i have a question: in the web wallets(hosted wallets)when user want to make a transaction and send the information to the wallet server , can a one change the information(man in the middle attack)?


Depending on the nature of the implementation, yes.

If you are considering hosted wallets such as exchanges, then yes - an MITM that is able to bypass SSL protections, a fairly common implementation on many corporate and organizational networks, will trivially be able to change data.

Certain wallets work around this by either storing the private keys locally and signing information retrieved from a remote server (such as metamask, or ledger live), which might still be susceptible to an MITM on the information being retrieved, or by using a local secret to sign requests to the remote server, which prevents in flight modification without detection.

Wallets further work around that by using systems such as the SPV protocol to both retrieve and verify data prior to signing it.

| improve this answer | |
  • You should always download a wallet and make sure this wallet does not require you to sign up and give any information. A secure wallet will generate the 12 to 24 word mnemonic phrase and tell you to back it up. – ecavero Feb 28 at 18:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.