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.