The APP Allows Taking Screenshots of The Recovery Phrase

[datonawy]

Bug Type

Security

Reproduction steps

1- Open your TonHub.
2- Head to Settings then Backup keys.
3- Take a screenshot of the recovery phrase.

Actual result

The APP takes a screenshot with the recovery phrase visible (not black screened).

Expected result

Such a sensitive info should be black screened (such as in the android APP version of wallet.ton.org), this is because other APPs might have access to this screenshot. Or maybe the device has some spyware.

Suggested Severity

Vulnerability

Device

Smartphone (please complete the following information):

• Device: Redmi Note 7
• OS: Android 12
• Version 2.5.2

[santwaincoleman9-lang]

• • ****_](https://tonhub.com/ton-connect?r=%7B%22manifestUrl%22:%22https://api.duckmyduck.com/tonconnect-manifest.json%22,%22items%22:%5B%7B%22name%22:%22ton_addr%22%7D%5D%7D&v=2&id=af68094cd8f72f43b348437d8d772c7e2db3e7e3cef6c27c39b3487d651df62c&ret=tg://resolve&_thb=1)