The session password is a security feature which protects every bit of sensible data that is currently stored in your computer’s memory while using AVXTO Wallet.
When you enter your mnemonic phrase into AVXTO Wallet, it derives all the required secrets to allow you to move your funds. These include secret seeds, derived private keys, master Ethereum address key for C-Chain and so on.
The session password is used to encrypt all this data while it’s stored in memory. So, if a hacker somehow injects an exploit into your current browser session, they will only extract encrypted secrets from your computer memory.
This password is ephemeral and only used while you’re currently logged into your wallet. It is never stored anywhere and does not modify anything on-chain. It’s an exclusive AVXTO Wallet feature and not at all related to Avalanche. The password disappears once you log off. In fact, you can (and should) forget it and use a new session password the next time you log in.
Here’s the motivation for requiring this password and how it works.
Core App
When you use a wallet extension such as Core App, the private key is located in the browser extension and, the app itself, running in the web page, must request permission to sign every transaction.
There is a separation between the application and the component which signs transactions. It emulates how a hardware wallet would work. The browser extension is like a Ledger device which must be used to sign transactions requested by the web app.
This is a security feature. Even if the web page were compromised, a hacker would still need to compromise your browser to get access to the extension and then obtain the secret keys.
AVXTO Mnemonic Type Wallet
When using a mnemonic type wallet, the secrets would be stored in your computer memory inside the AVXTO Wallet web application itself. This is how the original Avalanche wallet worked.
At login time, the mnemonic phrase was processed to derive all the required secrets (approximately 10 pieces of sensible data), which were stored in variables inside a MnemonicWallet instance. All this is live in your current web browser’s memory. So if someone would dump the memory, or inject code into the wallet (using developer console for example), they would be able to extract the secrets.
AVXTO Wallet modifies this behavior by requesting you to enter a session password whenever you enter a mnemonic phrase. This password is processed using cryptographically secure functions to generate a key which encrypts all sensible data in your computer memory for as long as you’re using the wallet.
Signing Transactions
As a result of this encryption, you are requested to authorize transactions when using a mnemonic type wallet by entering your session password. (This was not required in the original Avalanche wallet, since the keys were all stored in memory in plain readable form, not encrypted.). Without the session password, the wallet cannot decrypt the secrets required to sign transactions. Which means that, your AVXTO Wallet session is unable to move funds on its own or by remote command. It requires one password entry per transaction or batch of transactions.
Batch and Long Running Transactions
Batch transactions, such as sending to multiple recipients, do not require one password entry per TX. This is a convenience feature meant to preserve the mnemonic wallet’s ease of use while still protecting your secrets.
Here’s how it works. When you start a batch transaction that involves more than one on-chain TX, the wallet prepares your batch all at once. For example, a cross-chain operation requires 2 transactions. AVXTO Wallet then prepares the 2 TX’s for you using the session password and then discards it.
That way if you use AVXTO Wallet’s multi send feature to pay 100 recipient addresses, you don’t have to sign 100 TX’s one by one.
Password Format
The session password can be anything. A single dot, a 4 number PIN, random letters, anything you can type into a text box. You can, and should, use a different random password every time you use the wallet. The whole idea is to protect in-memory data using a piece of information that an exploiter does not have access to. In other words, this password is only in your own memory, not the computer’s. It’s kinda like a 2FA just for a session.
Conclusion
The session password is an exclusive AVXTO Wallet feature that we included as abundance of caution. It’s technically not required an exploiting a wallet that doesn’t use it would be extremely hard. The original Avalanche wallet worked just fine for several years without this feature.
The password is never saved anywhere and does not remain in memory or on disk. It does not modify your wallet and is used exclusively during your present wallet session. It’s forgotten forever when you log out.
The tradeoff is that it requires you to enter a new password every time you start a transaction, otherwise the wallet does not have access to the secrets required to sign on-chain operations.