What are the security considerations that should be noted when interacting via Infura to the Ethereum Mainnet?
Are your private keys or mnemonic phrase ever sent to Infura? Can Infura execute any unauthorized transactions, in any way?
Basically, I want to know if it is safe to use Infura and what the risks are. Thanks!
Infura does not request or obtain private keys. Infura cannot sign transactions.
Signing requests are made by the dApp you are using. The dApp is more important for security, because it is what asks you what you want to do with your assets: Infura is just a node that passes your signed transaction to other nodes and miners.
dApps also use Infura to show you information about the blockchain, for example your balance. If Infura is evil, it could cause the dApp to show you wrong information. But it is hard for Infura to profit because the dApp is in control. Infura usually cannot show you a wrong address, but they can show a wrong balance.
Privacy is a security related consideration to using Infura. If you use more than 1 address for privacy, it is typically easy for Infura to correlate your addresses. dApps usually query for your account balance, and Infura could see which Ethereum addresses are being queried from the same IP address.
When you first connect a hardware wallet to Infura, when the balances of each account is checked in bulk, Infura can see those queries happen together.
Running your own node is a way to not give Infura information about your accounts. You will also have to be careful how you query blockchain explorers because they can do similar correlation.
