The approach I'm currently using in my DApp is mapping Ethereum addresses to a solidity struct which contains all of that specific user's data. But since the address is publicly available can't someone just use that user's address and by manipulating their keystore file or some other way send messages to the contract with other user's Ethereum address? If yes, then what can be done to prevent this and what other login/authentication methods are there? If no then I guess I have some wrong ideas about how contracts are signed(?), so please direct me where I can find out more in depth information about this.
Add a comment
|
1 Answer
But since the address is publicly available can't someone just use that user's address and by manipulating their keystore file or some other way send messages to the contract with other user's Ethereum address?
Transactions sent to the blockchain don't explicity contain a sender address - the address is worked out from the transaction's signature.
The only way to sign the transaction is using the sender's private key. So even though the msg.sender address can be publicly determined, no one else can sign their transactions.
...and by manipulating their keystore file
If someone has access to msg.sender's account, then they have complete control. It's up to the user to ensure their account is secure.
answered Mar 19, 2017 at 15:08
