Skip to main content
Ethereum

Return to Question

edited title
Link
Mikko Ohtamaa
Mikko Ohtamaa
  • 22.5k
  • 7
  • 65
  • 133

Why accessing geth over rpc is not safe? Is there any alternative? Geth RPC connections securely

added 152 characters in body
Source Link
Prashant Prabhakar Singh
Prashant Prabhakar Singh
  • 8.1k
  • 5
  • 42
  • 80

I have read everywhere that exposing personal over rpc is dangerous and is vulnerable. The question is HOW? Is it possible for anyone to send transactions to my geth console, if my ipaddress and port on which geth is listening is compromised?  

Secondly, I don't understand if it's a security threat, how are some coins based on Ethereum are able to provide their own wallet? They must be using RPC api to connect to geth. Isn't their coin at risk?
 
I am also building a web interface for my coin using web3.js so that users of my coin could use web to access their accounts and carry out transactions but for that I need to expose personal over RPC. Am I compromising security? If yes, what else I can do to provide web access to my users of their accounts.
 
Can -rpcaddr and -rpccorsdomain help in any way? I couldn't understand their use properly. If I set --rpcaddr "ip1", "ip2" --rpccorsdomain "ip1", What does this means?

I have read everywhere that exposing personal over rpc is dangerous and is vulnerable. The question is HOW?
Secondly, I don't understand if it's a security threat, how are some coins based on Ethereum are able to provide their own wallet? They must be using RPC api to connect to geth. Isn't their coin at risk?
I am also building a web interface for my coin using web3.js so that users of my coin could use web to access their accounts and carry out transactions but for that I need to expose personal over RPC. Am I compromising security? If yes, what else I can do to provide web access to my users of their accounts.
Can -rpcaddr and -rpccorsdomain help in any way? I couldn't understand their use properly. If I set --rpcaddr "ip1", "ip2" --rpccorsdomain "ip1", What does this means?

I have read everywhere that exposing personal over rpc is dangerous and is vulnerable. The question is HOW? Is it possible for anyone to send transactions to my geth console, if my ipaddress and port on which geth is listening is compromised?  

Secondly, I don't understand if it's a security threat, how are some coins based on Ethereum are able to provide their own wallet? They must be using RPC api to connect to geth. Isn't their coin at risk?
 
I am also building a web interface for my coin using web3.js so that users of my coin could use web to access their accounts and carry out transactions but for that I need to expose personal over RPC. Am I compromising security? If yes, what else I can do to provide web access to my users of their accounts.
 
Can -rpcaddr and -rpccorsdomain help in any way? I couldn't understand their use properly. If I set --rpcaddr "ip1", "ip2" --rpccorsdomain "ip1", What does this means?

Source Link
Prashant Prabhakar Singh
Prashant Prabhakar Singh
  • 8.1k
  • 5
  • 42
  • 80

Why accessing geth over rpc is not safe? Is there any alternative?

I have read everywhere that exposing personal over rpc is dangerous and is vulnerable. The question is HOW?
Secondly, I don't understand if it's a security threat, how are some coins based on Ethereum are able to provide their own wallet? They must be using RPC api to connect to geth. Isn't their coin at risk?
I am also building a web interface for my coin using web3.js so that users of my coin could use web to access their accounts and carry out transactions but for that I need to expose personal over RPC. Am I compromising security? If yes, what else I can do to provide web access to my users of their accounts.
Can -rpcaddr and -rpccorsdomain help in any way? I couldn't understand their use properly. If I set --rpcaddr "ip1", "ip2" --rpccorsdomain "ip1", What does this means?