3

I'm new to ethereum and geth. I just want to know that my current architecture or solution to make a new Android wallet in secure way.

Mobile wallet -> sends private keys over https -> REST API(Node js) -> Web3.js -> Geth JSON RPC (locally available).

is it secure way to develop a wallet? or else please suggest me some ideas. enter image description here

|improve this question
3
+100

Sending the private keys...even through HTTPs...is a security issue. Not only would you have to trust the connection, but also the middleware in place.

Ideally, the public/private keys will be only accessible to the client-side. What you send over your connection, is the signed transaction requests.

Essentially, based on your graph, I'd:

  • Move web3 to the client size.
  • Depending on how this is being built...create a bridge from native to web3js (unless there is native build already made)...this would be your REST API > to > web3 bridge.
  • Have web3 connect > to > RPC directly.
|improve this answer
  • JSON RPC is a HTTP communication link. – Sathish Kumar Mar 16 '18 at 20:08
  • 1
    @Sathish Never said not to use HTTP. – ReyHaynes Mar 16 '18 at 20:16
  • @Sathish You can expose your geth rpc to the web through your server and connect to that directly, or use a service like Rinkeby which is a more robust option at this point in your development phase. – ReyHaynes Mar 20 '18 at 13:42
  • please check out my answer. please give me your suggestions! – Sathish Kumar Mar 20 '18 at 14:28
  • Meant service like infura.io, not Rinkeby. – ReyHaynes Mar 20 '18 at 17:05
1

I believe it is not about which form you send the private key. Sending private key to a service itself violates the design of blockchain - people need to trust your service not using the private keys for bad, also your service need to be secure enough against attacks.

|improve this answer
0

To make it a one degree secure. Don't send your private key in a clear form. You must encrypt it.

You may also take a look to the implementation of an Android Ethereum Wallet called WallETH. You can get the full working source code @ https://github.com/walleth/walleth

Hope, this would help you.

|improve this answer
0

According to @YANG Lei and @Haynes suggestions. I came up with my solution. Is it secure enough or suggest me some ways. Thank you!

Android Application -> Signs offline transaction using Web3j -> Sends to ETH node through NGINX Reverse proxy (HTTPS Communitcation) -> Nginx forwards to localhost JSON RPC Client.

enter image description here

|improve this answer
  • 1
    This solution looks better. But you should edit your question instead of replying like that – Crema Mar 20 '18 at 14:37
  • Looks better. Just as I mentioned. You can also opt to use a service like Infura (infura.io) to handle the second and third parts of your app connecting to the Ethereum network. That'll save you a bunch of time for prototyping. – ReyHaynes Mar 20 '18 at 17:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.