UX proposal: Always prompt for passphrase by default to improve plausible deniability
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 35/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- c
- Domain
- embedded-iot, security
Research direction
No files or tests are named. Start by tracing the device's passphrase prompt and BIP39 wallet-creation or unlock flow, then identify the UI paths that distinguish empty from non-empty passphrases. Done means all users follow the same prompt flow while empty, single, and multiple passphrases remain supported.
Written by the indexing model from the issue text.
Description
Clarified proposal text (ready for GitHub)
Currently, using a BIP39 passphrase is optional and often treated as an “advanced feature”.
This creates a UX distinction between “standard wallets” and “passphrase wallets”.
Under coercion or extortion scenarios, this distinction becomes a security issue:
the act of using a passphrase itself can signal the existence of hidden wallets.
Proposal
Change the default UX so that the device always prompts for a passphrase, even if it is empty.
-> “No passphrase” becomes simply an empty passphrase
-> Users who use 0, 1, or multiple passphrases follow the same flow
-> No visual or behavioral signal distinguishes passphrase usage
Benefits
-> Improves plausible deniability under physical threat
-> Normalizes passphrase usage without forcing it
-> Maintains full BIP39 compatibility
-> Does not change cryptography, only UX
Rationale
Security should not depend on whether a user chose an “advanced option”.
A uniform flow reduces information leakage and improves real-world safety.
Important clarification
This proposal does NOT make passphrases mandatory.
Users remain fully free to:
-> use no passphrase at all (empty passphrase), or
-> use one or multiple passphrases
The goal is not to force behavior, but to ensure that:
-> all users go through the same interaction flow, and
-> passphrase usage cannot be inferred from the UI or user behavior.
This preserves user choice while improving safety under coercion.
- Dominant language
- C
- Stars
- 497
- Forks
- 131
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from Blockstream/Jade
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Blockstream/Jade#329 · 4 comments ·
-
Difficulty 1/5 Under an hour Newbie friendliness 78/100
Blockstream/Jade#317 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Blockstream/Jade#315 · 3 comments ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Blockstream/Jade#313 · 1 comment ·
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
Blockstream/Jade#345 · 4 comments ·
All issues in Blockstream/Jade
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
level/task module/gcp type/bug
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
-
Difficulty 1/5 Under an hour Newbie friendliness 86/100
hapostgres/pg_auto_failover#1190 ·
-
docs
Difficulty 1/5 Under an hour Newbie friendliness 85/100
-
P3 sonic-vpp
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
sonic-net/sonic-buildimage#29662 ·