MyMonero is the only mobile/web wallet for Monero. However, it is a centralized system where the source code (html/javascript) of the mobile wallet is stored in the server. This means that a perpetrator could embed malicious code or create a social engineering to steal the users seed/keys. In what way this could be circumvented or the users maybe alerted when there is a tampering of code.
Add a comment
|
1 Answer
The article Javascript Cryptography Considered Harmful goes through this quite well.
Secure delivery of Javascript to browsers is a chicken-egg problem.
Newer browsers that support Subresource Integrity allow a website to specify a file hash for an external resource (a stylesheet or some Javascript). This is nice but there is nothing stopping an attacker calculating a hash for their malicious code and inserting that into the integrity attribute.
