Repository navigation
Web login bug #14692
Description
I found the web login flow hashes passwords using scrypt loaded at runtime from an unpinned jsdelivr CDN script, which would expose all passwords and wallet keys if the CDN or package were compromised. I’ll fix this by switching to the already-bundled, tested @noble/hashes scrypt implementation across all platforms.
Reacted by Ray Jacobson
Activity
dylanjeffers commentedon Nov 7, 2026
Thanks for flagging this. Fixed in #14752: web login now runs
@noble/hashesscrypt from the app bundle in a worker, and nothing is loaded from jsdelivr. Derived keys are unchanged, and tests pin them against the old scripts. It will go out with the next web release.