Allow user to copy the paper key

[csbenz]

I want to copy the Paper Key to 1password but the app doesn't allow copying on the screen. Saving to a password manager is more secure than taking a screenshot which is backed up to the cloud or stays on the local storage.

The whole UX for the key generation is quite bad and doesn't help people onboard to this app. Simple steps can improve it immensely!

[pm47]

So you are that person who gives 1-star review to FOSS app because you don't have the convenience feature you like. Thank you for your support! Le mar. 3 mars 2020 à 22:56, Christopher Benz <[email protected]> a écrit :

…

I want to copy the Paper Key to 1password but the app doesn't allow copying on the screen. Saving to a password manager is more secure than taking a screenshot which is backed up to the cloud or stays on the local storage. The whole UX for the key generation is quite bad and doesn't help people onboard to this app. Simple steps can improve it immensely! — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#239?email_source=notifications&email_token=AAPPFPVDECGTJXEJY5C3SPDRFV4JFA5CNFSM4LAUDQQKYY3PNVWWK3TUL52HS4DFUVEXG43VMWVGG33NNVSW45C7NFSM4ISFOA4Q>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAPPFPXF2Z5OSCJXGDOJECLRFV4JFANCNFSM4LAUDQQA> .

[t-bast]

Saving to a password manager is more secure than taking a screenshot which is backed up to the cloud or stays on the local storage.

Of course if you compare to horrible security measures. It's also safer than posting your seed on Twitter.

But what we currently provide is also more secure than what you suggest. Simply displaying the seed without any other capabilities is the safest we can get without compromising the UX too much. Allowing you to copy means an attacker with access to the clipboard that infected your phone gets your seed very easily. You can't control how long it stays in the clipboard. You can't control where the clipboard stores that data.

On top of that I wouldn't recommend putting your seed in a password manager, unless it's a 100% local (ie offline one). It's of course entirely your choice, but do know that if you do that, you are completely trusting your password manager vendor to not decrypt your seed and steal your bitcoins. You have absolutely no way to protect yourself against that once it has been stored (even encrypted) on their servers.

[t-bast]

Before asserting that what we do is bad, please start by asking why it is the way it is. We welcome all contributions, questions and feature requests, and stay humble about what we do, but we expect our users to do the same.

We've put a lot of effort into making this software, making it FOSS, improving it constantly, so the least you could do is have a little bit of consideration for the free work we've done for you.