AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 29 Bitcoin

feat(core): hide chars in passphrase input

Public commit record

What the developer wrote

Authored by obrusvit

80/100 · Strong
feat(core): hide chars in passphrase input

- hide already written characters in the passphrase keyboard in Delizia
and Bolt
- holding a finger in the input field reveals the whole passphrase in a
potentially multi-line manner
- update fixtures
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit changes how Trezor hardware wallets display passphrase entry on screen. Previously, the passphrase characters were shown in plain text as the user typed them. After this change, already-typed characters are hidden (shown as dots or asterisks), with only the most recently typed character briefly visible. The user can press and hold in the input area to reveal the full passphrase for verification. This is a security/usability improvement to reduce shoulder-surfing risk, not a fix for an exploitable vulnerability.

Recommended action

No immediate security action required. Treat as a normal privacy-hardening UI improvement. Reviewers may want to verify that the reveal gesture does not accidentally persist on screen after touch release, and that the masking behavior does not interfere with accessibility or user confirmation flows.

Security signals we found

01

UI change masks sensitive passphrase input to mitigate shoulder-surfing

02

Adds time-bounded reveal of last character and touch-to-reveal full passphrase

03

Disables keypad interaction while passphrase is fully revealed

04

Updates UI test fixtures indicating behavior change is intentional and tested

05

No cryptographic, memory-safety, or authentication logic changed

Risk score

Why this scored 29/100

Our methodology →
Potential impact 5/30
Exploitability 0/25
Stealth signal 0/15
Affected reach 10/15
Confidence 9/10
Evidence quality 5/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.