If I sent a message via http to a smart contract, how secure is that? If I cannot use TLS, then could someone listen at he port and then intercept the message and then divert the message to an unknown blockchain?
asked Mar 21, 2018 at 20:22
-
Can you give the exact scenario where you are worried about ssl? What are you trying to do?– AndreyCommented Mar 22, 2018 at 3:05
Add a comment
|
3 Answers
All the data in the blockchain is public and anyone with a copy of it can read transactions sent to a contract and do anything they want to do with it.
It depends where are your keys stored:
keys are stored in the client side (ie metamask, hardware wallet): transactions are signed and cannot be modified without tampering with the signature.
keys are stored in the server (ie inside a client like geth or parity): you have to secure the communication between your ui and the server, for example with SSL certificates or an SSH tunnel.
-
Yes but the issue to me was the HTTP messaging between the contract and the UI; and if someone could interfere with that. Commented Mar 22, 2018 at 7:39
-
@TrevorOakley I've added updated my answer with a few notes about that when you have to secure the communication.– Ismael ♦Commented Mar 22, 2018 at 12:37
What I would do is create a dapp to interact with the contract,and put that dapp in a safe server with https or a VPN on. This way data from dapp to the contract would be safe. But I guess if between you in the dapp is compromised (let's say with a malware or keylogger) then it won't
-
This sounds like we are not using blockchains anymore but a secure server and a normal app. If we require just one server to be used then we have the same issues with a centralised server service. Commented Mar 22, 2018 at 2:19
-
If you connect with X method directly to the blockchain, you'll still have this issue.– btc4cashCommented Mar 22, 2018 at 2:22
-
My way secure the request from dapp to the blockchain but not from user to the dapp. Using like metamask or myetherwallet on a compromised device would be in any case bad.– btc4cashCommented Mar 22, 2018 at 2:23
You need to either find a node that accepts SSL or run a local node and setup ngnix with SSL, as described here:
-
What if someone just uses another node? Can we really require a user to use just one node? I thought that was not possible as all the nodes would run the contract at the same time. Commented Mar 22, 2018 at 2:18
-
Ok so how it works is - when you submit a transaction to ethereum, it goes to one node and executes there, and from there it goes to a bunch of other nodes and executes there to make sure the result is the same. You can control the connection between your app and the first note (if you host that node) but you can't control the communication between the nodes (and you don't need to). If you can't force your app to connect to your own node where you can setup reverse proxy with ssl, then it connects to regular nodes over its rcp protocol which doesn't support ssl.– AndreyCommented Mar 22, 2018 at 3:04
-
That is interesting about connecting to one node only. Commented Mar 22, 2018 at 7:38