RE: Hate putting private keys into websites? Introducing Steem Keychain!

You are viewing a single comment's thread from:

RE: Hate putting private keys into websites? Introducing Steem Keychain!

yabapmatt in #steem • 6 years ago

This is an important conversation so thank you for bringing it up. As far as I know the security concerns around browser extensions primarily come from fake extensions being listed in the stores that impersonate real ones to steal keys. As long as you are careful to only install and use the legitimate version at the link i shared above there should be no security concern.

I think the fact that Metamask has been widely used for storing Ethereum private keys for a long time now shows that browser extensions can be a secure and user-friendly way to transact on blockchains, and we have built Steem Keychain to work as similarly to Metamask as possible.

6 years ago in #steem by yabapmatt

0.00 BPC

4 votes

Sort:

Trending

[-]

dhimmel 6 years ago

With extensions you are placing a large amount of trust in the developer and the codebase. For example, the extension requires permission to:

Read and change all your data on the websites you visit

Hence, a malicious developer could not only steal your Steem credentials but possibly even other types of personal content.

I happen to know @yabapmatt is not malicious. However, there is still the possibility that his account gets hacked and a malicious version of the extension is released to the Chrome store. I'm not sure how common this type of attack is and what sort of screening extensions undergo to prevent this.

So in summary, browser extensions can be secure, as if implemented properly they perform all sensitive tasks client-side, which is good, but also can easily leak sensitive data should they be poorly engineered or created/hijacked by an attacker. Please add to my understanding if it's incomplete.

0.00 BPC

9 votes

[-]

quochuy 6 years ago

You have a ability to download the extension to your harddrive and tell Chrome to load it locally. Your copy of the extension would then be updated only when you update the code manually

0.00 BPC

2 votes

[-]

haejin 6 years ago

And how do you download the extension to local HD?

0.00 BPC

9 votes

[-]

quochuy 6 years ago

Hi @haejin

The following instructions have been written for a Mac computer, but for a Windows computer, it's very similar:

Go to the Steem Keychain GIT repository: https://github.com/MattyIce/steem-keychain
Click on the "Clone or Download" green button
Select "Download ZIP"
Once the ZIP file download successfully, unzip it somewhere on your local HD. For the purpose of this mini-guide, I will assume you have unzipped it under Documents/steem-keychain-master
Now, launch Chrome and in the address bar, type chrome://extensions
On the top right of the screen, enable the "Developer mode"
Now you have three new button showing at the top left, click on "Load unpacked"
Browse to Documents
click on the folder steem-keychain-master
click on the "Select button"
You should now see the extension appearing on the screen

To upgrade you will have to download and unzip again and overwrite the files on your local harddrive then go back to chrome://extensions and click the circular arrow icon to reload the extension. Verify its version number to confirm the upgrade.

This is what Chrome extension developers do to test their extensions before uploading it to the Chrome Web Store.

0.00 BPC

7 votes

[-]

haejin 6 years ago

Thanks! Very helpful!
Would an upgrade wipe out prior entered keys?
If one had used steemconnect or entered keys via cop paste in the past, should new keys be generated for the Key Chain; in the event steemconnect or steemit inc. get hacked?

0.00 BPC

10 votes

[-]

quochuy 6 years ago (edited)

An upgrade should not wipe the entered keys if you don’t remove the extension prior to the upgrade. ~~I have not checked how the extension stores the keys but beware when you clear the browser’s cache as it might also clear the keys depending on the cache clearing options you checked.~~ After checking the extension and testing on another computer, it seems that clearing cache does not clear your keys from the extension, to remove all store keys, you would need to remove the extension itself.

To my knowledge, SteemConnect (from v2) does not store your private keys, it uses you active key to grant posting authority to the dapps that was using SteemConnect. The key is not needed later on when posting or upvoting. The private key is still requested for each transfer or settings request. Utopian got hacked in the past, the hacker could not retrieve the keys because there was nothing to retrieve, they could only use the SteemConnect token to perform the upvotes. If SteemConnect get hacked, just revoke your tokens.

However, if you want to be 100% you have not leaked your keys somehow then yes, go regenerate them. I still recommend you kept your owner key somewhere else safe.

Posted using Partiko iOS

0.00 BPC

4 votes

[-]

cryptosharon 6 years ago

Do you know which option that is, so that I can look out for it if I decide to update or erase cache?

Posted using Partiko Android

0.00 BPC

[-]

quochuy 6 years ago

I've updated my comment above, but it seems that clearing cache didn't remove the keys but removing the extension from Chrome does.

0.00 BPC

[-]

bearone 6 years ago

Thanks for the detailed explanation Q. I'll look into it and follow your instructions. 👍

0.00 BPC

[-]

quochuy 6 years ago

You're welcome :-)

0.00 BPC

[-]

cryptosharon 6 years ago

Do you develop chrome extensions?

Posted using Partiko Android

0.00 BPC

[-]

quochuy 6 years ago

I do occasionally

0.00 BPC

[-]

cryptosharon 6 years ago

I wanna :D
SoonTM

0.00 BPC

[-]

yabapmatt 6 years ago

All good, valid points. There's really no situation where it's completely impossible for keys to ever get stolen. I will say that the extension purposely never stores the owner key or master password for accounts, so if there were to ever be a hack, while that would certainly be bad as active keys and liquid funds could be stolen, it's a much easier situation to recover from since you can just change your keys and not have to go through the account recovery process.

I believe this is still more secure than the system being used now where if any of the sites into which people are putting their keys are hacked, many master passwords will be stolen.

0.00 BPC

2 votes

[-]

cryptosharon 6 years ago

Much more secure indeed in this era of middlemen. I just wish browsers had a much heavier emphasis on security in order to facilitate these tasks with the biggest convenience:security ratio.

Posted using Partiko Android

0.00 BPC

[-]

cryptosharon 6 years ago

You are completely right. The safest way is compiling the extension yourself as has been explained elsewhere on this thread.

Posted using Partiko Android

0.00 BPC

1 vote

[-]

cryptosharon 6 years ago

Will it also be used for SMTs like metamask allows for erc20 tokens?

Posted using Partiko Android

0.00 BPC

[-]

yabapmatt 6 years ago

Absolutely!

0.00 BPC