Browser-laptop: private wallet data in ledger state files should be encrypted using password manager

[diracdeltas]

The wallet private key and passphrase are as sensitive as most passwords, so we should use the Brave password manager encryption key to encrypt them before saving to disk.

related: https://github.com/brave/browser-laptop/issues/8449

cc @darkdh @mrose17

[alexwykoff]

@diracdeltas how would you rank this re: security? high/med/low?

[diracdeltas]

med

[hugobuddel]

Related #11419

[bridiver]

this shouldn't have been closed by the muon PR, it still needs to use the new api calls

[NumDeP]

+1 Hi @alexwykoff I'd argue this is bordering on high on a med-high scale on the basis that it would better to have this fixed now when you don't have other important items and technologies built and avoiding complaints which won't be much considering a low user base coherently.

I'd also argue that it's best to also to have items encrypted as well in that preference area, where it would be nice to allow a feature in about:preferences#security where it would be appropriate to have a ‘PIN’ feature above ‘Data Privacy’ and under this you allow Security - Payments - Extensions (and future security orientated features/technologies) essentially making it invisible to guests and un-entered pin users (if that makes sense) once the password (pin) has been set for the browser.

Rather than having to type the entire post I created in the community, would you mind skimming though the information I pasted and either +1 or tell me why it's not doable or unnecessary, which I hope you won't say and request to change the title of this issue to a more suitable one. Thanks.

• https://community.brave.com/t/enhancing-private-data-security-braves-built-in-about-passwords/9858

[tanevanwifferen]

Priority has increased a lot lol. Beware of spectre peeking in through a malicious piece of javascript.

[diracdeltas]

i think the priority has gone up from 'medium' to 'high' given the growth in ledger usage and the amount of value stored in Brave wallets. setting a milestone to 0.21.x for now, but maybe worth bumping to 0.20.x @darkdh @bsclifton wdyt?

[bsclifton]

I think 0.21.x would be perfect 👍

[NejcZdovc]

@diracdeltas @darkdh do we plan do this before 1.0?

[diracdeltas]

probably wait to just do this in chromium-fork

[diracdeltas]

^ unless @darkdh has cycles to do this before then

[darkdh]

prefer doing that in chromium-fork, thanks.

[NejcZdovc]

added label post-v1

[bridiver]

@bsclifton was this ticket migrated to brave-browser? If not it needs to be.

[bsclifton]

Created https://github.com/brave/brave-browser/issues/2555 to track in brave-core 😄 👍