diff --git a/hubzilla/addon/g1wallet/g1wallet.php b/hubzilla/addon/g1wallet/g1wallet.php index df4fcb2..59eb52c 100644 --- a/hubzilla/addon/g1wallet/g1wallet.php +++ b/hubzilla/addon/g1wallet/g1wallet.php @@ -107,7 +107,7 @@ function g1wallet_content() { head_add_css('/addon/g1wallet/view/css/g1wallet.css'); } if (function_exists('head_add_js')) { - head_add_js('/addon/g1wallet/vendor/scrypt-js-3.0.1.min.js'); + head_add_js('/addon/g1wallet/vendor/bip39-3.1.0.min.js'); head_add_js('/addon/g1wallet/view/js/g1wallet.js'); } diff --git a/hubzilla/addon/g1wallet/g1wallet_renderer.php b/hubzilla/addon/g1wallet/g1wallet_renderer.php index a5ff67d..e435783 100644 --- a/hubzilla/addon/g1wallet/g1wallet_renderer.php +++ b/hubzilla/addon/g1wallet/g1wallet_renderer.php @@ -70,26 +70,22 @@ function g1wallet_render_landing($access) { function g1wallet_render_unlock_form() { // Renders the wallet unlock form. // The form is handled entirely by g1wallet.js — it does NOT POST to the server. - // Pseudo and password never leave the browser. + // The mnemonic never leaves the browser. + // + // Per Duniter HD Wallet RFC 0015 (Dubp_HD_Wallet), the wallet's keypair is + // derived from a 12-word BIP39 mnemonic (English wordlist), using its + // entropy as input to a BIP32-Ed25519 derivation — not a raw PBKDF2 seed. $out = '
Enter your Ğ1 credentials. These are used only in your browser to derive your keypair. They are never sent to the server.
'; + $out .= 'Enter your 12-word Ğ1 mnemonic phrase. It is used only in your browser to derive your keypair. It is never sent to the server.
'; $out .= '