Dogecoin Contributor Flags Social Signing as Potential Wallet Security Risk
Dogecoin community member Mishaboar has raised concerns about social signing, a wallet feature that uses everyday accounts like Google or Apple ID, following reports of unauthorized transactions on Keplr accounts.
This comes after Keplr, a multichain wallet supporting Cosmos, Bitcoin, Ethereum, and Starknet, stated it had received reports of unauthorized transactions on some Keplr accounts created with Google or Apple login. The wallet provider stated that the incident has been escalated to the Web3Auth team, with both working together to investigate the matter.
Before Keplr's disclosure, Web3 wallet infrastructure provider Web3Auth said it was aware of a security issue affecting its services used by some third parties. It stated that it had temporarily paused the embedded wallet service in response to the issue; however, after an initial investigation, no evidence was found that MetaMask users were impacted.
Social signing risks flagged
In his X post, Mishaboar criticized social signing. The concern is particularly significant for inexperienced crypto users who may not recognize the risks associated with connecting their personal accounts to wallet services. While the feature makes wallet creation and access easier, it could introduce security vulnerabilities that users may not fully understand.
Social signing, the feature you may want to add to your wallet if you hate your users. The worst part is that the users that use the social signing option -and which will end up being hacked through it - are also often newbies, entering crypto for the first time. And the risk goes beyond the funds in your wallet - data leaks could link your real life identity to your holdings, which can have terrible consequences.
Mishaboar noted that this warning also extends to wallets using social sign-in, which allows users to back up their keys in the "Cloud," which just means somebody else's server, he explained.
iOS security alert
This week, a security advisory was issued for iOS users, who are urged to update their devices to enhance their wallet security. This follows security researchers identifying two exploit kits, Coruna and DarkSword, which target devices running older iOS versions. These do not rely on a flaw in any wallet app, but once a device is compromised, they can access wallet data stored on it.
Related
