Install Third-party Plugins with the New Version of Electrum Wallet

[Pmalek]

The next version of Electrum will allow users to install third-party plugins. This is an opt-in feature where you need to save the plugins as zip files in your user data directory. You have to use administrator permissions and authorize them with a password. Third-party plugins won't have an auto-update feature. Each new update will have to be authorized by the user again.

I don't know why but I was under the impression that third-party plugins were already supported by Electrum.

Read more about it below:
https://x.com/ElectrumWallet/status/1912064951230886173
https://github.com/spesmilo/electrum/pull/9718

[Findingnemo]

Might be an welcome addition but am I being paranoid about the potential security concerns due to the third party plugins? Already we got tons of fake wallets that replicate Electrum and other most used ones and now those malicious actors will keep launching the plugins that might steal data or something.

But good thing is average user may not try to do anything because it needs specific knowledge about what they are doing and possible outcomes.

[Ambatman]

Simple and secured my motto. Yes this would bring about versalities
But I can't just rule out the risk it may pose.
If anything goes wrong it could affect electrums reputation but I guess they should know about this already.
Well it's not like it's compulsory for every user so I have nothing against
Good Initiative, It's good to see they are interested in growth and satisfying some customers
If it was not needed they wouldn't have brought it up.

[Forsyth Jones]

I also had the impression that third-party plugins were already allowed by Electrum...

Will there be a dedicated page on the Electrum website listing the verified and trustworthy plugins (whether third-party or official)?

In keepass2 (an open source and offline password manager), you can install third-party plugins to expand the functionalities of the password manager, such as allowing the use of Windows Hello, logging in with a Trezor device and so on.

It would be a welcome implementation, since developers may not have time to dedicate to all the improvement requests and new feature implementations. However, I'm not a security expert and I remain cautious with third-party plugins. I don't know how this implementation will be, and I recommend caution, don't go installing any plugin you come across, unless it's in a sandbox environment or other test environments.

[pooya87]

I don't know why but I was under the impression that third-party plugins were already supported by Electrum.

The feature to extend the existing features of Electrum wallet through plugins were added in version 1.7 many years ago.
https://github.com/spesmilo/electrum/blob/9d42505eec0b58e7ae1fc0cdd851daf9865fc906/RELEASE-NOTES#L2071-L2077

This change is going to force the user to "authenticate" their installation by requiring the plugin reside in a directory with root permission. That way it aims to prevent "plugin installation by malware". You can read more about the logic behind it in this issue: https://github.com/spesmilo/electrum/issues/9701

I still dislike it though. Because the user can still manually but unknowingly introduce a vulnerability into their own software and wallets should remain as clean as possible in my opinion. Although I get that this feature has its own utilities as well.

[nc50lc]

Will there be a dedicated page on the Electrum website listing the verified and trustworthy plugins (whether third-party or official)?

I can't find any reference in the website's GitHub repository and in the update in the official documentation about plugins,
But you can monitor this repository's fork list (under "About") to see the third-party plugins that are being developed specifically for that feature.
Link: github.com/spesmilo/electrum-plugins

[Pmalek]

Might be an welcome addition but am I being paranoid about the potential security concerns due to the third party plugins? Already we got tons of fake wallets that replicate Electrum and other most used ones and now those malicious actors will keep launching the plugins that might steal data or something.

All of this is optional. In fact, you probably don't have any plugins installed right now even if you use Electrum and the software is working just fine. The average user doesn't need them. If you decide to use them, apply the same logic you use with any software you install. Ask yourself do you really need it and why. Then, check who developed it, what does their track record look like, and what's the feedback of the community. And don't be in a hurry. Let others test it and post feedback first before you install it. I am not sure what kind of verification steps exist for Electrum plugins and how one can check the security of the add-ons.

Will there be a dedicated page on the Electrum website listing the verified and trustworthy plugins (whether third-party or official)?

I only know of https://electrum.readthedocs.io/en/latest/plugins.html where it mentions some of the "Internal Plugins" as they call them. Those are the ones maintained by Electrum and its team.

[dkbit98]

I see a lot of negative comments on twitter from people that are against adding third party plugins.
Maybe we can see some privacy enhancing plugin, but I have no clue have they are actually working.
If I remember correctly back in the days there was something similar with chipmixer plugin, and I doubt that was made by official electrum team.

[khaled0111]

I see a lot of negative comments on twitter from people that are against adding third party plugins.

Honestly, I can’t blame them. I'm also concerned about the potential security and privacy risks this new update may bring.
People trust Electrum and use it mainly because of the good reputation it and its developers have built over the years.
I might be wrong, but with this new update, the security of the wallet won’t be entirely in the hands of the core developers anymore.

I know that users will need admin permissions to install third-party plugins and that auto-updates will be disabled, but I don’t think this will be enough to protect non-technical users (and I believe they represent most of the wallet's users).

[Pmalek]

I know that users will need admin permissions to install third-party plugins and that auto-updates will be disabled, but I don’t think this will be enough to protect non-technical users (and I believe they represent most of the wallet's users).

