Bitcoin Forum

Bitcoin => Electrum => Topic started by: Lucius on January 30, 2020, 11:09:07 AM



Title: Electrum - Privacy issue (Windows)
Post by: Lucius on January 30, 2020, 11:09:07 AM
If you use Electrum on Windows OS and if you click on Start menu taskbar -> Properties -> Notification Area -> you can see all icons that appear in that area. One of them is Electrum which in itself is not a problem, but in additional info, that icon also shows balance of your wallet which can certainly compromise your privacy if you share your computer with someone, or need to have it repaired. I must mention that this is not an icon that is visible only while Electrum is open, but information that remains after you close the program.

I have to mention that this is about Windows 7, I haven't checked yet for the W10.

Please no discussion about how Windows is insecure or how we should stop using any version of this OS.

https://i.imgur.com/lrrTZnZ.jpg


Title: Re: Electrum - Privacy issue (Windows)
Post by: nc50lc on January 30, 2020, 11:26:45 AM
Same thing on Window10:
https://i.imgur.com/xO33Ezv.png

It's weird that the balance is being displayed on the selection of Taskbar Icons, from:
"Notification and Actions settings->Select which icons appear on the taskbar"


Title: Re: Electrum - Privacy issue (Windows)
Post by: o_e_l_e_o on January 30, 2020, 12:01:45 PM
I must mention that this is not an icon that is visible only while Electrum is open, but information that remains after you close the program.
What about if you restart your computer and then don't open Electrum at all? Is it still viewable then?

Is it showing the balance of the last wallet you opened? Would creating a "dummy" wallet and opening it reset the value to zero?


Title: Re: Electrum - Privacy issue (Windows)
Post by: Lucius on January 30, 2020, 02:19:41 PM
o_e_l_e_o, I can confirm that even after completely shutting down the computer and run CCleaner (it has zero effect on this issue) that notification is still visible in Notifications Area Icons with a balance of last opened wallet.

I will try to monitor for how long that info will be visible there without opening Electrum again. I'm sure opening an empty wallet would be the only smart solution, with some possible tweaks in the Windows settings that would make it impossible to remember things like this at all.


Title: Re: Electrum - Privacy issue (Windows)
Post by: DireWolfM14 on January 30, 2020, 02:50:54 PM
That's odd, on my PC that icon only appears when I have Electrum running.  I'm still running Win7 at work, been putting off the upgrade much to the IT guy's chagrin.  I noticed there's a setting that may have an effect:  Right click on the taskbar, and select properties, then click on the "Customise..." button.  It looks like you can select between three options, one is to hide the icon all together.

https://i.ibb.co/Fxwgy63/Untitled-1.jpg (https://i.ibb.co/Fxwgy63/Untitled-1.jpg)

https://i.ibb.co/N7mMSpg/Untitled.jpg (https://i.ibb.co/N7mMSpg/Untitled.jpg)


Title: Re: Electrum - Privacy issue (Windows)
Post by: hatshepsut93 on January 30, 2020, 03:36:18 PM
I just tested, it shows the balance of the latest opened wallet, so you can just open some empty dummy wallet before closing Electrum to show zero balance. Though I don't know if its possible to recover the previous Electrum labels if you dig through some system files.

I really don't think it's that big of an issue, if you are sharing your PC with someone you have bigger things to worry about, they could install a keylogger and steal your coins. But if it bothers you, you could probably open an issue on github and ask them to change the description string for notification service.


Title: Re: Electrum - Privacy issue (Windows)
Post by: NeuroticFish on January 30, 2020, 03:46:44 PM
I haven't checked yet for the W10.

On Windows 10 the tray icon seems to go away as soon as I close Electrum. But I use the portable exe... Is the other one installing some sort of agent for faster start?!
Indeed it's an unnecessary info on the tray icon, which causes more trouble than help.

I just tested, it shows the balance of the latest opened wallet, so you can just open some empty dummy wallet before closing Electrum to show zero balance. Though I don't know if its possible to recover the previous Electrum labels if you dig through some system files.

I believe that the tray icon is not intended to be there after closing Electrum and it may be just something hanging in the app when it should close.


Title: Re: Electrum - Privacy issue (Windows)
Post by: stompix on January 30, 2020, 04:18:06 PM
o_e_l_e_o, I can confirm that even after completely shutting down the computer and run CCleaner (it has zero effect on this issue) that notification is still visible in Notifications Area Icons with a balance of last opened wallet.

