refactor(python): do not request credential in get_default_client
What the developer wrote
Authored by matejcik
refactor(python): do not request credential in get_default_client
Currently there is no good way of passing back the credential that was
requested, so it is lost anyway.
[no changelog]
What changed, and why it matters
This is a small code cleanup in Trezor's Python library. It changes how a new Bluetooth-style pairing flow is started so that it no longer asks the device for a 'credential' during setup. The commit message says the credential could not be returned to the caller anyway, so it was being discarded. There is no direct evidence in the commit that this fixes a security vulnerability; it reads as a refactor to avoid a useless step.
Treat as a routine refactor unless additional vendor or researcher context shows the lost credential had security consequences. Reviewers may want to confirm that request_credential=False is safe for all callers of get_default_client and that no downstream code expected the credential to be requested as a side effect.
Security signals we found
Change is in pairing/authentication-related code path
Credential request disabled in default pairing flow
No changelog entry, suggesting developer does not treat as security fix
No explicit security wording in commit title or message
Evidence from the diff
In python/src/trezorlib/client.py, get_default_client() now calls default_pairing_flow() with request_credential=False. Previously the pairing flow requested a credential by default, but the wrapper had no mechanism to pass that credential back to its caller, so the value was effectively lost. The patch removes the request rather than adding plumbing to return the credential. The change is framed as a refactor and is marked [no changelog].
Changed components
python/src/trezorlib/client.pyget_default_client()default_pairing_flow()Inspect captured patch +5 / −1
diff --git a/python/src/trezorlib/client.py b/python/src/trezorlib/client.py
index ffe24aec..ab1b5db4 100644
--- a/python/src/trezorlib/client.py
+++ b/python/src/trezorlib/client.py
@@ -618,7 +618,11 @@ def get_default_client(
if not client.pairing.is_paired():
from .thp.pairing import default_pairing_flow
- default_pairing_flow(client.pairing, code_entry_callback=code_entry_callback)
+ default_pairing_flow(
+ client.pairing,
+ code_entry_callback=code_entry_callback,
+ request_credential=False,
+ )
return client
Why this scored 16/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.