0

If I sent a message via http to a smart contract, how secure is that? If I cannot use TLS, then could someone listen at he port and then intercept the message and then divert the message to an unknown blockchain?

  • Can you give the exact scenario where you are worried about ssl? What are you trying to do? – Andrey Mar 22 '18 at 3:05
2

All the data in the blockchain is public and anyone with a copy of it can read transactions sent to a contract and do anything they want to do with it.


It depends where are your keys stored:

  1. keys are stored in the client side (ie metamask, hardware wallet): transactions are signed and cannot be modified without tampering with the signature.

  2. keys are stored in the server (ie inside a client like geth or parity): you have to secure the communication between your ui and the server, for example with SSL certificates or an SSH tunnel.

  • Yes but the issue to me was the HTTP messaging between the contract and the UI; and if someone could interfere with that. – Trevor Lee Oakley Mar 22 '18 at 7:39
  • @TrevorOakley I've added updated my answer with a few notes about that when you have to secure the communication. – Ismael Mar 22 '18 at 12:37
0

What I would do is create a dapp to interact with the contract,and put that dapp in a safe server with https or a VPN on. This way data from dapp to the contract would be safe. But I guess if between you in the dapp is compromised (let's say with a malware or keylogger) then it won't

  • This sounds like we are not using blockchains anymore but a secure server and a normal app. If we require just one server to be used then we have the same issues with a centralised server service. – Trevor Lee Oakley Mar 22 '18 at 2:19
  • If you connect with X method directly to the blockchain, you'll still have this issue. – btc4cash Mar 22 '18 at 2:22
  • My way secure the request from dapp to the blockchain but not from user to the dapp. Using like metamask or myetherwallet on a compromised device would be in any case bad. – btc4cash Mar 22 '18 at 2:23
0

You need to either find a node that accepts SSL or run a local node and setup ngnix with SSL, as described here:

How To SSL Ethereum Geth Node?

  • What if someone just uses another node? Can we really require a user to use just one node? I thought that was not possible as all the nodes would run the contract at the same time. – Trevor Lee Oakley Mar 22 '18 at 2:18
  • Ok so how it works is - when you submit a transaction to ethereum, it goes to one node and executes there, and from there it goes to a bunch of other nodes and executes there to make sure the result is the same. You can control the connection between your app and the first note (if you host that node) but you can't control the communication between the nodes (and you don't need to). If you can't force your app to connect to your own node where you can setup reverse proxy with ssl, then it connects to regular nodes over its rcp protocol which doesn't support ssl. – Andrey Mar 22 '18 at 3:04
  • That is interesting about connecting to one node only. – Trevor Lee Oakley Mar 22 '18 at 7:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.