2

I am creating an android DApp and have used go-ethereum to create wallets for users when they create an account. This stores the private key on their device. I want to also keep all of their details on something else so their name, email, keys and hashed password are kept together. How would I go about doing this so they are all secure? Is it as simple as storing them in a database? And would I even have to do that? Is there a better way?

Thanks!

Improve this question

1 Answer 1

Reset to default
4

If you store keys and password anywhere else than on the users device then you are back to square one, should stop right here, go back to using a traditional webservice and payment integration using Stripe or alike.

A secure way to go, is to implement a hardware wallet such as this one or this one. Geth can interface them and they also come with APIs that your custom app could use to request the hardware device to sign a tx. This is the ultimately secure way and best practice.

Now I read from your question that you are concerned about usability and convenience (e.g. "lost key" scenario). It is generally hard to find a golden middle between security and convenience and there is not one solution that fits all needs. Do you administer millions? Then you want to go via a hardware wallet without exceptions. Do you just control a few cents or a funny game? Then you might be fine with an in-app or mobile wallet. Do you actually need a blockchain in the first place or is a centralized legacy solution the way forward because you do not need to guarantee that people can interact with your dapp disregarding of your existence?

If you need something reasonably secure and want to go via hardware wallet but also treat a lost key scenario somewhat gracefully, you might setup a smart contract that provides e.g. a (secure!) web of trust. e.g. once 3 of my 5 trusted friends confirm that this new account X is actually me, and my old account Y is indeed lost, then they can transfer ownership of all assets from Y to X. This along with a time-lock and some emergency off-switches is starting to be the really interesting side of smart contracts, see e.g. the discussion here.

Improve this answer
2
  • Thanks, any idea on how you would implement a hardware wallet into android though? Then how would a user log in to the app? Would they need to put in their private key each time, or would it automatically find it from where it's stored in their phone? In which case how would I retrieve their other details if I couldn't store their keys elsewhere? I.e they log in with their private key and I also need their username, email etc from their account details but I wouldn't have that if I couldn't store their private key.
    – B.K Lewis
    Commented Jul 18, 2017 at 12:56
  • 2
    Your mobile phone formats a raw tx, sends it per USB (or bluetooth) to signing device, device signs it, sends signature back to mobile which then broadcasts it. Formatting a raw tx should work, mobile libraries for hardware signing devices (APIs) might not be ready yet (but I could be wrong).
    – SCBuergel
    Commented Jul 18, 2017 at 15:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.