3

I am working on App that will be deployed in private blockchain. For testing I used to unlock my Account from Geth console to overcome 'could not unlock signer account'. However there is a risk of someone else can connect node and execute transaction if I unlock Account (no matter how short unlock Account duration is). How do I execute transaction without unlocking Account. Can I send password with every transaction?

1

2 Answers 2

1

Use web3.personal.unlockAccount("accnumber", "password", duration) to unlock the account remotely. This API can be made available over RCP:

    /geth --testnet --fast --rpc --rpcapi "db,eth,net,web3,personal" console

However this does not reduce any risk. If an attacker has a direct connection to the RPC of your node, he or she can just repeatedly bomb the node with sendTransaction requests until the account happens to be unlocked. So don't expose RPC interface to third parties. Make sure it can be connected from your servers only using IP whitelists and similar.

1

You can't, the account essentially holds the private key that is needed for signing transactions. The private key is used to create a signature and the public key (which is derived from the address) is used to verify it (the signer could be the only entity capable of producing that signature).

No, the password is only there to protect the private key which is encrypted using AES (the password is the key for decrypting the account's private key).

2
  • how can i see my private key?
    – Aniket
    Aug 23, 2016 at 7:36
  • Please ask a separate question as it's not related to this one.
    – Sebi
    Aug 23, 2016 at 9:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.