Code Monkey home page Code Monkey logo

airsign's Introduction

Airsign

Sign your ethereum transactions from a sealed Android mobile phone to avoid password leaks.

Getting Started

Prerequisites

You will need a pc and an mobile phone running Android os, both with camera: the mobile phone that is offline (henceworth the offline phone) from the internet to make sure no hacker can get access to your passwords, and one that is connected to the internet (henceworth the online pc). You need to install parity ethereum client on the online pc for this package to work. This system has not been tested with geth client.

Installing

On offline phone do the followings:

  1. In google play install:
    • qr code reader - needed to read qr code from online pc
    • Termux - runs linux commands under Android
    • Termux API - make termux scripts able to read from clipboard
  2. Execute the followings on offline phone in Termux:
pkg update
pkg upgrade
pkg install git
git clone https://github.com/r001/airsign 
cd airsign 
git checkout android-termux 
./install_android
  1. Create ethereum account(s), and copy them to offline phone in the /data/data/com.termux/files/home/.ethereum/keystore directory.
    • If you want to go extremel secure, then take a fresh installed pc, install parity there, create accounts there, and generate QR code from the account json data, read that QR code to offline phone.

On online pc do the followings:

  1. Execute the followings on online pc:

  2. Install the same accounts that you have installed to offline phone to online pc. You have three alternatives here:

    • Alternative a: Recommended method:
      1. Create an account on online pc.
      2. Open the account key file and change the "account" fields addresss to the address of your account created in 3. ! This way the account can not be cracked, since the real account data is not available on the online pc, but parity will still handle the account as it was valid.
    • Alternetive b: Create external account: In parity create new account and chose "External" in the menu. This method is secure, but a few dapps can not use it (eg. www.oasisdex.com), so it is not recommended. The advantage of this method is that parity itself will generate a QR code that has to be signed by the offline phone. See later.
    • Alternative c: Less secure method: Simply copy accounts to use for parity. Using this method makes it possible to brute force attack your password if adversary gets access to your account data.
  3. Do the followings:

git clone https://github.com/r001/airsign 
cd airsign 
git checkout android-termux 

Usage

  1. On online pc do whatever transaction with parity and wait for the signer to come up. Do not sign the transaction on online pc! The whole point of using airsign is to avoid disposing your passwords on the online pc.
  2. On online pc run airdrop. This will read the transaction and create a QR code from it on the command line.
  3. On offline phone run QR code reader and read the QR code generated in (2.). You will see that reading was successful when the transaction is written on the screen. Copy the transaction to the clipboard.
  4. On offline phone start Termux.
  5. In Termux run the command airsign/airsign. This will read the transaction from the clipboard, and generate a series of QR codes. By hitting a key on keyboard you can display all the generated QR codes one by one. On online pc read the QR codes generated one by one by executing airpublish. When you have read all the QR codes, hit CTRL-c on online pc.
  6. On online pc you can now reject the signature request in parity. This will not delete the transaction.

Authors

  • Robert Horvath - Initial work - airsign

License

This project is licensed with the GPL v3 license.

Acknowledgments

Thaks to Daniel Brockman and Mariano Conti for their help to develop this package.

airsign's People

Contributors

r001 avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.