The current implementation in applications/qnet-wallet/src/quantum/dilithium-manager.ts derives the AES key from navigator.userAgent + '_qnet_storage_v1'. This is against all recommended cryptography methods.
Suggestion: Use PBKDF2, Argon2, or scrypt with a proper password/PIN input
Without any change, the encryption is worse than a single stored symmetric. Low entropy passwords and AES keys are frequently attacked through dictionary lists and rainbow tables. "1234" is definitely on the dictionary list.
The current implementation in applications/qnet-wallet/src/quantum/dilithium-manager.ts derives the AES key from navigator.userAgent + '_qnet_storage_v1'. This is against all recommended cryptography methods.
Suggestion: Use PBKDF2, Argon2, or scrypt with a proper password/PIN input
Without any change, the encryption is worse than a single stored symmetric. Low entropy passwords and AES keys are frequently attacked through dictionary lists and rainbow tables. "1234" is definitely on the dictionary list.