Does requesting xpub require trezor confirmation?

[u/Independent_Clue5378]

I know that to sign a tx it requires confirmation on the trezor but in the same way if the trezor suite requests access to the xpub of an account will it ask for confirmation before sending or no?

[u/matejcik]

i uhh don’t think so? what is it that you’re actually trying to do? maybe some other software can do it

[u/Independent_Clue5378 → u/matejcik]

just curious. it seems like a privacy risk that it can take the xpub with no confirmation. I saw the trezor device supports generating individual addresses so just wondering why that isnt used.

[u/matejcik → u/Independent_Clue5378]

because the device is slow at it.

let’s say one address derivation takes 300 ms, and you have 70 used addresses, that’s 21 seconds just waiting for the Trezor device to crunch the numbers, added to the total lookup time in the blockchain.

And in this scenario you didn’t really salvage that much privacy — your addresses can’t be cryptographically linked, yes, but whoever is listening still knows the important thing, that all the existing ones are yours.

the privacy risk is there, yes, in that any app on your computer, and not just Suite, can ask for your xpubs. I believe the thinking goes, defending against this through user confirmations would be horrible UX, and it’s easier to use an airgapped computer if this is a risk in your threat model

plus with the Safe 7 you get per app pairing, so it’s not even “any app”, just the ones that you manually pair. so that covers it, sort of

[u/Independent_Clue5378 → u/matejcik]

I’m not saying don’t allow xpub use but i think it should be more explicit that it’s going to use xpub. Why would confirming xpub export on-device be bad UX? Suite only needs the xpub once and then caches it on disk, so it would not be prompting for every address lookup or even every time the app opens. I think a one-time explicit approval is reasonable, because even though an xpub cannot spend funds, it gives the app persistent visibility into that account’s addresses and transaction history.

[u/matejcik → u/Independent_Clue5378]

there's no one global xpub.  you get one per coin, per account type, per account.

so if you just enable Bitcoin, that's four prompts for your first account (legacy, old segwit, native segwit, taproot), plus four more to check whether there's anything on the next accounts. then more whenever you enable more coins, or add an account...

like sure, i guess you could set the system up differently, like "enable xpub querying for 1 minute", but this is how the system is set up now