How Leather Carries Out Secure Transactions

Wallet security depends on how well your private keys are secured. In the case of custodial wallets, your security is in the hands of third-party services that manage your keys for you. While these services can be convenient, these third parties can pose a risk if compromised. In many cases, user assets can be accessed without users’ knowledge or consent.

Non-custodial wallets like Leather give users full control over their private keys and, by extension, their assets. But not all non-custodial wallets are built the same.

Here, we explore how Leather provides that extra layer of security.

The Core of Leather’s Security: Self-Custody

Leather is an open-source self-custodial wallet. This means that its code is open for the public to view and users retain access to their private keys (known as Secret Keys in the app).

Since Leather is a hot wallet, a user’s private keys are stored on the device on which the wallet has been installed.

Leather initially used PBKDF2 (Password-Based Key Derivation Function 2) to encrypt and store users' keys. It's a way to turn a password into a cryptographic key to encrypt data. This method relies heavily on the processing power of a computer's CPU to create the key.

Leather was updated to use a different method called Argon2id to improve security. Argon2id makes it more difficult for attackers to guess passwords, even with powerful computers. This change means that when users set a password for their wallet, it's turned into a key in a much safer way.

Integration with Ledger Hardware Wallets

Leather gives you an extra layer of protection with its integration with Ledger hardware wallets. With Leather, you can have the convenience of a software wallet with the security of a hardware wallet.

Leather users can connect their Ledger devices directly to the Leather wallet, adding to the security of their Bitcoin and Stacks transactions.

The integration allows users to perform a variety of transactions securely, such as sending and receiving Bitcoin (BTC), managing Ordinals, and interacting with the broader Bitcoin web3 ecosystem.

Support for Multisig

In the last quarter of 2023, Leather began supporting Asigna, a native multisig solution tailored for Bitcoin and Stacks, to enable multisig support.

Multisig is a digital signature scheme requiring multiple keys to authorize a cryptocurrency transaction. Instead of relying on a single key (and thus a single point of failure), multisig involves several keys. This multi-level approach increases security as a transaction needs more than one party’s approval before execution.

Leather Wallet supports multisig for Stacks transactions — a particularly useful feature for organizations or groups where management of funds requires consent from multiple stakeholders.

Leather’s Longtime Dedication to Wallet Security

While Leather has gradually introduced features that emphasize wallet security, it’s also important to highlight that the team behind Leather has a long track record of addressing wallet vulnerabilities over the years. The resolution of security vulnerabilities is crucial for any wallet, as many of these potential hazards can put users at risk.

Users have access to a full guide detailing key highlights from Leather’s security audits. Some highlights, however, include the following:

Preventing Private Key Caching by Browsers

In a previous code audit for Leather, Least Authority revealed that a “demonic vulnerability” existed, a security issue common across several browser-based crypto wallets.

The presence of this vulnerability meant that browsers would cache a wallet’s secret keys in their local storage. Since the keys were now stored in an accessible location, users’ private keys could be exposed, allowing outside parties to potentially reconstruct them from the browsers’ cache.

Leather addressed the demonic vulnerability by implementing a fix to prevent the caching of secret keys in browser local storage.

By ensuring users’ private keys are not stored in their browser’s cache, attackers can no longer exploit them for transaction authorizations. This approach is somewhat unique as it specifically targets the security risks associated with browser-based local storage.

Encrypted Key Phrase When Not in Use

As detailed in Leather’s security report, the "Plain Text Password Handling" issue in Leather involved users’ Secret Keys being stored in their browser’s memory in cleartext.

This posed a serious security risk as potential attackers could dump the extension process memory and steal a user’s Secret Key phrase, allowing them to take control of a wallet and all its assets.

Leather fixed the plain text password handling issue by introducing a function named ‘blastUndoStackToRemovePasswordFromMemory’.

The function is designed to remove the password from memory shortly after its use. It works by clearing the undo stack in the browser, which can potentially hold previous values of the input fields, including passwords.

This approach helps to ensure that sensitive data like passwords are not left in memory where malicious actors might access them.

Uniform Locking Mechanism

In a previous version of Leather, if a user had the wallet open in multiple tabs or windows, locking their account in one browser or tab didn't lock it in the others. The wallet remained accessible and, therefore, vulnerable in windows and tabs that were still open.

Leather resolved this issue by ensuring that when the wallet is locked in any one window or tab, it automatically locks and closes in all others, enhancing overall security.

This directly impacts transaction security. By ensuring the wallet locks simultaneously in all instances, Leather prevents unauthorized access and potential misuse in one of the still-open tabs or windows.

This uniform locking mechanism maintains the integrity and security of transactions by minimizing the window of opportunity for unauthorized access.

Use Leather For Your Bitcoin Transactions

Any crypto user needs a wallet that prioritizes security, offers robust encryption, and has regular upgrades.

Wallet security is one of the many reasons why Leather is open-source. Leather’s code is available to the public as proof of security, and the community, at large, can find bugs and suggest fixes before attackers exploit them.

This community-based effort continues to be a cornerstone of Leather’s development. Together, we're working towards building a more versatile — and secure — Bitcoin wallet that caters to users from all walks of life.

Connect to web3 applications built on Bitcoin with the Leather browser extension. Install Leather – the only wallet you need to tap into the multilayered Bitcoin economy – today.