<p>The wallet passphrase protects against an attacker who has access to your <em>disk</em> but not the rest of your system.</p>

<p>If someone has access to your bitcoind through RPC, you need to protect by setting an RPC password, not a wallet encryption password.</p>

CC BY-SA 3.0
2017-10-08T22:13:03.080Z
But can't the hacker use some kind of listener (man in the middle attack) on that port and see the Credentials in the post ?
Haddar Macdasi
CC BY-SA 3.0
2017-10-08T22:23:59.950Z
Yes, but if your attacker can access your local machine, you have far bigger problems. He could replace your bitcoind...
Pieter Wuille
CC BY-SA 3.0
2017-10-08T20:08:03.507Z
2017-10-08T20:08:03.507Z
Pieter Wuille
<p>Is it safe to use walletpassphrase with bitcoin-qt rpc call ?
I can think of a security problem, suppose hacker was able to insert some kind of program that call each second to the wallet with sendToAddress and the hacker bitcoin address, now he will get a lock response each time until the call will execute on the timespan the wallet is unlocked. is it possible ?</p>

<bitcoin-core><wallet-security>
Security bridge on bitcoin-qt walletpassphrase
Haddar Macdasi
# Security bridge on bitcoin-qt walletpassphrase

(Asked by: username_0 on 2017-10-08)

Is it safe to use walletpassphrase with bitcoin-qt rpc call ?
I can think of a security problem, suppose hacker was able to insert some kind of program that call each second to the wallet with sendToAddress and the hacker bitcoin address, now he will get a lock response each time until the call will execute on the timespan the wallet is unlocked. is it possible ?

**Tags:** bitcoin-core, wallet-security


---

## 1 answers

### Answer by username_1 on 2017-10-08. Score: 0 | Accepted answer

The wallet passphrase protects against an attacker who has access to your *disk* but not the rest of your system.

If someone has access to your bitcoind through RPC, you need to protect by setting an RPC password, not a wallet encryption password.

> **Comments:**
> **username_0**: But can't the hacker use some kind of listener (man in the middle attack) on that port and see the Credentials in the post ?  
> **username_1**: Yes, but if your attacker can access your local machine, you have far bigger problems. He could replace your bitcoind...  

---