As many have said, I've tested it right now cause it sounds really weird and it's not happening on my laptops on my W7 with the storage or on my usual wallets on W10. The icon does indeed show my full balance (which I didn't notice in two years of running it) but it disappears when I close the wallet.

Is damn weird.
I wonder, if the notification is still hanging there, does it update your balance if you receive a tx even if you have closed the program?

Anyhow, it seems we all use 3.3.8, ...maybe...


Title: Re: Electrum - Privacy issue (Windows)
Post by: Abdussamad on January 30, 2020, 07:09:20 PM
you should make an issue about it on github

mind you if you really want privacy you should create separate user accounts for separate users in your OS


Title: Re: Electrum - Privacy issue (Windows)
Post by: BitMaxz on January 30, 2020, 09:09:38 PM
I tried the method from this video https://www.youtube.com/watch?v=2c1-GcaiT_0 and it clears the Icon of Electrum but after I open the Electrum again it shows up again.

However, both IconStream and PastIconStream are totally deleted I can't find a way how to put them back.

The up arrow(Under notification tray) is also gone I can't put them back. I just warn you to don't follow the guide from that video.


Title: Re: Electrum - Privacy issue (Windows)
Post by: pooya87 on January 31, 2020, 06:01:18 AM
However, both IconStream and PastIconStream are totally deleted I can't find a way how to put them back.

you have to restart explorer.exe after you deleted those keys. kill it first from task manager and then run it again by typing it in File > New task
there is also this post in SO that could help: https://superuser.com/questions/122774/how-to-clear-the-list-of-notification-area-icons-in-windows-7


Title: Re: Electrum - Privacy issue (Windows)
Post by: Pmalek on January 31, 2020, 09:48:01 AM
Nice find Lucius, I had no idea this info was displayed in the open like that.
I had some issues finding what you mean on Windows 10 so I found this source that mentions the same problem: https://www.gitmemory.com/issue/spesmilo/electrum/5665/536391267

If you do a search on Windows 10 for "Select which icons appear on the taskbar" it should take you directly to the location where the info about your Electrum wallet is posted. I will check this later on my PC where Electrum is installed. 


Title: Re: Electrum - Privacy issue (Windows)
Post by: Lucius on January 31, 2020, 11:16:32 AM
I really don't think it's that big of an issue, if you are sharing your PC with someone you have bigger things to worry about...

mind you if you really want privacy you should create separate user accounts for separate users in your OS

For me personally, this is not a big problem -  I have my own PC, but the goal was to warn others who might share a computer with someone. It is just about privacy protection, and I agree that there are many bigger issues that need to be addressed.

On Windows 10 the tray icon seems to go away as soon as I close Electrum. But I use the portable exe... Is the other one installing some sort of agent for faster start?!

It is not about tray icon, it goes away in my case also - but it can still be found in Notifications area where it shows balance of the last opened wallet. nc50lc is confirmed same issue on W10, but as you say, you use portable version.

Is damn weird.
I wonder, if the notification is still hanging there, does it update your balance if you receive a tx even if you have closed the program?
Anyhow, it seems we all use 3.3.8, ...maybe...

It is still there, after 24 hours I open wallet last time - but it is not updating balance and it shows old BTC price from yesterday. Yes, I am using 3.3.7 with Nano S, but i will make an update to 3.3.8 and select option "Hide icon and notifications" for Electrum, then I'll see if there is any difference.

Nice find Lucius, I had no idea this info was displayed in the open like that.

I was thinking this is only related to W7, but some basic things stay the same in all versions. However, I think only one who would really seek it would find such information, Electrum has been around for so many years and no one has ever reported this (at least as far as I know).


Title: Re: Electrum - Privacy issue (Windows)
Post by: DireWolfM14 on January 31, 2020, 03:47:02 PM
I'm running 3.3.8 (installed version, not standalone,) on my Win7 machine, and I'm not having the same issue.  My Win10 machine behaves the same way, i.e. the icon goes away as soon as I close the program.

Curious; I can right-click on the Electrum Icon in the tray, and select Exit Electrum, do you have that option, and does the icon go away if you do?  Have you checked your Task Manager to see if Electrum is still running in the background some how?  Does it behave the same way whether your Nano is plugged into the USB port, or not?


Title: Re: Electrum - Privacy issue (Windows)
Post by: Pmalek on January 31, 2020, 10:43:29 PM
When I checked this on my laptop there was no notification from Electrum. So, I opened up one of my wallets on Electrum just to make sure and after that the notification appeared. It shows the balance and name of the wallet I opened. After closing Electrum it was still there. I restarted my PC and the info remains. So apparently it stays there for a while but since it wasn't there the first time I checked it probably gets dropped from the notification area after a while. I will check again tomorrow if it changes after the laptop was shut down and not just restarted.


Title: Re: Electrum - Privacy issue (Windows)
Post by: AltcoinBuilder on February 01, 2020, 07:50:36 AM
they should change it to a static text like this example (it is in c#):

https://docs.microsoft.com/en-us/dotnet/framework/winforms/controls/app-icons-to-the-taskbar-with-wf-notifyicon



Title: Re: Electrum - Privacy issue (Windows)
Post by: Lucius on February 01, 2020, 11:07:45 AM
I'm running 3.3.8 (installed version, not standalone,) on my Win7 machine, and I'm not having the same issue.  My Win10 machine behaves the same way, i.e. the icon goes away as soon as I close the program.

Perhaps you misunderstood, it is not about icon you see in the tray (left from clock/date), but it is about an icon which is displayed on in Notification Area Icons - you get there by click on Customize (Taskbar and Start Menu Properties). This is not related to an icon in the tray (it goes away when I close Electrum) or about some Electrum process that is still working in the background.

So apparently it stays there for a while but since it wasn't there the first time I checked it probably gets dropped from the notification area after a while. I will check again tomorrow if it changes after the laptop was shut down and not just restarted.

I just check is it still here today, and it is still there - but it is dropping down on the list as you noticed, and it will probably disappear completely until I start Electrum again.


Title: Re: Electrum - Privacy issue (Windows)
Post by: pooya87 on February 02, 2020, 03:53:27 AM
they should change it to a static text like this example (it is in c#):

the tooltip is showing the wallet status at all times, for instance when you start the client it shows syncing and how much left to download, your connection status,... then when everything is finished it is changed into "balance + wallet name". it can't be changed to a static text.
the fix is simple, the following lines should be edited to exclude the balance from the tooltip:
https://github.com/spesmilo/electrum/blob/a041a0c0755159a7dfe0fd9ca6f30fe50545c8ff/electrum/gui/qt/main_window.py#L854-L868


Title: Re: Electrum - Privacy issue (Windows)
Post by: Pmalek on February 02, 2020, 01:54:25 PM
Even after a complete shutdown of the PC and one day later the wallet name and balance is still displayed in the notifications area. I am really curious how long it stays there. Hopefully I wont be needing my Electrum app in the next couple of days so I can check this.
Personally it is not too big of an issue to me. There are other wallets that you can open and see more information than this.


Title: Re: Electrum - Privacy issue (Windows)
Post by: Lucius on February 02, 2020, 02:44:49 PM
the fix is simple, the following lines should be edited to exclude the balance from the tooltip:

So fix is simple, but can only be done by Electrum developers in next version/s?

Pmalek, in my case it is still there after 4 days, but for anyone who does not share his PC or sent it for repair, there is no real danger. In some cases, it may be better to live in blissful ignorance than to burden yourself with little things ;)


Title: Re: Electrum - Privacy issue (Windows)
Post by: TryNinja on February 02, 2020, 03:52:43 PM
So fix is simple, but can only be done by Electrum developers in next version/s?
You can also edit the code and build your own version yourself. :D

I'm not sure if you can simply just edit and run it through python, but building the binaries look simple anyways.


Title: Re: Electrum - Privacy issue (Windows)
Post by: pooya87 on February 03, 2020, 03:04:42 AM
So fix is simple, but can only be done by Electrum developers in next version/s?
You can also edit the code and build your own version yourself. :D

I'm not sure if you can simply just edit and run it through python, but building the binaries look simple anyways.

that's true but don't go messing around in the code by changing it if you are not familiar with python and Electrum's source code, you may end up messing things up.


