2

If you're running geth on localhost and use a web page I provided to interact with the ethereum network, is it not possible for me to just unlock the account and transfer the funds to a different account using web3js and javascript? I am a little confused as to how locking and unlocking of wallets work and how I can build a self contained web app without using geth/infura?

Also, is it possible to connect a web dapp to a web wallet and use the web wallet somehow to interact with the contract?

  • your question is little unclear. You need provide a web interface for others to interact with the ethereum network? Or you want to do something like this ? – Achala Dissanayake Sep 29 '17 at 0:54
  • @AchalaDissanayake Sorry, I meant something similar to the link you provided. What happens if I interact with my smart contract instance and transfer all the ethers from the local wallet to a different wallet? Can I do that without the user knowing and if so, how can I prevent it from happening? What is a secure solution to that? – Manan Mehta Sep 29 '17 at 15:50
  • got it or still confused? – Achala Dissanayake Sep 30 '17 at 14:51
  • @AchalaDissanayake A little more clarification will help! Can I use web3.personal.unlockAccount(acc, pswd) to unlock an account using javascript? And what would the pswd be to unlock the account? Will it be the passphrase given to you when you create the account or the private key? Also, does acc have to be an account on the localhost running geth or could it be any eth account and pswd correspondingly? – Manan Mehta Oct 2 '17 at 6:58
  • 1
    It's the passphrase you need. If you have the keystore file locally you can unlock it with the local node – Achala Dissanayake Oct 2 '17 at 8:02
2

If you're running geth on localhost and you come across my web page, is it not possible for me to just unlock the account and transfer the funds to a different account using web3js and javascript?

If what you meant by my web page is you are providing a wallet like service, yes you can.

Let's say you provided a webpage and for the user to interact using their own local node and you ask them to provide the password to unlock the account, you may retrieve the password from that and somehow find a way to access the file system of the users computer(just like some hacker find a way to enter a system) and get the keystore file.

But the main problem is why people should trust your web page or service?

If you want to others to show that your web page can be trusted , I may suggest something like , that you provide the interface to interact with the ethereum if the user has unlocked his account on a locally run node or metamask like service. So even though you get access to keystore file, it will be hard to decrypt them to find private keys since you dont know the passwrod/phrase.

How wallets work is that they generate a cryptographic key pair and store your private key encrypted locally. So when you provide the password the key is decrypted and used to sign transactions. You may read this post for more details.

how ever the wallets are not 100% trusted. That you may sometimes still have to trust the wallet service providers. There's a good read here.

In conclusion I may suggest you to use a metamask like service to build a trust-able dapp. This question also will be useful for you.

  • I'm having the hardest time connecting an imported V3 wallet to web3. I can't get web3 to successfully sign txns when using web3.eth.accounts.wallet.decrypt. There's no documentation on how to make it the default address? I try to set web3.eth.accounts.wallet[0]['address'] to default after decrypting. Without the ['address'] property, it throws an error. Thanks a bunch. – GViz Jun 1 '18 at 1:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.