Consider removing crypto_api

[christophersanborn]

Consider removing crypto_api (http://docs.bitshares.org/api/crypto.html), or, if retaining, to remove from default api_access list.

crypto_api exposes functions for blind and stealth operations which, for security, should be performed wallet-side, and not offloaded to the API node. (Doing so exposes private values and blinding factors to the node, which may abuse the info.)

Per issue here, it is evident that crypto_api was not intended for long-standing inclusion nor for general public use:

For starters we will assume these calls exist, and simply relay them to a C++ node to evaluate and return the result. Then we can replace the RPC calls with Javascript implementations. After we have proven the rest of the system works.

Leaving the API exposed by default may incur a risk of naive wallet developers relying on the API to perform range proof operations that are not performant in a browser environment of or embedded (e.g. smartphone) environment.

Inclusion in default api_access: https://github.com/bitshares/bitshares-core/blob/master/libraries/app/application.cpp#L436-L440

More info (historical): cryptonomex/graphene#500, cryptonomex/graphene#582

[abitmore]

I agree to remove them from default api_access list.

[oxarbitrage]

closed by #1125