user63917: If I have a fairly default bitcoin.conf file, let's say:
rpcport=8332
txconfirmtarget=6

ie: notably one where I don't specify things like rpcuser, rpcpassword - is this insecure?
As I understand, this lets the node be queried locally without an authentication. However I'm not sure this is any more dangerous than wallet.dat sitting around - local access would mean private key access.
Are default settings of bitcoin insecure?

user24925: 
ie: notably one where I don't specify things like rpcuser, rpcpassword - is this insecure?

No, Bitcoin Core by default creates a RPC cookie file in the data directory on startup which is used in place of static authentication. Specifying a rpcuser and rpcpassword is deprecated, and they can't be blank regardless.

63917: <p>If I have a fairly default <code>bitcoin.conf</code> file, let's say:</p>
<pre><code>rpcport=8332
txconfirmtarget=6
</code></pre>
<p>ie: notably one where I don't specify things like <code>rpcuser</code>, <code>rpcpassword</code> - is this insecure?</p>
<p>As I understand, this lets the node be queried locally without an authentication. However I'm not sure this is any more dangerous than <code>wallet.dat</code> sitting around - local access would mean private key access.</p>
<p>Are default settings of bitcoin insecure?</p>
 24925: <blockquote>
<p>ie: notably one where I don't specify things like rpcuser, rpcpassword - is this insecure?</p>
</blockquote>
<p>No, Bitcoin Core by default creates a RPC cookie file in the data directory on startup which is used in place of static authentication. Specifying a <code>rpcuser</code> and <code>rpcpassword</code> is deprecated, and they can't be blank regardless.</p>
