0

I think air gap does not guarantee that funds are never stolen.

The reason is that you don't know what is inside generated transaction bytes that you copy&paste to an online computer to broadcast. Potentially if myetherwallet site is hacked and you downloaded hacked version, it can attach your private key and password to transaction data. Since your are encoding it and do not know what is inside, you will gladly copy&paste your transaction to online computer and send it, thus giving control to your wallet to everybody.

I wonder if there is any solution to that risk, like inspecting transaction bytes to make sure the size is not greater than certain number, so that no extra data can be fit. Or may be creating restricted wallet contract that can only send ether without any attached data.

And then good broadcasting software like myetherwallet should inspect length of tx bytes and warn user if it's too long for just sending funds.

Improve this question

1 Answer 1

Reset to default
1

Answering for the specific case of MyEtherWallet.

Potentially if myetherwallet site is hacked and you downloaded hacked version, it can attach your private key and password to transaction data.

If you're using MEW on an offline computer, you're presumably using their standalone, offline version: https://github.com/kvhnuke/etherwallet

This is completely open-source, and can be cloned from GitHub. There are presumably commit/approval restrictions, so should the code change, lots of people know about it. It's therefore unlikely that you'd be using a hacked version of their software in the case you outline.

If someone had hacked your air-gapped machine and changed the MEW binary, presumably by getting physical access to it... then they've got access to your system anyway.

Improve this answer
5
  • So the best we can do is to rely on git commit/approval restrictions and browser download SSL protections. I suppose these restrictions are less safe than air gap that we try to rely on.
    – alpav
    Commented Jun 14, 2017 at 23:17
  • Now if that software was distributed via blockchain and developers publish their commits only from air gapped machine then we could say that we have air gapped safety.
    – alpav
    Commented Jun 14, 2017 at 23:19
  • Also what if github web server is hacked ? Is github considered unbreakable fortress ? Who owns github ? Where is the guarantee that they don't publish malfunctioned code based on government request or serve only portions of IP addresses different code so that hack is not noticed widely.
    – alpav
    Commented Jun 14, 2017 at 23:23
  • I suppose today the easiest way to steal billions is to hack myetherwallet or github website. No need to hack exchanges, which would have much tougher protections to break.
    – alpav
    Commented Jun 14, 2017 at 23:48
  • I wonder what is considered easier to hack by hackers github, myetherwallet.com, poloniex.com, kraken.com, bankofamerica.com, chase.com or dhs.gov ?
    – alpav
    Commented Jun 14, 2017 at 23:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.