Quote from: kontroll on April 12, 2025, 03:04:32 AM

Quote from: ABCbits on April 11, 2025, 11:47:08 AM

--snip--

Same can be said for MetaMask and Trust Wallet. Konkret was motivated to a large part from the lack of privacy options in the Ethereum web wallet space. Do you know of any other actually reasonable ones? Last I used Trezor Suite it was also sending your addresses to their servers in default configuration but can at least be configured to behave privately if you set it up with your own node and BlockBook server.

I don't really do research about this matter, although i recall few ETH wallet (such as Metamask and Frame) supposed to let you choose backend/server (used to get TX history).

Lets you configure an endpoint to use for RPC requests, yes. Even if you configure one, your addresses are still sent to their servers in the background anyway.

OK, so if I take a step back, your question comes from a good place. You recognize the risks and complexity of your Android.

You're recognizing the risk of running some bad code which manages to bend the system to trick it and/or you to do take some destructive action or expose and extract some information.

So you're looking for a new application which could then detect and protect you from these threats. You can't really get that much more secure by bolting on a new part on top of a fundamentally insecure and leaky foundation. There are some better approaches.

You can look for a more secure foundation. Which Android device and ROM you use make a big difference. GrapheneOS comes highly recommended and is a huge step up in security from most stock ROMs. It locks things down a bit more to protect against those kinds of exploits.

Second, separate your domains. Everyone talks about hardware wallets, and those can be great. But maybe you really shouldn't be browsing random sites on the same device that holds access to your crypto funds in the first place? You could get a new device (like an old Pixel 6 or sth) and keep that dedicated to your crypto dealings.

Third, practice basic OS hygiene on at least your important device. Remove old apps you don't use or recognize. Stay on top of OS updates. Don't sync or backup sensitive stuff on Drive or other clouds.

Thx for replies!

Unfortunately TG is not an option for me (and even if it were I don't really trust TG enough to be happy with that). I guess it should be possible to implement something similar to the TG bot if one is motivated enough.

What's the motivation behind disabling the forum notifs for some boards?

Quote from: Forsyth Jones on April 02, 2025, 10:36:27 PM

I recommend stopping using browser password managers, although they've evolved over time, they still cannot compare to the security of an offline password manager like keepass, which works even without an internet connection, since the database is saved locally.

I installed a Keepass extension on my browser, so I don't have to copy and paste every password I need. I believe it should be safer since it doesn't put anything on our clipboard just in case a malware is lurking around.

If you go the extra mile and use QubesOS or something with a similar compartmentalizing approach, you do get protection from those kinds of vectors since clipboard sharing is triggered only via dom0 ("root domain"), even escalating to root in a compromised AppVM ("user domain") shouldn't give access to clipboard contents of other AppVMs. It does take some dedication to set up but I believe it does pay off.

Still don't put your secrets on other peoples' clouds, though, yeah.

Usually a good idea to make ones thread model explicit in conversations like these. Are we only concerning ourselves with fund-loss incidents (obviously a primary concern either way) or also with privacy and for example not having our identity tracked and correlated with account addresses?

For privacy-conscious folks, I think it's a great idea to look into what your wallet is actually doing and what data it's sharing with whom. A lot of reputable wallets send out a lot more data than you'd think! This can also give you heads up when wallets are dynamically updating and loading code online outside of expected app updates (which is a what we call "supply-chain security risk" and relevant for your funds being SAFU).


For browser wallets

• You can open Developer Tools (Ctrl+Shift+J or F12) and look under the Network tab to inspect network activity
• Note that it's not guaranteed that all connections show up here. There are somewhat obscure channels extensions can use to have network activity not obviously show up here
• For browser extensions, you can open the inspector via the Debugging section of either Chrome or Firefox

For any reasonable wallet

• Any non-browser wallet should have a way to configure a proxy. You can set it up to proxy all requests via tools like mitmproxy or burpsuite to get a full insight into network activity
• The same approach works for browser wallets and is more certain to capture all requests
• If the wallet does not have any way to configure proxy for network connections, that should be a major red flag in itself
• If you're comfortable reading code or like a challenge, try to inspect and verify the source code. Source code not being available or readable are also red flags.

For unreasonable wallets

• First off, again, try to avoid wallets that give you trouble with the above approaches
• You could use a DNS server like pihole (or whatever "VPN DNS" app is good for mobile these days). Will not work if the app is sneaky using DoT/DoH
• You could force-use a transparent proxy and even intercept TLS connections if you roll up your h4x0r sleeves

Would also recommend checking out Konkret Wallet, if you're on the lookout for a safe browser wallet for Ethereum/EVM/ERC tokens.

Hi all!

Old-time greybeard here but first venture into posting on AT.

Interested in fundamentals and ideals and applying them in the real world through free/open-source software and privacy tech. I might do a bit of posting about how Konkret Wallet which I hope will be well-received.