Dogecoin Advocate Warns of Security Risks in Social Signing for Wallets

Concerns Over Social Signing in Blockchain Wallets

Concerns have been raised by Mishaboar, a member of the Dogecoin community, regarding the security implications of using social signing for blockchain wallet access. This method allows individuals to create wallets via everyday accounts—like Google or Apple ID—rather than dealing with complex seed phrases.

Unauthorized Transactions and Keplr's Response

The alarm was sounded following reports of unauthorized transactions involving some Keplr wallet accounts, which can be created through these social logins. In response, Keplr, a multichain wallet that supports various cryptocurrencies including Cosmos and Ethereum, has acknowledged the situation and is collaborating with the Web3Auth team to investigate the incidents more thoroughly.

Prior to Keplr’s announcement, Web3Auth, which provides blockchain wallet infrastructure, mentioned being aware of ongoing security issues affecting some services reliant on its platform. The company opted to temporarily disable its embedded wallet service as a precaution. After preliminary investigations, Web3Auth confirmed that users of MetaMask, another popular wallet application, did not appear to have been affected by these vulnerabilities.

Mishaboar's Critique of Social Signing

"Social signing, the feature you may want to add to your wallet if you hate your users."

Mishaboar emphasized that the issue could disproportionately affect novice crypto users who may not fully comprehend the dangers associated with linking their personal accounts to digital wallets. This situation raises concerns beyond simple financial theft; potential data breaches might connect a user’s real-world identity to their cryptocurrency holdings, posing significant risks.

"The worst part is that the users that use the social signing option—and who will end up being hacked through it—are also often newbies, entering crypto for the first time."

Mishaboar also highlighted that these concerns extend to wallets that allow users to back up their private keys in the cloud, indicating that such storage options are only as secure as the servers they reside on.

Advisory for iOS Users

In light of these security vulnerabilities, a recent advisory targets iOS users, recommending updates to bolster wallet security. This renewed urgency comes amidst research findings that have identified two exploit kits, named Coruna and DarkSword, which can compromise older iOS devices. These threats do not exploit any specific wallet applications but rather leverage device vulnerabilities to gain access to sensitive wallet data stored within them.