Lets say, for pushing a transaction I unlocked my wallet and pushed the transaction with the active permission by command line.
So, while wallet is remained unlocked, can anyone who knows my account name can push the transaction because the command simple asks this flag account_name@active. That's it.
My doubt is, what are the consequences if someone leaves his/her wallet unlocked for a while?
Add a comment
|
1 Answer
My doubt is, what are the consequences if someone leaves his/her wallet unlocked for a while?
The wallet is just a software that doesn't communicate with nodeos directly. If you have your wallet unlocked, then someone who has access to your machine can list your keys (by default, listing private keys in an unlocked wallet still requires the password) and send transactions signed by accounts managed by keys imported in your wallet. Note that they need to have access to your machine.
So, while wallet is remained unlocked, can anyone who knows my account name can push the transaction because the command simple asks this flag account_name@active. That's it.
No, the account_name@active is mapped to at least a public key, and cleos communicates with, for example, keosd to find the secret key(s) associated with the public key(s) and sign a transaction before sending it to nodeos. Someone only knowing your account name cannot do anything unless they're also using your machine with the unlocked wallet.
answered Aug 6, 2018 at 10:17
-
So, if i host wallets and in my machine multiple wallets are there. So, if someone leaves his/her wallet unlocked and i know the account name then I can use his account to push transaction. In that case, how someone will trust me to host their wallet on my machine? Commented Aug 6, 2018 at 10:20
-
they can always make sure it's unlocked or they can trust you with a wallet that contains keypairs to less critical account permissions (eg custom permissions not owner or active) also you don't need to know the account name--you can find it anyway from the public keys stored in the wallet using
cleos get accounts keyCommented Aug 6, 2018 at 10:24 -
Then if someone has to
trustme, then doesn't it defeat the purpose of blockchain? Commented Aug 6, 2018 at 10:26 -
not trust you in that sense--you can only do what the permissions resolved by the keys in the wallet allows you to do. if you want someone else to host your sensitive/critical private keys and you leave them unencrypted by not locking your wallet, you're running the same risk as you do in any blockchain when you expose your private keys, but eos allows you to manage permissions more conveniently. you can use a wallet that locks after each action, but this is not a question about security practices; it asks about the risks of leaving your wallet unlocked Commented Aug 6, 2018 at 10:33