Ethereum Stack Exchange is a question and answer site for users of Ethereum, the decentralized application platform and smart contract enabled blockchain. It only takes a minute to sign up.
Sign up to join this community
If you're running geth on localhost and use a web page I provided to interact with the ethereum network, is it not possible for me to just unlock the account and transfer the funds to a different account using web3js and javascript? I am a little confused as to how locking and unlocking of wallets work and how I can build a self contained web app without using geth/infura?
Also, is it possible to connect a web dapp to a web wallet and use the web wallet somehow to interact with the contract?
If you're running geth on localhost and you come across my web page, is it not possible for me to just unlock the account and transfer the funds to a different account using web3js and javascript?
If what you meant by my web page is you are providing a wallet like service, yes you can.
Let's say you provided a webpage and for the user to interact using their own local node and you ask them to provide the password to unlock the account, you may retrieve the password from that and somehow find a way to access the file system of the users computer(just like some hacker find a way to enter a system) and get the keystore file.
But the main problem is why people should trust your web page or service?
If you want to others to show that your web page can be trusted , I may suggest something like , that you provide the interface to interact with the ethereum if the user has unlocked his account on a locally run node or metamask like service. So even though you get access to keystore file, it will be hard to decrypt them to find private keys since you dont know the passwrod/phrase.
How wallets work is that they generate a cryptographic key pair and store your private key encrypted locally. So when you provide the password the key is decrypted and used to sign transactions. You may read this post for more details.
how ever the wallets are not 100% trusted. That you may sometimes still have to trust the wallet service providers. There's a good read here.
In conclusion I may suggest you to use a metamask like service to build a trust-able dapp. This question also will be useful for you.
web3.eth.accounts.wallet[0]['address'] to default after decrypting. Without the ['address'] property, it throws an error. Thanks a bunch.
Jun 1, 2018 at 1:13