Replying to Avatar Cyph3rp9nk

For the record, the whirpool-client code does have Tor identity management. The code I showed belongs to the new soroban implementation and I did not review the old client (very badly structured code). However neither the android app nor sparrow manage identities.

The android app because it is computationally expensive, hence one of the reasons why wasabi never had a phone client and sparrow because it was not implemented correctly.

I don't know what percentage of people were using said desktop client, but evidently everyone who has used the android client or sparrow has not been protected.

nostr:note15720avmmchg6fy8rqmwxrxut3cy6kfg297l7scn3gjysemmzrfzsxjva9p
Avatar
Al₿erto Troya 1y ago 💬 1

Can’t believe you’re the only one that had reviewed the code until now.

Do you refer to Sparrow just the desktop client or any specific functionality within it?

Reply to this note

Please Login to reply.

Discussion

Avatar
Cyph3rp9nk 1y ago

I am not the only one, whirpool's shortcomings have been addressed before by others, both xpub exposure, lack of identity management, and key tagging vulnerabilities in signature management by the coordinator.

When I refer to sparrow it is using the whirpool function.