Having a hard-coded location for the wallet.dat is a bad practice #2363

Having a default hard-coded location for the wallet.dat file allows any malware to easily find it and steal the data contained inside. It would be more appropriate to have the user keep that file in a private location on the file system, and load it into the bitcoin software manually only when he/she needs to spend coins. This will make it harder for malware to locate the file, as now it will have to search the entire file-system for something that looks like a bitcoin private key.

Perhaps a separate agent similar to pageant for Putty would be appropriate. It will hold private keys in memory only when bitcoin needs to use them.

If you have malware on your system, then the malware can simply replace bitcoind/Bitcoin-Qt with a wallet-stealing version of bitcoind/Bitcoin-Qt... right?

I'm generally against whack-a-mole security features that will stop THIS round of malware, but will do nothing against tomorrow's smarter malware.

Honestly Bitcoin software features that go anywhere near the wallet.dat should be as predictable and idempotent as possible if you ask me. The last thing we need is some complexity intending to add casual obfuscation causing a wallet to get corrupted...

I agree these kind of measures cannot protect against the general case of malware. However, a decade or so ago (but also a few times since) there were various bugs in the browser origin policy that made it possible to retrieve a file if you had the exact name. This is what led Mozilla, for example, to add a randomized string to the profile directories.

Today's threats are different, with the common attack vector to exploit bugs in flash, java plugins or the javascript compiler itself. Thus the attacker gains full control over the browser process and playing hide and seek with files won't help you for long. So I think the security gained by this is at most marginal...

Anyway, multi-wallet support is going to allow exactly what you propose.

We are going to have multi-wallet support? When will it probably be done?

If you need multiwallet support badly, can you help testing @codeshark's pulls?

https://github.com/bitcoin/bitcoin/pulls/CodeShark

Testing will always help get things merged sooner.

Closing this issue, as the consensus is that we don't agree that this is bad practice.