3

I'm running a private blockchain instance for personal development and I'm trying to understand what is the proper way to use personal.unlockAccount() to prevent a security risk.

I understand the usage of the function,

personal.unlockAccount(addr, password, duration)

I know that if I don't put a duration, the account remains unlocked for the default time (which appears to be 300 seconds). With hacks and security risks, should I stick to personal.unlockAccount(addr, password, 0.1) or something of that nature? Or is it unimportant that the account is unlocked (contrary to what I've been reading online regarding security risks / hacking vulnerabilities)

1 Answer 1

1

You can use sendRawTransaction to send signed transaction from the front end to the geth client so that you are not exposing the password to the network.

Example

var Tx = require('ethereumjs-tx');
var privateKey = new Buffer('e331b6d69882b4cb4ea581d88e0b604039a3de5967688d3dcffdd2270c0fd109', 'hex')

var rawTx = {
  nonce: '0x00',
  gasPrice: '0x09184e72a000', 
  gasLimit: '0x2710',
  to: '0x0000000000000000000000000000000000000000', 
  value: '0x00', 
  data: '0x7f7465737432000000000000000000000000000000000000000000000000000000600057'
}

var tx = new Tx(rawTx);
tx.sign(privateKey);

var serializedTx = tx.serialize();

//console.log(serializedTx.toString('hex'));
//0xf889808609184e72a00082271094000000000000000000000000000000000000000080a47f74657374320000000000000000000000000000000000000000000000000000006000571ca08a8bbf888cfa37bbf0bb965423625641fc956967b81d12e23709cead01446075a01ce999b56a8a88504be365442ea61239198e23d1fce7d00fcfc5cd3b44b7215f

web3.eth.sendRawTransaction(serializedTx.toString('hex'), function(err, hash) {
  if (!err)
    console.log(hash); // "0x7f9fade1c0d57a7af66ab4ead79fade1c0d57a7af66ab4ead7c2c2eb7b11a91385"
});
2
  • Is this what's commonly done, or do people expose passwords to the network?
    – David
    Mar 2, 2017 at 19:38
  • 1
    Exposing password to network is obviously risky. This is a good alternative, or you can disable web3 and make your own interface to interact with geth ipc from server side only.
    – niksmac
    Mar 3, 2017 at 4:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.