Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: use createFromUri instead of addFromUri for keys #320

Merged
merged 2 commits into from
Aug 1, 2024

Conversation

JoeCap08055
Copy link
Contributor

This PR changes our usage of keyring.addFromUri() to keyring.createFromUri() so that keypairs will not be saved in a long-lived variable.

Note, this is only a minor improvement to security for the following reasons:

  1. We do not have control over JS garbage collection, so not way to guarantee that the generated keypair is eliminated from memory at any given point in time
  2. The seed phrase used to generate the keypair is currently injected to the application as an environment variable, so anyone with enough access to view the process could also see the environment

Closes #187

@JoeCap08055 JoeCap08055 requested a review from wilwade July 31, 2024 19:03
Copy link
Contributor

@wilwade wilwade left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One suggestion to move new Keyring({ type: 'sr25519' }) to a const at the top level

Copy link
Contributor

@wilwade wilwade left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

@JoeCap08055 JoeCap08055 merged commit cc50ac7 into main Aug 1, 2024
6 checks passed
@JoeCap08055 JoeCap08055 deleted the chore/use-create-instead-of-add-for-keys branch August 1, 2024 00:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Code Standarization: Use createFromUri
2 participants