Topic: [ANN][SHIFT] The New Web | IPFS/Phantom | ShiftNrg.org Hosted Decentralized! - page 59. (Read 547597 times)

Quote from: ngin-x on July 24, 2017, 12:14:45 AM

This doesn't look good. Still time to fix this, but I'm surprised there was no urgency even when they knew about it

After getting the above response, I asked the devs when the new version of the web wallet will be released. No response so far. I'll post here if I get any.

This needs to be fixed on an urgent basis. After what happened with Parity hack, I don't think I can sleep easy until this is fixed.

Shift also needs a desktop lite client. Web wallets cannot be trusted.

No answer about it yet ?

Nope.

This is the response a dev named Ralph S gave the Ryder forum a few days ago.

Some of you mentioned this post about a warning for LSK, SHIFT, RISE.
https://boards.4chan.org/biz/thread/2836956

There is no reason to panic, we are aware of that API endpoint and the security risk this could cause. They do have a point, and it is important to repeat: ALWAYS use the OFFICIAL https wallet, if you are not running your own node!
No need to say that we NEVER log input. Some users who lost their keys wish we would though.

We do have a fix for this, to be released in the next wallet update. Where we don't use this endpoint at all, and sign transactions at the client side to broadcast to our main nodes.
That way your private keys are safe, because they aren't sent at all. You can compare it to the way MyEtherWallet works.

We hope this explains the case and answers your questions.

Why are you copy pasting Ralph's response everywhere? Your answer is not relevant to the question asked.

realstarlord

member

Activity: 84

Merit: 10

This doesn't look good. Still time to fix this, but I'm surprised there was no urgency even when they knew about it

After getting the above response, I asked the devs when the new version of the web wallet will be released. No response so far. I'll post here if I get any.

This needs to be fixed on an urgent basis. After what happened with Parity hack, I don't think I can sleep easy until this is fixed.

Shift also needs a desktop lite client. Web wallets cannot be trusted.

No answer about it yet ?

Nope.

This is the response a dev named Ralph S gave the Ryder forum a few days ago.

Some of you mentioned this post about a warning for LSK, SHIFT, RISE.
https://boards.4chan.org/biz/thread/2836956

There is no reason to panic, we are aware of that API endpoint and the security risk this could cause. They do have a point, and it is important to repeat: ALWAYS use the OFFICIAL https wallet, if you are not running your own node!
No need to say that we NEVER log input. Some users who lost their keys wish we would though.

We do have a fix for this, to be released in the next wallet update. Where we don't use this endpoint at all, and sign transactions at the client side to broadcast to our main nodes.
That way your private keys are safe, because they aren't sent at all. You can compare it to the way MyEtherWallet works.

We hope this explains the case and answers your questions.

ngin-x

full member

Activity: 308

Merit: 100

Quote from: Bigbobbasher on July 23, 2017, 06:49:15 PM

This doesn't look good. Still time to fix this, but I'm surprised there was no urgency even when they knew about it

After getting the above response, I asked the devs when the new version of the web wallet will be released. No response so far. I'll post here if I get any.

This needs to be fixed on an urgent basis. After what happened with Parity hack, I don't think I can sleep easy until this is fixed.

Shift also needs a desktop lite client. Web wallets cannot be trusted.

No answer about it yet ?

Nope.

Bigbobbasher

full member

Activity: 238

Merit: 101

Crypto connoisseur.

Aha!!! Great!!! Now i get it! Thx realstarlord!

realstarlord

member

Activity: 84

Merit: 10

Quote from: realstarlord on July 23, 2017, 06:01:53 PM

Quote from: Bigbobbasher on July 23, 2017, 02:22:30 PM

So do we vote for more than one pool? Or if we vote for more than one does that mess up forging?

Hello,

Vote for a many delegates and delegate pools as you like!

You can vote for 33 at a time and up to 101 total.

It costs 1 shift to vote, so try to vote for as many pools and delegates in one vote as possible.

So then which pool would pay out to me that i voted for?

All of the pools you vote for will payout. So you can vote for every pool that is forging (top 101) if you like.

Bigbobbasher

full member

Activity: 238

Merit: 101

Crypto connoisseur.

Quote from: realstarlord on July 23, 2017, 06:01:53 PM

Quote from: Bigbobbasher on July 23, 2017, 02:22:30 PM

So do we vote for more than one pool? Or if we vote for more than one does that mess up forging?

Hello,

Vote for a many delegates and delegate pools as you like!

You can vote for 33 at a time and up to 101 total.

It costs 1 shift to vote, so try to vote for as many pools and delegates in one vote as possible.

So then which pool would pay out to me that i voted for?

realstarlord

member

Activity: 84

Merit: 10

Quote from: Bigbobbasher on July 23, 2017, 02:22:30 PM

So do we vote for more than one pool? Or if we vote for more than one does that mess up forging?

Hello,

Vote for a many delegates and delegate pools as you like!

You can vote for 33 at a time and up to 101 total.

It costs 1 shift to vote, so try to vote for as many pools and delegates in one vote as possible.

realstarlord

member

Activity: 84

Merit: 10

This doesn't look good. Still time to fix this, but I'm surprised there was no urgency even when they knew about it

After getting the above response, I asked the devs when the new version of the web wallet will be released. No response so far. I'll post here if I get any.

This needs to be fixed on an urgent basis. After what happened with Parity hack, I don't think I can sleep easy until this is fixed.

Shift also needs a desktop lite client. Web wallets cannot be trusted.

No answer about it yet ?

Hello,

One of the Shift devs responded on Ryver. I would like to share his response with you:

Some of you mentioned this post about a warning for LSK, SHIFT, RISE.
https://boards.4chan.org/biz/thread/2836956

There is no reason to panic, we are aware of that API endpoint and the security risk this could cause. They do have a point, and it is important to repeat: ALWAYS use the OFFICIAL https wallet, if you are not running your own node!
No need to say that we NEVER log input. Some users who lost their keys wish we would though.

We do have a fix for this, to be released in the next wallet update. Where we don't use this endpoint at all, and sign transactions at the client side to broadcast to our main nodes.
That way your private keys are safe, because they aren't sent at all. You can compare it to the way MyEtherWallet works.

We hope this explains the case and answers your questions.

Bigbobbasher

full member

Activity: 238

Merit: 101

Crypto connoisseur.

So do we vote for more than one pool? Or if we vote for more than one does that mess up forging?

afrorc

newbie

Activity: 22

Merit: 0