1

What are the security considerations that should be noted when interacting via Infura to the Ethereum Mainnet?

Are your private keys or mnemonic phrase ever sent to Infura? Can Infura execute any unauthorized transactions, in any way?

Basically, I want to know if it is safe to use Infura and what the risks are. Thanks!

2
  • 2
    Infura is just like any other node (with a bit of restrictions though). Of course private keys are not sent to the outside. No crypto specialist suggests asking for private keys ever, unless he is a scammer. It is safe to use infura.
    – Nulik
    Jul 11 at 15:29
  • Yes, I was assuming this, but just want to be sure ;) Jul 11 at 15:49
1

Infura does not request or obtain private keys. Infura cannot sign transactions.

Signing requests are made by the dApp you are using. The dApp is more important for security, because it is what asks you what you want to do with your assets: Infura is just a node that passes your signed transaction to other nodes and miners.

dApps also use Infura to show you information about the blockchain, for example your balance. If Infura is evil, it could cause the dApp to show you wrong information. But it is hard for Infura to profit because the dApp is in control. Infura usually cannot show you a wrong address, but they can show a wrong balance.

Privacy is a security related consideration to using Infura. If you use more than 1 address for privacy, it is typically easy for Infura to correlate your addresses. dApps usually query for your account balance, and Infura could see which Ethereum addresses are being queried from the same IP address.

When you first connect a hardware wallet to Infura, when the balances of each account is checked in bulk, Infura can see those queries happen together.

Running your own node is a way to not give Infura information about your accounts. You will also have to be careful how you query blockchain explorers because they can do similar correlation.

1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.