Private Key exposure during Wallet signup about blockchain-carbon-accounting HOT 4 CLOSED

This feature was implemented because I felt that UI flow requiring metamask is not intuitive for non-crypto users. The goal was to make it easy for a user to sign up and use the application without a wallet like Metamask or signing every transaction.

You bring up a good point that the private key should be encrypted in the database. I'd rather not require the user to enter their password, though, to confirm the transaction each time.

We should remove the logging of the private key in the console.

from blockchain-carbon-accounting.

@sichen1234

agree with the approach you adopted. Metamask is a powerful tool but not for everyone and will create adoption barriers.

at a minimum server side private key encryption using secure environment secret. If a backup of the db is leaked all the users private keys are exposed.

from blockchain-carbon-accounting.

@brioux Good point. I think a passphrase in the config file is better. What do you think?

from blockchain-carbon-accounting.

This has been fixed. Thanks for bringing it up.

from blockchain-carbon-accounting.