Dogecoin community member Mishaboar has raised alarms over potential security risks associated with logging into blockchain wallets using social auth methods like Google, Apple ID, Telegram, or email. The momentum of this discussion soared following reports of unauthorized transactions on Keplr Wallet, which supports multiple networks.
Unauthorized Transactions Reported
Keplr revealed that it received notifications of unauthorized activities in accounts set up via Google or Apple login methods. The company stated that the issue has been escalated to the Web3Auth team for a joint investigation. Keplr provides wallet services for multiple networks, including Cosmos, Bitcoin, Ethereum, and Starknet.
While Web3Auth simplifies crypto wallet access through traditional login methods, it poses additional security questions regarding key management and data flow. Despite easing seed phrase management, the infrastructure could inadvertently introduce vulnerabilities.
“Social login might be a feature one would add if they disliked their users,” stated Mishaboar.
Mishaboar emphasized that this method could be especially challenging for users new to cryptocurrency. While it simplifies wallet creation and access, it could also lead to security loopholes that users might not fully comprehend.
Risks of Identity Linkage Emerged
Mishaboar warned that risks aren’t confined to assets within the wallet; when personal accounts are linked to wallet services, potential data breaches could link the user’s real identity with their digital assets, a scenario with grave implications.
“The majority of those using social login and potentially at risk are newcomers. Moreover, the threat isn’t limited to funds within the wallet,” Mishaboar cautioned.
The warning extends to wallets backing up keys on cloud services, which effectively store data on third-party servers. Mishaboar stresses this practical understanding of “cloud” entails entrusting information to an external entity’s infrastructure.
iOS Users Urged for Security Updates
This week, a separate security advisory was issued for iOS users, urging them to update their devices to enhance wallet security. Security researchers have identified two exploit kits, Coruna and DarkSword, targeting older iOS versions.
These tools do not exploit specific wallet application flaws but can access wallet data stored on compromised devices. Therefore, the risk is deemed to be associated not only with the app level but also directly linked to the overall device security.
