"Privacy leak: wormhole service links transactions to user's PC and mobile IP address #212"

aalfredo · March 3, 2021, 6:31am

HI
I came across this defect below and want to know if this a concern as its still open.
if its still open does it mean when using the ZEC wallet between the desktop and the mobile I risk exposing my metadata information ? This does not sound very secure to me .
Does this also mean the ZECwallet should not be used between a desktop and mobile client ?

Defect

“Privacy leak: wormhole service links transactions to user’s PC and mobile IP address #212”

github.com/ZcashFoundation/zecwallet

Privacy leak: wormhole service links transactions to user's PC and mobile IP address

opened 08:50PM - 04 Jan 20 UTC

tromer

Following up on a discussion in the [Zecwallet UX - Replace Zecwallet UI with a …React-based one](https://grants.zfnd.org/proposals/407969070-zecwallet-ux-replace-zecwallet-ui-with-a-react-based-one) grant proposal: > The connection between the Browser and Mobile App is done over the [wormhole protocol](https://github.com/ZcashFoundation/zecwallet/wiki/Android-App-FAQ#what-is-a-direct-connection-vs-connect-over-the-internetvia-wormholezecqtwalletcom). This is already built, and is currently how the App connects to Zecwallet. The connection uses TLS and the data inside is further encrypted end-to-end (with libsodium's symmetric encryption), so the wormhole service can't see the data either (But can see metadata like the IP address). (where the wormhole protocol implementation is [here](https://github.com/adityapk00/zqwwormhole/blob/master/src/main/kotlin/com/zecqtwallet/wormhole/Service.kt).) I'm worried about the privacy implications of the metadata and traffic patterns, because the centralized wormhole server can see the message timing, size and IP address of all PC-to-mobile communication. For example, I guess that it's very easy to identify "transaction send" events just by the message sizes, in both the current architecture (where the mobile app is a UI frontend) and in the envisioned "web app" architecture (where the mobile app is a key store). The actual transactions are readily observable (on the peer-to-peer network, and at the lightwalletd service), and linkable by the timing. Hence: **The operator of the "wormhole" service, or anyone monitoring it, gets to know the IP address of both the PC and mobile phone of every sender of every transaction that uses this system.** That's bad. A couple of ideas for improvements: 1. Establish a direct TCP connection between the PC and mobile, when possible. For example, consider how [Magic Wormhole](https://github.com/warner/magic-wormhole) falls back to its [Transit Relay](https://magic-wormhole.readthedocs.io/en/latest/welcome.html#relays) only if necessary: > The file-transfer commands also use a “Transit Relay”, which is another simple server that glues together two inbound TCP connections and transfers data on each to the other. The wormhole send file mode shares the IP addresses of each client with the other (inside the encrypted message), and both clients first attempt to connect directly. If this fails, they fall back to using the transit relay. 2. Use Tor or I2P for the PC-to-mobile link

tokidoki · March 3, 2021, 11:35am

Hi @aalfredo Zecwallet is an open source project. You are free to contribute code if you think there are things to improve.

Cheers.

Shawn · March 3, 2021, 4:40pm

I believe this issue only applies to users that are using the ZecWallet Android companion app to remotely connect/control to thier home ZecWallet Fullnode. In that case you are opening a wormhole that connects you directly to your node and the app has to see both IP addresses to make the remote connection.

The Android companion app isn’t as popular anymore because ZecWallet lite now enables fully shielded transactions on mobile with no need to connect to your own full node remotely.

aalfredo · March 3, 2021, 5:37pm

Thanks for the update and clarifying the issue .