<blockquote>
<p>ie: notably one where I don't specify things like rpcuser, rpcpassword - is this insecure?</p>
</blockquote>
<p>No, Bitcoin Core by default creates a RPC cookie file in the data directory on startup which is used in place of static authentication. Specifying a <code>rpcuser</code> and <code>rpcpassword</code> is deprecated, and they can't be blank regardless.</p>

CC BY-SA 4.0
2020-11-30T06:26:03.210Z
Gotcha. What's the name of that file by default? Not seeing it on disk nor in the documentation.
lollercoaster
CC BY-SA 4.0
2020-12-01T01:18:08.767Z
The name of the file is ".cookie", in the usual Bitcoin Core data directory.
Pieter Wuille
CC BY-SA 4.0
2020-11-30T06:16:29.140Z
2020-11-30T06:16:29.140Z
Claris
<p>If I have a fairly default <code>bitcoin.conf</code> file, let's say:</p>
<pre><code>rpcport=8332
txconfirmtarget=6
</code></pre>
<p>ie: notably one where I don't specify things like <code>rpcuser</code>, <code>rpcpassword</code> - is this insecure?</p>
<p>As I understand, this lets the node be queried locally without an authentication. However I'm not sure this is any more dangerous than <code>wallet.dat</code> sitting around - local access would mean private key access.</p>
<p>Are default settings of bitcoin insecure?</p>

<bitcoind><json-rpc><wallet-security>
RPC security of bitcoind node
lollercoaster
# RPC security of bitcoind node

(Asked by: username_0 on 2020-11-30)

If I have a fairly default `bitcoin.conf` file, let's say:

```
rpcport=8332
txconfirmtarget=6

```

ie: notably one where I don't specify things like `rpcuser`, `rpcpassword` - is this insecure?

As I understand, this lets the node be queried locally without an authentication. However I'm not sure this is any more dangerous than `wallet.dat` sitting around - local access would mean private key access.

Are default settings of bitcoin insecure?

**Tags:** bitcoind, json-rpc, wallet-security


---

## 1 answers

### Answer by username_1 on 2020-11-30. Score: 2

> ie: notably one where I don't specify things like rpcuser, rpcpassword - is this insecure?

No, Bitcoin Core by default creates a RPC cookie file in the data directory on startup which is used in place of static authentication. Specifying a `rpcuser` and `rpcpassword` is deprecated, and they can't be blank regardless.

> **Comments:**
> **username_0**: Gotcha. What's the name of that file by default? Not seeing it on disk nor in the documentation.  
> **username_2**: The name of the file is ".cookie", in the usual Bitcoin Core data directory.  

---

