So my question is about the to which degree Web3Auth is trusted? I played around with their SDK a bit, and after user logs into the DApp, the application can even retrieve user's private key and initiate any kind of transaction without even prompting anything to user.

You might say the user shouldn't have logged in to shady DApps in the first place, but still compared to browser wallets such as Metamask, which at least requires the validation of the wallet owner for sending transactions etc. even when it is connected to the website, it seems relatively unsecure.

I would like to hear any supportive or refutive ideas if any, or if I'm missing anything.

1 Answer 1


I would suggest you use Web3Auth with a degree of caution. I did some research and found that some user reported that there are insufficient information/documentation on how the actual Web3Auth network works and architected. There are also concerns if Web3Auth is architected in a more centralized and less documented way. In addition, some users also reported that they didn't see any licenses attached to the Web3Auth software in their Github repository and concerned that the licensing fees to use their software could be restrictive and high after developers have integrated their libraries and SDKs into their workflow.

See: https://forum.dfinity.org/t/torus-authentication/11893/6

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.