Non-technical users and beginners won't even know that Electrum plugins exist, let alone where to find and how to install them. And even if they do, they only have themselves to blame for any harm they cause. Why would you go out of your way to install and give permissions to something you don't understand or trust? if you do, blame yourself. I am sure Electrum isn't going to advertise these 3rd-party plugins in any way. If you get them from a scammer, who is to say you wouldn't do other stupid things that could lead to you losing your BTC, like installing a fake wallet or importing your seed somewhere online. 

[satscraper]

If you get them from a scammer, who is to say you wouldn't do other stupid things that could lead to you losing your BTC, like installing a fake wallet or importing your seed somewhere online.  

Yeah, 3^rd plugins may potentially come from malicious actors so I treat all of them as possible threats to my stash. I would avoid installing any into wallets that support them. Thankfully Foundation team is very strict about this kind of stuff so my Passport Core will never support such plugins ^{which is exactly how I like their products}.

[hugeblack]

It may be a disclaimer for developing plugins that Electrum developers don't want to officially support, but it's best to avoid installing them unless you really know what you're doing.

[Forsyth Jones]

The question is, what can be added to Electrum to improve the user experience? Can plugins provide this? At the moment, I've no ideas about which plugins could be developed, besides the existing ones that I didn't find very interesting, I've never needed them.

Maybe something related to additional encryption would be welcome. But I'd only install it for my test wallets or offline environment.

It's all still a beginning, time will tell if it will be a good addition. I usually use some plugins in keepass2, but after that I started using only Keepassxc, which doesn't allow the installation of plugins, but it's very complete.

[TryNinja]

The question is, what can be added to Electrum to improve the user experience? Can plugins provide this? At the moment, I've no ideas about which plugins could be developed, besides the existing ones that I didn't find very interesting, I've never needed them.

I remember ChipMixer releasing a plugin for Electrum many ages ago, which they eventually discontinued. Probably one of the reasons was the difficulty to install it, they even tried to get it merged to Electrum, but no luck because of the nature of their business.

News:

We have created Electrum plugin. It's not merged yet, but you can check it here: https://github.com/chipmixer/electrum/tree/plugin/plugins/chipmixer

Small update here.
We have created ChipMixer plugin for Electrum. It allows you to tumble your bitcoins with us without leaving your wallet and it is even easier to use than website (prefill forms, creates new wallet and imports private keys for you).

You can check readme and screenshots here: https://github.com/chipmixer/electrum/tree/plugin/plugins/chipmixer
Pull request is pending, maybe it will get included in next version of Electrum.

[Pmalek]

The question is, what can be added to Electrum to improve the user experience? Can plugins provide this? At the moment, I've no ideas about which plugins could be developed, besides the existing ones that I didn't find very interesting, I've never needed them.

Where can we see a complete list of already supported Electrum plugins? I know of the following source, but there are probably better ones out there.
https://electrum.readthedocs.io/en/latest/plugins.html

One feature that would make Electrum better is the option for QR signing for airgapped hardware wallets like Jade, SeedSigner, etc. Electrum doesn't support it. Competitor apps like Sparrow, Nunchuk, Blockstream Green, and others support it. I think that's something that would be useful.

[pooya87]

The question is, what can be added to Electrum to improve the user experience? Can plugins provide this? At the moment, I've no ideas about which plugins could be developed, besides the existing ones that I didn't find very interesting, I've never needed them.

In the menu of your Electrum client if you click on the Tools > Plugins you will see a list of the plugins that can be installed with a ? in front that explains what they do (From version 4.5.5). Some of them look interesting even though I've never used any of them either; like the LabelSync one for those who want a backup of their labels and a way to recover it again in another wallet, and there are some who want this.

[Pmalek]

Some of them look interesting even though I've never used any of them either; like the LabelSync one for those who want a backup of their labels and a way to recover it again in another wallet, and there are some who want this.

LabelSync looks neat if you have wallets with many transactions and it would be a nightmare if you lost your labels. Not that long ago, some developers created a standard for saving wallet labels, where the data can be exported and imported among different wallets that support the standard. My guess is that Electrum will add that sooner or later. LabelSync saves your labels on a third party server in an encrypted format. That's ok, although possibly a little privacy infringing.

Labels are saved in your Electrum wallet files. But is there a way to only save the labels on your local machine without a copy of your wallet file and without using LabelSync?

[nc50lc]

Not that long ago, some developers created a standard for saving wallet labels, where the data can be exported and imported among different wallets that support the standard.
My guess is that Electrum will add that sooner or later.

Do you mean BIP-0329?
Link: github.com/bitcoin/bips/blob/master/bip-0329.mediawiki

If so, during the first few months, it seemed like it was going to be implemented quickly.
But for some reason, the one who is working on the implementation never updated his Pull Request for almost a year now.
The main developers aren't working on it either.
Link: github.com/spesmilo/electrum/pull/8614

[Abdussamad]

Labels are saved in your Electrum wallet files. But is there a way to only save the labels on your local machine without a copy of your wallet file and without using LabelSync?

You can export them. Wallet menu > labels > export

[Pmalek]

Do you mean BIP-0329?

Yes, I that's the standard I was talking about.

You can export them. Wallet menu > labels > export

Yes, that's right. I now remember that I have seen that option in Electrum before but totally forgot about it. I guess it's fair to assume that the exported file can only be imported back to Electrum and not any other wallets, right? which is another reason why Craig Raw created BIP0329 in an attempt to standardize it.