1

I currently use web3 and geth to develop dapps, and we know that web3 interacts with geth through json rpc. If we want to unlock an account through dapp, we need to enter the password in the dapp, and then web3 will unlock it through json rpc. I want to know when web3 uses the password provided by the user to send an unlock request to geth, will this password be hijacked by an intermediary? I personally think that json rpc is also transmitted in plain text, so I think json rpc is not safe, I don’t know if my understanding is correct.

Hope you can help me, thank you!

Improve this question

1 Answer 1

Reset to default
1

Maintaining unlocked accounts on the node that you're communicating with is typically useful for testing your contracts on a local network, for example, via ganache.

When working on a remote network, it is generally risky because anyone hacking the node that you're communicating with can exploit those unlocked accounts at will.

So you may want to consider the following alternative scheme:

When a user registers:

  1. The user enters a memorable password
  2. The client encrypts the private key with the password, and sends it to the server
  3. The server receives the encrypted private key, and saves it into the database

When a user logs-in:

  1. The server sends the encrypted private key to the client

When a user performs a transaction available on client's web-page:

  1. The user enters the password
  2. The client decrypts the private key using the password
  3. The client signs the transaction with the private key
  4. The client sends the signed transaction to the server
  5. The server sends the signed transaction to the node
Improve this answer
13
  • Hi, goodvibration! Your answer helped me a lot. I am not very clear about one place. In your answer, it says: 4. The client sends the signed transaction to the server. 5. The server sends the signed transaction to the node. I know that web3 can be used to send signed transactions to geth node. From a specific technical point of view, how to implement steps 4 and 5? Do I need to use web3 on both the client and server sides?
    – wei wang
    Dec 22, 2020 at 4:45
  • @weiwang: It doesn't have to be web3.js of course, but yes - if you choose to work with web3.js, then you could use:
    – goodvibration
    Dec 22, 2020 at 5:00
  • 3. const signedTx = await web3.eth.accounts.signTransaction(txOptions, privateKey);.
    – goodvibration
    Dec 22, 2020 at 5:00
  • 4. Send the output of it (signedTx.rawTransaction) to the server via HTTP or similar.
    – goodvibration
    Dec 22, 2020 at 5:00
  • 5. const receipt = await web3.eth.sendSignedTransaction(signed.rawTransaction);.
    – goodvibration
    Dec 22, 2020 at 5:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.