disallow Type Passwords if not okeys in sssp
What the developer wrote
Authored by scgbckbone
disallow Type Passwords if not okeys in sssp
What changed, and why it matters
This commit tightens access to the 'Type Passwords' feature on COLDCARD devices when operating in a restricted 'semi-seedless' mode (SSSP). Previously, the feature was available whenever the device was in emulator mode; now it also requires that SSSP-related keys are present. Without this change, a user in this restricted mode might have been able to type out stored passwords even when other seed-dependent features were intentionally disabled. The fix is a one-line guard that aligns the password-typing feature with the same key-presence check used for related features.
Treat as a minor security hardening patch. Review whether other menu items in HobbledTopMenu and related flows consistently apply `sssp_related_keys()` or equivalent predicates, and verify that `sssp_allow_notes` and `sssp_allow_vault` already enforce equivalent checks. No urgent user action is indicated unless the project issues an advisory.
Security signals we found
Access-control hardening in a restricted operational mode (SSSP)
Feature gating now depends on key availability, not just emulator flag
One-line predicate change with explicit security framing in commit title
Evidence from the diff
In shared/flow.py, the HobbledTopMenu entry for ‘Type Passwords’ changed its predicate from lambda: settings.get("emu", False) to lambda: settings.get("emu", False) and sssp_related_keys(). This means the menu item is now shown only when the device is in emulator mode AND sssp_related_keys() returns true. The change prevents the password-entry feature from being reachable in SSSP states where the necessary keys are absent. The commit message frames this as a security-hardening guard, not a functional bug fix.
Changed components
shared/flow.pyHobbledTopMenuType Passwords menu itemSSSP (semi-seedless setup/protocol) modeInspect captured patch +1 / −1
diff --git a/shared/flow.py b/shared/flow.py
index c0a2579..945fda5 100644
--- a/shared/flow.py
+++ b/shared/flow.py
@@ -553,7 +553,7 @@ HobbledTopMenu = [
MenuItem('Secure Notes & Passwords', menu=make_notes_menu, predicate=sssp_allow_notes,
shortcut='n'),
MenuItem('Type Passwords', f=password_entry, shortcut='t',
- predicate=lambda: settings.get("emu", False)),
+ predicate=lambda: settings.get("emu", False) and sssp_related_keys()),
MenuItem('Seed Vault', menu=make_seed_vault_menu, predicate=sssp_allow_vault,
shortcut='v'),
MenuItem('Advanced/Tools', menu=HobbledAdvancedMenu, shortcut='t'),
Why this scored 46/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.