11

Being an active member of the Ethereum Stack Exchange community, I stumble upon many threads started by new users containing sensitive information about their digital wallets - private keys and 12-words mnemonics.

Here's just two examples I found in my recent revision history:

The community always react quickly to remove the private information from the question description, but it's still available in the revision history. Although most likely those private keys map to empty wallets used for development, you can never know.

  1. Is there a way for the community moderators to completely erase this type of information from the revision history?
  2. To prevent future mistakes, is there a way for the question editors in Bitcoin, Ethereum etc to show a warning whenever a 64-char word is typed? That it, something like "Heads up! You might've pasted your private key. It's not safe to do that, just use a placeholder". Unfortunately, it might be harder to validate against 12-word passphrases, there could just be a warning whenever the word "mnemonic" or "passphrase" shows up.
  • 1
    From Can moderators / high-rep users delete revisions from the revision history?: "neither moderators nor high-rep users have the ability to delete revisions. The dev team can [...] You can edit the post to remove it (creating a new revision), flag it for mod attention, and a mod will contact a dev to have them delete the original revision." The post is a tad bit old but may still apply. I suggest trying that even before a proper answer is posted here - worst-case scenario you get a declined flag, best-case scenario, no more private key in the wild – Jenayah Nov 22 '18 at 23:40
  • 4
    @Jenayah moderators can redact posts now, it's not a trivial process, but it's possible – Mad Scientist Nov 22 '18 at 23:45
  • @Jenayah I would edit that post, but I'm stifled by the non-HTTPS image, so I guess that's why no one bothered to edit it. – Sonic the Inclusive Hedgehog Nov 23 '18 at 0:01
7

Redactions are possible. The UI is a pain so discussing a workflow that works with your moderators is a great idea.

This is no different from any other personally identifying information - as if you'd posted your private key elsewhere or password in my opinion.

The latter is probably unlikely to happen, especially as something unique to a few sites. While there's blacklists of some things that is going to be some painful regex.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .