Is there any secure solution(without exposing a Private key of the user) to automatically sign transactions, which are requested from a DApp, so that user doesn't have to sign each of them manually? I know that in the web3 API exists something like this:

let signedTransaction = await web3.eth.accounts.signTransaction(options, PRIVATE_KEY);

But Private key is exposed here, which is in my opinion a security issue. Am I wrong?

  • You could keep the private key in local storage – AKroell Feb 12 '19 at 14:52
  • Thanks for the answer. I think it's still a security issue, is it somehow possible without using any private key in the browser? – gorpen Feb 12 '19 at 15:01
  • You could use a proxy contract that you have control over and the user can trigger transactions through authenticated REST calls but then you are in charge of keeping the private key secure. – AKroell Feb 12 '19 at 15:14
  • At Pegasys we are working on a project called EthSigner that acts like a proxy for your tx and sign them but your dapp and node will never have to deal with the keys. You may have a look at it : docs.ethsigner.pegasys.tech – Nicolas Massart May 14 '19 at 12:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.