Alexander Bakker's Blog

Insecure seed generation in the Nano Android wallet

On the 21th of June 2018, the release of the new wallet applications for Nano was announced on Reddit. Shortly after that, another announcement was made telling users of the Android app to transfer their funds to a wallet with a seed that was not generated by the app. I quickly looked up the source code and found that the app was using a random number generator that is not cryptographically secure. Let’s analyze how bad this really is. Spoiler: it’s bad.

Mutating immutable strings in Go

As most Go programmers probably know, strings are immutable in Go. This has its advantages, but there are times when one might want to make changes to a string. Using reflection, we can obtain the underlying StringHeader struct of strings and modify the contents.