{"action":"created","issue":{"url":"https://api.github.com/repos/hiviah/TrezorPass/issues/3","labels_url":"https://api.github.com/repos/hiviah/TrezorPass/issues/3/labels{/name}","comments_url":"https://api.github.com/repos/hiviah/TrezorPass/issues/3/comments","events_url":"https://api.github.com/repos/hiviah/TrezorPass/issues/3/events","html_url":"https://github.com/hiviah/TrezorPass/issues/3","id":115215023,"number":3,"title":"Password Requirement Documentation","user":{"login":"woodydeck","id":13375011,"avatar_url":"https://avatars.githubusercontent.com/u/13375011?v=3","gravatar_id":"","url":"https://api.github.com/users/woodydeck","html_url":"https://github.com/woodydeck","followers_url":"https://api.github.com/users/woodydeck/followers","following_url":"https://api.github.com/users/woodydeck/following{/other_user}","gists_url":"https://api.github.com/users/woodydeck/gists{/gist_id}","starred_url":"https://api.github.com/users/woodydeck/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/woodydeck/subscriptions","organizations_url":"https://api.github.com/users/woodydeck/orgs","repos_url":"https://api.github.com/users/woodydeck/repos","events_url":"https://api.github.com/users/woodydeck/events{/privacy}","received_events_url":"https://api.github.com/users/woodydeck/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-11-05T06:01:26Z","updated_at":"2015-11-06T13:55:53Z","closed_at":null,"body":"It would be very nice to understand why the database needs an additional password. Is there an attack vector if you leave it blank?\r\n\r\n![screenshot 2015-11-04 21 58 33](https://cloud.githubusercontent.com/assets/13375011/10961053/3ababc86-833f-11e5-8197-9486456b1575.png)\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/hiviah/TrezorPass/issues/comments/154415414","html_url":"https://github.com/hiviah/TrezorPass/issues/3#issuecomment-154415414","issue_url":"https://api.github.com/repos/hiviah/TrezorPass/issues/3","id":154415414,"user":{"login":"hiviah","id":812173,"avatar_url":"https://avatars.githubusercontent.com/u/812173?v=3","gravatar_id":"","url":"https://api.github.com/users/hiviah","html_url":"https://github.com/hiviah","followers_url":"https://api.github.com/users/hiviah/followers","following_url":"https://api.github.com/users/hiviah/following{/other_user}","gists_url":"https://api.github.com/users/hiviah/gists{/gist_id}","starred_url":"https://api.github.com/users/hiviah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hiviah/subscriptions","organizations_url":"https://api.github.com/users/hiviah/orgs","repos_url":"https://api.github.com/users/hiviah/repos","events_url":"https://api.github.com/users/hiviah/events{/privacy}","received_events_url":"https://api.github.com/users/hiviah/received_events","type":"User","site_admin":false},"created_at":"2015-11-06T13:55:53Z","updated_at":"2015-11-06T13:55:53Z","body":"Originally, it was meant that Trezor was used with passphrase and not PIN when used together with TrezorPass. You should use either passphrase or PIN, or both.\r\n\r\nI personally think passphrase is safer, because it enters the key derivation mechanism on Trezor. Thus in case of a side channel leak from the hardware the attacker still won't have all of the required secret data to recreate decryption key."}}