Title: Re: Electrum - Privacy issue (Windows)
Post by: Pmalek on February 03, 2020, 09:32:16 AM
Pmalek, in my case it is still there after 4 days, but for anyone who does not share his PC or sent it for repair, there is no real danger. In some cases, it may be better to live in blissful ignorance than to burden yourself with little things ;)
I don't see it as a burden but it is still an interesting case that makes me thing how long the notification will remain visible there. Those who see it as a burden can just create a new wallet and open that new wallet before closing Electrum, like someone already suggested. That way the notification will show an empty wallet.


Title: Re: Electrum - Privacy issue (Windows)
Post by: HCP on February 04, 2020, 01:28:47 AM
the tooltip is showing the wallet status at all times, for instance when you start the client it shows syncing and how much left to download, your connection status,... then when everything is finished it is changed into "balance + wallet name". it can't be changed to a static text.
the fix is simple, the following lines should be edited to exclude the balance from the tooltip:
https://github.com/spesmilo/electrum/blob/a041a0c0755159a7dfe0fd9ca6f30fe50545c8ff/electrum/gui/qt/main_window.py#L854-L868
As per pooya87's instructions...
https://talkimg.com/images/2023/11/15/zLNeI.png


Compiled it up on my Ubuntu VM... and we end up with:
https://talkimg.com/images/2023/11/15/zLIGd.png


and this:
https://talkimg.com/images/2023/11/15/zLsf5.png


and this:
https://talkimg.com/images/2023/11/15/zL3Kz.png


I'm wondering if maybe a "privacy" switch of some sort in the settings might be one way to deal with this...



EDIT: Indeed... it's fairly simple to add one in  ;) ;D  8):
https://talkimg.com/images/2023/11/15/zLvH2.png


Currently requires a restart (or the closing and re-opening of wallet files) if you change the setting though... as I can't figure out how to force the main window to "update" the statusbar info immediately... I'm guessing there is probably a way to do it, but I'm not overly familiar with the Electrum code base... just enough to be "dangerous" :P


Title: Re: Electrum - Privacy issue (Windows)
Post by: Lucius on February 05, 2020, 01:37:01 PM
HCP, so you played around with the code and you add this option to Electrum? I am asking this because I check settings in 3.3.7 and I do not see that option. I still haven't updated to 3.3.8, it doesn't really matter to me since I only use Electrum in combination with Ledger.


Title: Re: Electrum - Privacy issue (Windows)
Post by: TryNinja on February 05, 2020, 08:58:37 PM
HCP, so you played around with the code and you add this option to Electrum? I am asking this because I check settings in 3.3.7 and I do not see that option. I still haven't updated to 3.3.8, it doesn't really matter to me since I only use Electrum in combination with Ledger.
Electrum shows your balance on your Windows notification center for everyone to see, so he commented that part of the code and made it only show a "Synced" text instead of the balance (for privacy reasons).

Edit: oh, you are talking about the checkbox. Yes, he probably did that as I also couldn't find anything in the code (and the "I can't figure out how to..." part). :D


Title: Re: Electrum - Privacy issue (Windows)
Post by: DireWolfM14 on February 06, 2020, 03:24:02 PM
~
Perhaps you misunderstood, it is not about icon you see in the tray (left from clock/date), but it is about an icon which is displayed on in Notification Area Icons - you get there by click on Customize (Taskbar and Start Menu Properties). This is not related to an icon in the tray (it goes away when I close Electrum) or about some Electrum process that is still working in the background.

I was indeed mistaken, sorry for the confusion.  I see that your concern is now mine as well, my menu also shows my balance, even when Electrum isn't running.  I don't share my computers, nor send them out for repair, but it's still something that should be addressed in my opinion.


just enough to be "dangerous" :P

Apparently, lol.  That's a great hack, you should submit a pull request to have that feature added to the next release.

Are you using Visual Basic to modify the code and build binaries?


HCP, so you played around with the code and you add this option to Electrum? I am asking this because I check settings in 3.3.7 and I do not see that option. I still haven't updated to 3.3.8, it doesn't really matter to me since I only use Electrum in combination with Ledger.

Like TryNinja said, those are features that HCP added himself.  That checkbox is not a feature in version 3.3.8.


Title: Re: Electrum - Privacy issue (Windows)
Post by: pooya87 on February 07, 2020, 04:54:50 AM
Are you using Visual Basic to modify the code and build binaries?

