I am trying to use the testrpc, and one of the solutions I found was to run testrpc in one terminal window, and then run Mist --rpc localhost:8545 in another. When doing this, the following warning pops up:

Insecure RPC Connection

What exactly does this mean? Since it is a localhost, does this matter at all? I am running a private-net, so would anyone benefit from abusing the less secure state? What 'passwords' will be sent ove rthe wire as plaintext?


It shouldn't matter. This warning is against doing connecting to a real node.

As it mentions, there's no encryption on the connection to the node (in this case, testrpc). If it was a real node, then whenever you input your password to confirm a transaction, then that unencrypted password could conceivably be going over the network. (it might not, if it's just localhost) Real ETH has been lost this way.

But testrpc doesn't even have passwords in the first place, and it randomly generates accounts with fake ETH. At worst, someone who had access to your testrpc could... mess with your temporary, simulated blockchain?

For reference, mist normally connects over the vastly more secure IPC system, but testrpc doesn't use that. Again, it hardly matters, since it's just a private testnet.

  • Perfect response - covered all my points. Thank you. – user5135 Nov 19 '16 at 19:49
  • @shanefontaine FYI generally you would also upvote the answer :) – eth Nov 20 '16 at 1:04
  • @eth thanks. I'm new to stack exchange so thanks for the heads up. – user5135 Nov 20 '16 at 1:05
  • @shanefontaine Welcome to Ethereum and StackExchange! – eth Nov 20 '16 at 1:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy