0

I have mentioned details here: https://github.com/bitcoin-core/gui/issues/76

Also what would be the best approach to solve this problem using c++ which works on linux, windows and mac without any issues?

Few solutions are mentioned here: https://stackoverflow.com/questions/40504281/c-how-to-check-the-last-modified-time-of-a-file

Fileinfo

3

No.

If your machine is compromised you can't trust last modified timestamps.

One of the obstacles to Bitcoin adoption is complexity. Developers should keep the user interface as simple and clear as possible. 99.9% of users wouldn't understand the information or how to use it.

A better approach to detecting malicious changes to a configuration file might be to encrypt the configuration file with the wallet password or to store a checksum of the config file in the encrypted wallet file and only alert the user when configuration changes are detected that were not made via the wallet software itself. But any message should carefully and clearly explain what the situation is without confusing new inexperienced users.

I'm not sure how useful this is since if your wallet config has been maliciously altered the whole computer is untrustworthy.

| improve this answer | |
  • > If your machine is compromised you can't trust last modified timestamps Makes sense > 99.9% of users wouldn't understand the information or how to use it Possible. Still may help few. > alert the user when configuration changes are detected that were not made via the wallet software itself Interesting > whole computer is untrustworthy Yes. And this solution may help notify the user early about it instead of him doing it after few days. Example: you receive emails from services that XYZ change was made to your account, secure account if it wasn't you. – Prayank Aug 27 at 14:29
  • 1
    I think @RedGrittyBrick just means that it's pointless: an attacker who is able to modify the config file can also hide the time of modification... or steal the wallet file... or replacing the bitcoin binary with a version that lies about the timestamp... or just sends your coins directly away. You need to be able to trust the system you're running a wallet on; no way around that. – Pieter Wuille Aug 27 at 19:02
  • 2
    @Prayank: The point is that if someone can modify your configuration file, they could also modify your Bitcoin installation such that the modification will not raise an alert. Warnings by a service provider work because gaining access to change the password is a different level of access from being notified about such changes. – Murch Aug 27 at 19:02
  • @Murch Possible – Prayank Aug 27 at 19:35
  • @PieterWuille sure attacker can do more than just making changes in config file and I realized such timestamp information may help in some cases although its best to solve it at system level for all important files by user with something like sourceforge.net/projects/iwatch on linux which is a tool for detecting changes in filesystem and send email notifications. i.imgur.com/EUJnBQE.png – Prayank Aug 28 at 1:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.