2

I am wondering if there are any security issues with other's knowing my RPC credentials. I'm not familiar with RPC and how it works or anything.

Reason I'm asking... I make youtube videos. Right now I'm editing one where I am using the Lightning Network. Everything in the video is on the testnet. So I'm not at risk of any real damage being done to me. Most I'll lose is the progress I made setting up the testnet and lightning network on this machine. However, if my RPC credentials don't matter, it would save me a lot of time having to blur them out in my video.

Thank you.

AltcoinXP-Anthony
  • 31
  • 1

1 Answers1

3

Yes, you should keep your RPC credentials private. RPC credentials give someone control over your node. They will be able to issue all of the commands that you can issue, including sending coins, shutting down the node, disconnecting and connecting peers, etc. The most important part is that if your wallet is not encrypted OR if you have unlocked the wallet, having the RPC credentials allows someone to move your Bitcoin.

The RPC interface can also be used to overwrite files in your filesystem. The backupwallet command will overwrite files with the backup. An attacker could use this to effectively delete files on your machine by overwriting them with copies of your wallet.

However, the RPC interface is typically not exposed to the internet, so even if someone does have your RPC credentials they probably cannot connect to your node to issue commands. Even so, you should keep your credentials private, or as Nate Eldredge suggests, change them before you post the video.

Ava Chow
  • 70,382
  • 5
  • 81
  • 161
  • 1
    You might want to add that the RPC can be used to overwrite files on your filesystem. (so, e.g. "this wallet is an empty testnet wallet" doesn't mean its safe to expose the rpc to the outside world). We have also previously had security vulnerabilities that were only exploitable via RPC. – G. Maxwell Aug 23 '18 at 05:08
  • 1
    Are there still issues if disablewallet is enabled? – Jonathan Cross Aug 23 '18 at 15:00