4

From what I am reading in various places such as here ,here or here, it is not safe to expose the personal api to the front-end Dapp via RPC.

Hence asking the users to run geth --rpc --rpcapi "eth,net,web3,personal" --rpccorsdomain "http://yourDomain is not safe.

My question is why is that the case? I have the impression the links I provided gloss through it but I am still a bit unclear.

Thanks!

EDIT

From the answers I would like to expand/clarify a bit on my confusion:

A user logs into his computer and typesgeth --rpc --rpcapi "eth,net,web3,personal" --rpccorsdomain "http://yourDomain.com" on the terminal.

This enables his node to listen to http://yourDomain.com . Then he opens a browser and goes to the Dapp at http://yourDomain.com.

Then sure he would be able to mess around with his own node and accounts but how an external attacker could do that?

2
  1. Information disclosure: personal.listAccounts , will tell what are the addresses ( external account) that node contains.
  2. Brute force: Keep asking to unlock account [personal.unlockAccount()] by using listAccounts( above function),locking existing accounts ( personal.lockAccount) randomly.Inadvertently DoS attack
  3. Unnecessary Account creation: personal.newAccount() , keep creating accounts,may be billions of them so that your server space fills up ( geth creates keystore files on account creation)

Updates:

Who would be able to do hacking ?

Answer: Anyone, with malicious intention.

How would someone be able to perform the above tasks ?

Answer: From his browser console, he could do the following.

     var Web3 = require('web3');
         var web3 = new Web3();
         web3.setProvider(new web3.providers.HttpProvider("http://yourDomain"));
for(i=0;i<100000000;i++){
web3.personal.newAccount(/*some random function*/);
}// There the hacker could able to create 100000000 many accounts in your server.
web3.eth.defaultAccount="0xHackersOwnAccount"; //As the hacker knows somehow all incoming money transfer is to your default account, but alas !!  no more

I hope I did not teach wrong guy.

  • I understand that, however I was more perplex on who would be able to do that and how . I have edited the question in order to reflect that – EugVal Jul 3 '16 at 9:58
  • I see, thanks! (though as I suspected the attacker would need to have hold of the victims computer/session,then if you warn your users correctly it could be acceptable). You did not teach the wrong guy haha I'm was just hesitating between using the personal api or asking users to unlock their accounts when using the Dapp I'm building. – EugVal Jul 4 '16 at 20:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.