[Bug] snarkos-toolkit PrivateKey prints sensitive information in Display and Debug trait implementations about snarkvm HOT 4 OPEN

Oh that's actually good to know, I'll look into it, did not realize that was the case

from snarkvm.

A few thoughts -

• I agree the Debug behavior for the private key in toolkit should be a no-op. I think it would be risky if this ended up in system logs.

• I think Display should continue to print out the human-readable private key.

• In web contexts, as WASM doesn't support Debug or Display, a wrapping struct with a to_string implementation is provided, which is used to print the string value out.

from snarkvm.

• I agree the Debug behavior for the private key in toolkit should be a no-op. I think it would be risky if this ended up in system logs.
• I think Display should continue to print out the human-readable private key.

That wounds like a reasonable compromise. Debug is probably the bigger problem.

• In web contexts, as WASM doesn't support Debug or Display, a wrapping struct with a to_string implementation is provided, which is used to print the string value out.

Are you sure about this? println! isn't supported, but a lot of people still use the logging macros which support formatting values using those traits, and people might also be using other code which makes use of those traits.

from snarkvm.

It seems that at least the Debug impl only displays the seed now, but leaving this issue open in case there are any extra adjustments needed.

from snarkvm.