From 426ed39aacf7b695a4d7be516329fb2dd3c45b6a Mon Sep 17 00:00:00 2001 From: al-munazzim Date: Sat, 8 Aug 2026 19:48:20 +0200 Subject: [PATCH] Warn that Specter auth does not encrypt data folder (#2683) Co-authored-by: Nazim --- docs/faq.md | 7 +++++++ .../specter/templates/settings/auth_settings.jinja | 8 ++++++++ 2 files changed, 15 insertions(+) diff --git a/docs/faq.md b/docs/faq.md index 43211f3e9..819dce3e2 100644 --- a/docs/faq.md +++ b/docs/faq.md @@ -31,6 +31,7 @@ - [*Can this also work with external nodes like Casa, MyNode, and Raspilitz?*](#can-this-also-work-with-external-nodes-like-casa-mynode-and-raspilitz) - [*Can I use Tor?*](#can-i-use-tor) - [I forgot my password, how can I reset it?](#i-forgot-my-password-how-can-i-reset-it) + - [Does the Specter password encrypt my wallet data files?](#does-the-specter-password-encrypt-my-wallet-data-files) - [BACKING UP FUNDS](#backing-up-funds) - [*If something happens to the `~/.specter` folder, is it still possible to **restore** access to multisigs created there (assuming there is no backup of the `~/.specter` folder)?*](#if-something-happens-to-the-specter-folder-is-it-still-possible-to-restore-access-to-multisigs-created-there-assuming-there-is-no-backup-of-the-specter-folder) - [*To recover a multisig that was built on specter (eg: 2 of 3 with ColdCard), is having the seeds of all 3 signing wallets sufficient or do we need to backup more info?*](#to-recover-a-multisig-that-was-built-on-specter-eg-2-of-3-with-coldcard-is-having-the-seeds-of-all-3-signing-wallets-sufficient-or-do-we-need-to-backup-more-info) @@ -241,6 +242,12 @@ Depending on "what's written in `somethingInHere`: * If it's `usernamepassword`, you won't be able to recover the password but you can deactivate it by setting it to `none` and restart Specter. * If it's `none` (or you just set it to `none`) you can login without any password. So hurry up with setting it again within specter. +### Does the Specter password encrypt my wallet data files? + +No. Specter authentication protects access to the app/session, but it does not encrypt the whole Specter data folder at rest. The data folder contains wallet metadata files such as xpubs, addresses, wallet names, labels, and transaction metadata that may be readable by anyone or any process with filesystem access to that folder. + +If this is in your threat model, use OS-level disk encryption (for example FileVault on macOS), make sure backups and sync tools that include the Specter data folder are encrypted and access-controlled, and consider running Specter from a data folder located on an encrypted volume/container via `--specter-data-folder`. + ## BACKING UP FUNDS ### *If something happens to the `~/.specter` folder, is it still possible to **restore** access to multisigs created there (assuming there is no backup of the `~/.specter` folder)?* diff --git a/src/cryptoadvance/specter/templates/settings/auth_settings.jinja b/src/cryptoadvance/specter/templates/settings/auth_settings.jinja index 13b17784b..e9f5ffecb 100644 --- a/src/cryptoadvance/specter/templates/settings/auth_settings.jinja +++ b/src/cryptoadvance/specter/templates/settings/auth_settings.jinja @@ -22,6 +22,14 @@ {% endif %} + +