6

With several web applications emerging that are essentially front-ends to dapps, there are RPC calls being made to localhost port 8545 (ostensibly by web3.js running in the web client). These local calls are even being made by web sites hosted on public urls, something that does not occur in the vast majority of secure web apps.

While users know that they "must be running geth on my computer", they may not fully understand that this is happening or the security implications. If "something" other than geth or another valid ethereum node is listening on port 8545, and implements the JSON RPC API, the user may be interacting with the ethereum network through that untrusted node.

How does web3.js know that the locally hosted RPC API is a valid node?

Improve this question
7
  • 1
    A valid node would be node running on software distributed by the Ethereum Foundation (such as geth), or widely accepted as implementing Ethereum (such as Ethcore Parity).
    – Jamie Pitts
    May 4, 2016 at 16:03
  • 1
    Do you mean that some malicious virus could listen on this local host port in place of a real node, but act as a real ethereum node while stealing keys when you use Dapps ? This would be very difficult to detect and could possibly be very harmful for people who don't really technically understand how it works.
    – Nicolas Massart
    May 4, 2016 at 16:14
  • 1
    Yes, there are many scenarios that come to mind. Some are far more benign, such as a user unintentionally running an edge version of geth. There may be solutions outside of my expertise, at the very least the user can be notified via web3.js about what is running. It is possible that web3.js in the browser is already validating the locally running node (I have not examined the js code yet but did look and found no documentation about this sort of validating).
    – Jamie Pitts
    May 4, 2016 at 16:25
  • 1
    I can't see any way to verify except if binary is signed. But it would mean that you can't build your own binary. Also, web3 is just a JS lib. The first thing I would do if I were a virus would be to disable web3 check or make it think geth is legit. I think we have to rely on antivirus softwares in this case.
    – Nicolas Massart
    May 5, 2016 at 12:44
  • 1
    This describes how geth interaction can be subverted. Not directly related to this question about "what is running", but interesting nonetheless. forum.daohub.org/t/urgent-buying-dao-using-mist-has-hacked/1742 . Bundling the node with the wallet so that the exposed port 8545 would not be required would reduce some of the exposure / surface to attack. However, this would reduce the creative uses of that port by web apps.
    – Jamie Pitts
    May 13, 2016 at 15:56

2 Answers 2

Reset to default
2

So to answer the question, web3 doesn't know. If the port hosts a service that present a matching interface, web3 will use it, wether it's the official Geth or not.

Improve this answer
0

You can try web3.net.listening This property is read only and says whether the node is actively listening for network connections or not.

You can check whether there is any client open and web3 is able to communicate with it. 

var listening = web3.net.listening;
console.log(listening); // true of false
Improve this answer
2
  • Yes but it won't make any difference if the service is not the real geth but a clone or something with the same interface. It web3 won't see the difference. The point, as I understood it, is not to know if something that looks like geth responds on the port but to know if it really is geth.
    – Nicolas Massart
    May 23, 2016 at 13:26
  • @NicolasMassart, yes i know that
    – niksmac
    May 23, 2016 at 14:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.