<p>You can view the source of the <a href="https://github.com/spesmilo/electrum/blob/master/plugins/labels.py" rel="nofollow">Electrum label sync plugin on github</a>. </p>

<blockquote>
  <p>How and where are the labels stored?</p>
</blockquote>

<p>They appear to be stored on sync.bytesized-hosting.com:9090.</p>

<blockquote>
  <p>Is the transmission of the labels encrypted?</p>
</blockquote>

<p>The labels are encrypted with AES using using a truncated SHA1 of the wallets Master Public Key, this should be reasonably safe. IV appears to be static, this is fairly weak but not disastrous. For most people the server should not be able to decrypt any of the information stores within the label sync service. </p>

<pre><code>    self.encode_password = hashlib.sha1(mpk).digest().encode('hex')[:32]
    self.iv = hashlib.sha256(self.encode_password).digest()[:16]
    self.wallet_id = hashlib.sha256(mpk).digest().encode('hex')
</code></pre>

<blockquote>
  <p>Do the electrum server save IP information by default?</p>
</blockquote>

<p>The source of the sync server is <a href="https://github.com/maran/electrum-sync-server" rel="nofollow">available on github</a>, however you should ideally assume that all traffic to it is logged. This would include the hash of your master public key, your IP address, and the times you were using the wallet which can be correlated with transactions. This is probably never going to be an issue for most people but it is something to be aware of. </p>

CC BY-SA 3.0
2015-08-25T12:06:17.363Z
No, it's not a hash of the wallet password, but of the master public key.
ThomasV
CC BY-SA 3.0
2015-08-25T12:19:25.337Z
@ThomasV You're right, I got that completely wrong, fixed.
Claris
CC BY-SA 3.0
2015-08-20T04:05:07.810Z
2015-08-25T12:21:48.697Z
2015-08-25T12:21:48.697Z
Claris
<p>I have some questions about the electrum tool plugin "label sync".<br>
How does it work?<br>
I had a look into in the QA's here how electrum server/client do work, the random server setup sounds quite resilent.  </p>

<p>Do the electrum server save IP information by default?<br>
How and where are the labels stored?<br>
Does the plugin direct to a central server or is the information some how stored on all the server nodes?<br>
Is the transmission of the labels encrypted?</p>

<p>thanks in advance</p>

<electrum>
Is Electrum's label sync a decentralized service?
tupambae
# Is Electrum's label sync a decentralized service?

(Asked by: username_0 on 2015-08-19)

I have some questions about the electrum tool plugin "label sync".  
How does it work?  
I had a look into in the QA's here how electrum server/client do work, the random server setup sounds quite resilent.

Do the electrum server save IP information by default?  
How and where are the labels stored?  
Does the plugin direct to a central server or is the information some how stored on all the server nodes?  
Is the transmission of the labels encrypted?

thanks in advance

**Tags:** electrum


---

## 1 answers

### Answer by username_1 on 2015-08-20. Score: 1

You can view the source of the [Electrum label sync plugin on github](https://github.com/spesmilo/electrum/blob/master/plugins/labels.py).

> How and where are the labels stored?

They appear to be stored on sync.bytesized-hosting.com:9090.

> Is the transmission of the labels encrypted?

The labels are encrypted with AES using using a truncated SHA1 of the wallets Master Public Key, this should be reasonably safe. IV appears to be static, this is fairly weak but not disastrous. For most people the server should not be able to decrypt any of the information stores within the label sync service.

```
    self.encode_password = hashlib.sha1(mpk).digest().encode('hex')[:32]
    self.iv = hashlib.sha256(self.encode_password).digest()[:16]
    self.wallet_id = hashlib.sha256(mpk).digest().encode('hex')

```

> Do the electrum server save IP information by default?

The source of the sync server is [available on github](https://github.com/maran/electrum-sync-server), however you should ideally assume that all traffic to it is logged. This would include the hash of your master public key, your IP address, and the times you were using the wallet which can be correlated with transactions. This is probably never going to be an issue for most people but it is something to be aware of.

> **Comments:**
> **username_2**: No, it's not a hash of the wallet password, but of the master public key.  
> **username_1**: @username_2 You're right, I got that completely wrong, fixed.  

---