Visual Basic is a programming language, you need an Integrated development environment (IDE) to modify the code and build it. both Visual Studio (for windows only but more powerful) and Visual Studio code (open source multiple OS) are capable of doing this, there is also a bunch more IDEs available here: https://wiki.python.org/moin/IntegratedDevelopmentEnvironments


Title: Re: Electrum - Privacy issue (Windows)
Post by: HCP on February 10, 2020, 06:36:33 AM
Are you using Visual Basic to modify the code and build binaries?
... you need an Integrated development environment (IDE) to modify the code and build it.
IDE? Nope...

I simply used a text editor (notepadqq) within an Ubuntu 18.04 VM... and edited the following files after cloning the git repository:

/electrum/gui/qt/main_window.py
/electrum/gui/qt/settings_dialog.py

I basically just copied "similar" code in each file to add in the checkbox into the settings window and then adjust the statusbar to say "synced" if the checkbox is checked. ;)

Then I followed the instructions here to build the Windows binaries: https://github.com/spesmilo/electrum/tree/master/contrib/build-wine


Apparently, lol.  That's a great hack, you should submit a pull request to have that feature added to the next release.
I'll have to tidy up the code a bit first... and probably do some "proper" testing to make sure I haven't broken anything... but a pull request probably isn't completely out of the question. :)


Title: Re: Electrum - Privacy issue (Windows)
Post by: Kakmakr on February 12, 2020, 01:29:36 PM
the fix is simple, the following lines should be edited to exclude the balance from the tooltip:

So fix is simple, but can only be done by Electrum developers in next version/s?

Pmalek, in my case it is still there after 4 days, but for anyone who does not share his PC or sent it for repair, there is no real danger. In some cases, it may be better to live in blissful ignorance than to burden yourself with little things ;)

I tested it on my computer and it only showed it whilst the wallet was opened. So I doubt that you would send your computer for repairs with the wallet being open.  ???  <Do you guys have a automatic login enabled for your wallet when you boot or reboot your OS?>  I do not launch the wallet every time I use the computer.

Any experienced hacker can remote your desktop and watch you while you work with your wallet and then see your balance and even use a key logger to capture your password for the wallet.  >:(

I wonder why the developers added this in the first place or is this a cached notification from the last transaction that you made that adjusted your balance?  <So that you can see the last balance, even if you are not authenticated to a server for offline use?>


Title: Re: Electrum - Privacy issue (Windows)
Post by: Lucius on February 12, 2020, 02:49:13 PM
I tested it on my computer and it only showed it whilst the wallet was opened. So I doubt that you would send your computer for repairs with the wallet being open.  ???  <Do you guys have a automatic login enabled for your wallet when you boot or reboot your OS?>  I do not launch the wallet every time I use the computer.

Any experienced hacker can remote your desktop and watch you while you work with your wallet and then see your balance and even use a key logger to capture your password for the wallet.  >:(

I wonder why the developers added this in the first place or is this a cached notification from the last transaction that you made that adjusted your balance?  <So that you can see the last balance, even if you are not authenticated to a server for offline use?>

I think you should read from the beginning, you are very likely referring to the icon that appears in tray when your wallet is open. It is not about that icon, but about icon "which is displayed on in Notification Area Icons - you get there by click on Customize (Taskbar and Start Menu Properties).

I really don't know what kind of automatic logging in your wallet you're talking about? Wallet is not open, but Windows is keep information about last open wallet in Notification Area Icons.


Title: Re: Electrum - Privacy issue (Windows)
Post by: pooya87 on February 13, 2020, 05:21:31 AM
I wonder why the developers added this in the first place or is this a cached notification from the last transaction that you made that adjusted your balance?  <So that you can see the last balance, even if you are not authenticated to a server for offline use?>

it is a windows feature that is added by Microsoft!
whenever you have any application that shows up in your "Notification Area" (which is the space beside the clock in windows 7) your windows stores its "description". for example for volume it shows a speaker icon and it stores the description of it as something like "Speakers: 50%".


Title: Re: Electrum - Privacy issue (Windows)
Post by: Pmalek on February 13, 2020, 09:46:19 AM
Snip
Close your Electrum software.

If you are using Windows 7/10 click on the search bar at the bottom of your desktop and enter Select which icons appear on the taskbar.
Now click on the system settings that appear and you will see you last opened wallet name and its balance in the notification area.
It remains there even after a restart and after you shut down your computer. Someone reported it was there 4 days after he used his Electrum wallet the last time.