1

I have used electrum for many years on my desktop pc, and have alway felt very secure in doing so because of my ability to use a very strong password to encrypt my seed phrase with. However I just started using the android version and have some concerns.

The android version requires me to select a PIN but it is only 6 digits long? How does the android version of electrum ensure that this tiny keyspace (1 million) stays secure?

1

Edit 15/3/2021: Electrum now lets you set a longer password.

Android is also better at keeping apps from stepping on each other's toes. The OS isolates Electrum's files and prevent other apps from accessing them.

5
  • +1 Good answer, but I would like more details. Why does rooting after wallet creation not work? Why can the files not be accessed using adb? – Brian Drake Mar 14 at 12:40
  • the answer is wrong now. they allow you to set a longer password and the wallet file can be saved to microsd card. – Abdussamad Mar 15 at 14:08
  • Please edit your answer to include this new information, as well as clarify the relevance of rooting the device either before or after creating the wallet. – Brian Drake Mar 15 at 14:10
  • @BrianDrake afaik rooting wipes app data so can't be used for this purpose – Abdussamad Mar 15 at 14:14
  • 1
    Rooting should not erase data, according to Android SE. – Brian Drake Mar 15 at 14:17
1

The android version requires me to select a PIN but it is only 6 digits long? How does the android version of electrum ensure that this tiny keyspace (1 million) stays secure?

The PIN is not used as a master seed in this way. It may be used as an additional source of user-supplied entropy, but the wallet's seed will be generated in a cryptographically secure way, using other sources of randomness to provide sufficient security.

I am unfamiliar with the specifics of Electrum's implementation, but there are generally two possibilities here:

1) the password / PIN is simply used to encrypt the wallet, and is not used as input for the seed

2) the password/ PIN is used as a '13th/25th word' that acts as a password on the mnemonic. Find more info here. Also, from BIP 39:

A user may decide to protect their mnemonic with a passphrase. If a passphrase is not present, an empty string "" is used instead.

4
  • 1
    Electrum uses option 1 - it has support for option 2, but you configure that during wallet set up, and don't need to reenter it unless you are restoring a wallet (I'm not sure if that applies to the mobile version, but since the desktop works that way, I imagine it does) – Raghav Sood Oct 30 '19 at 20:26
  • Option 1 is what I was afraid was happening, and what I meant when I asked if the private seed is secure. A 6 digit pin as an encryption key for the wallet, which contains the master private key, is not secure. I'm going to have to re evaluate using electrum on my android device because of this. If anyone ever gains access to the encrypted wallet file, it would be trivial to brute force the wallet file encryption. – user258667 Oct 30 '19 at 22:04
  • @RaghavSood ah, thats good info, thanks! – chytrik Oct 30 '19 at 22:27
  • @user258667 Oh! I understand the question better now. Your comment is correct, if anyone gains access to the encrypted wallet file, the 6-digit PIN encryption is not extremely strong. Nevertheless, the security model provided by such a mobile wallet may still be useful in some situations (ie a small amount of 'daily spend' BTC, not a large amount that you want to keep extremely secure). – chytrik Oct 30 '19 at 22:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.