3

Lets say, for pushing a transaction I unlocked my wallet and pushed the transaction with the active permission by command line.
So, while wallet is remained unlocked, can anyone who knows my account name can push the transaction because the command simple asks this flag account_name@active. That's it.

My doubt is, what are the consequences if someone leaves his/her wallet unlocked for a while?

3

My doubt is, what are the consequences if someone leaves his/her wallet unlocked for a while?

The wallet is just a software that doesn't communicate with nodeos directly. If you have your wallet unlocked, then someone who has access to your machine can list your keys (by default, listing private keys in an unlocked wallet still requires the password) and send transactions signed by accounts managed by keys imported in your wallet. Note that they need to have access to your machine.

So, while wallet is remained unlocked, can anyone who knows my account name can push the transaction because the command simple asks this flag account_name@active. That's it.

No, the account_name@active is mapped to at least a public key, and cleos communicates with, for example, keosd to find the secret key(s) associated with the public key(s) and sign a transaction before sending it to nodeos. Someone only knowing your account name cannot do anything unless they're also using your machine with the unlocked wallet.

  • So, if i host wallets and in my machine multiple wallets are there. So, if someone leaves his/her wallet unlocked and i know the account name then I can use his account to push transaction. In that case, how someone will trust me to host their wallet on my machine? – Rajat Chaudhary Aug 6 '18 at 10:20
  • they can always make sure it's unlocked or they can trust you with a wallet that contains keypairs to less critical account permissions (eg custom permissions not owner or active) also you don't need to know the account name--you can find it anyway from the public keys stored in the wallet using cleos get accounts key – confused00 Aug 6 '18 at 10:24
  • Then if someone has to trust me, then doesn't it defeat the purpose of blockchain? – Rajat Chaudhary Aug 6 '18 at 10:26
  • not trust you in that sense--you can only do what the permissions resolved by the keys in the wallet allows you to do. if you want someone else to host your sensitive/critical private keys and you leave them unencrypted by not locking your wallet, you're running the same risk as you do in any blockchain when you expose your private keys, but eos allows you to manage permissions more conveniently. you can use a wallet that locks after each action, but this is not a question about security practices; it asks about the risks of leaving your wallet unlocked – confused00 Aug 6 '18 at 10:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.