3

I'm running a private blockchain instance for personal development and I'm trying to understand what is the proper way to use personal.unlockAccount() to prevent a security risk.

I understand the usage of the function,

personal.unlockAccount(addr, password, duration)

I know that if I don't put a duration, the account remains unlocked for the default time (which appears to be 300 seconds). With hacks and security risks, should I stick to personal.unlockAccount(addr, password, 0.1) or something of that nature? Or is it unimportant that the account is unlocked (contrary to what I've been reading online regarding security risks / hacking vulnerabilities)

1

You can use sendRawTransaction to send signed transaction from the front end to the geth client so that you are not exposing the password to the network.

Example

var Tx = require('ethereumjs-tx');
var privateKey = new Buffer('e331b6d69882b4cb4ea581d88e0b604039a3de5967688d3dcffdd2270c0fd109', 'hex')

var rawTx = {
  nonce: '0x00',
  gasPrice: '0x09184e72a000', 
  gasLimit: '0x2710',
  to: '0x0000000000000000000000000000000000000000', 
  value: '0x00', 
  data: '0x7f7465737432000000000000000000000000000000000000000000000000000000600057'
}

var tx = new Tx(rawTx);
tx.sign(privateKey);

var serializedTx = tx.serialize();

//console.log(serializedTx.toString('hex'));
//0xf889808609184e72a00082271094000000000000000000000000000000000000000080a47f74657374320000000000000000000000000000000000000000000000000000006000571ca08a8bbf888cfa37bbf0bb965423625641fc956967b81d12e23709cead01446075a01ce999b56a8a88504be365442ea61239198e23d1fce7d00fcfc5cd3b44b7215f

web3.eth.sendRawTransaction(serializedTx.toString('hex'), function(err, hash) {
  if (!err)
    console.log(hash); // "0x7f9fade1c0d57a7af66ab4ead79fade1c0d57a7af66ab4ead7c2c2eb7b11a91385"
});
  • Is this what's commonly done, or do people expose passwords to the network? – David Mar 2 '17 at 19:38
  • 1
    Exposing password to network is obviously risky. This is a good alternative, or you can disable web3 and make your own interface to interact with geth ipc from server side only. – niksmac Mar 3 '17 at 4:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.