3

I'm new to ethereum and geth. I just want to know that my current architecture or solution to make a new Android wallet in secure way.

Mobile wallet -> sends private keys over https -> REST API(Node js) -> Web3.js -> Geth JSON RPC (locally available).

is it secure way to develop a wallet? or else please suggest me some ideas. enter image description here

4 Answers 4

3
+100

Sending the private keys...even through HTTPs...is a security issue. Not only would you have to trust the connection, but also the middleware in place.

Ideally, the public/private keys will be only accessible to the client-side. What you send over your connection, is the signed transaction requests.

Essentially, based on your graph, I'd:

  • Move web3 to the client size.
  • Depending on how this is being built...create a bridge from native to web3js (unless there is native build already made)...this would be your REST API > to > web3 bridge.
  • Have web3 connect > to > RPC directly.
5
  • JSON RPC is a HTTP communication link. Mar 16, 2018 at 20:08
  • 1
    @Sathish Never said not to use HTTP.
    – ReyHaynes
    Mar 16, 2018 at 20:16
  • @Sathish You can expose your geth rpc to the web through your server and connect to that directly, or use a service like Rinkeby which is a more robust option at this point in your development phase.
    – ReyHaynes
    Mar 20, 2018 at 13:42
  • please check out my answer. please give me your suggestions! Mar 20, 2018 at 14:28
  • Meant service like infura.io, not Rinkeby.
    – ReyHaynes
    Mar 20, 2018 at 17:05
1

I believe it is not about which form you send the private key. Sending private key to a service itself violates the design of blockchain - people need to trust your service not using the private keys for bad, also your service need to be secure enough against attacks.

0

To make it a one degree secure. Don't send your private key in a clear form. You must encrypt it.

You may also take a look to the implementation of an Android Ethereum Wallet called WallETH. You can get the full working source code @ https://github.com/walleth/walleth

Hope, this would help you.

0

According to @YANG Lei and @Haynes suggestions. I came up with my solution. Is it secure enough or suggest me some ways. Thank you!

Android Application -> Signs offline transaction using Web3j -> Sends to ETH node through NGINX Reverse proxy (HTTPS Communitcation) -> Nginx forwards to localhost JSON RPC Client.

enter image description here

2
  • 1
    This solution looks better. But you should edit your question instead of replying like that Mar 20, 2018 at 14:37
  • Looks better. Just as I mentioned. You can also opt to use a service like Infura (infura.io) to handle the second and third parts of your app connecting to the Ethereum network. That'll save you a bunch of time for prototyping.
    – ReyHaynes
    Mar 20, 2018 at 17:09

This site is temporarily in read-only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .