8

Is ethereumwallet.com generating the all the keys, accounts and transactions client-side? Is it legit and safe to use?

ethereum wallet dot com

Is it possible to confirm the javascript has no backdoors? Can it be trusted?

6

If you are trying to store a lot of Ether, I wouldn't even risk Javascript, your browser, the operating system, the operating system drivers, various firmwares in your system, or the BIOS being compromised. You should just use geth on an offline computer to generate keys, save those addresses (write them down exactly, print them, or otherwise export them somehow), then send to those addresses later. (Just like with Bitcoin, the address never needs to "be online" to receive ether.)

Hot Wallet / Cold Wallet strategy is the only way to be safe. And the method of transferring between them should not be easy / should not be computer automated. (They were fully automated in cases like Mt. Gox getting broken into.)

For any hot wallet strategies (for pocket change amounts of ether or for keys to contracts that don't matter a lot to you), I'd still stick to only running the official clients, they would have been tested the most. (And if there's an exploit there, you'd better believe people will start opening issues and patches will be issued.)

As far as a direct answer to the question, I haven't ever audited the code of ethereumwallet.com, maybe the best way to do this is to post a bounty to make it worth many different people's time to go through? (But then, you'd only know the Javascript layer is safe. As I've stated above, there are other layers to worry about too.)

  • 2
    I disagree with cold wallets being safe. There were too many assets stolen from cold storages already and everyone today recommends multisignature. – Waqar Lim Jan 26 '16 at 11:43
  • Can you clarify by what you mean when you say official clients. Right now the official Ethereum Wallet is in beta, under heavy development, and is not being recommended by the developers for large amounts of Ether. We don't want anyone to be confused. – tayvano Jan 26 '16 at 16:30
  • 2
    @Taylor I agree with what you are saying. A geth backed client (even if the GUI is still in beta) still seems safer than trusting your money to some random website. But agreed - don't store large amounts in non-stable clients. – linagee Jan 27 '16 at 5:54
  • 1
    @5chdn: Multisignature is better, but would you be storing your multisignature private keys on an offline or online computer? This still matters, there is still a private key at the heart of it. – linagee Jan 27 '16 at 18:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.