Source: Wit Olszweski – Shutterstock
- Social recovery wallets create a higher level of theft protection than any other type of wallet, according to Ethereum’s Vitalik Buterin.
- The technology is currently only offered by the Argent wallet and the Loopring wallet.
Ethereum’s inventor Vitalik Buterin suggests in a blog post the wider adaptation of “social recovery wallets” to mitigate the problem of cryptocurrency theft. As Buterin writes on the blog post, one of the biggest challenges in making cryptocurrencies and blockchain applications usable by average users is security.
As such, how to prevent losses and theft is critical. While “many solutions” have been launched over the years, such as paper wallets, hardware wallets and Buterin’s own one-time favorite, multisig wallets, each type of wallet has a shortcoming, Buterin said:
However, these solutions have all suffered from various defects – sometimes providing far less extra protection against theft and loss than is actually needed, sometimes being cumbersome and difficult to use leading to very low adoption, and sometimes both.
According to Buterin, there is an emerging, better alternative: a newer type of smart contract wallet called a social recovery wallet. These wallets, according to the Ethereum inventor, can potentially offer a high level of security and much better usability than previous options. However, there is still a long way to go “before they can be easily and widely deployed.”
Ethereum’s inventor explains social recovery wallets
“Social recovery wallets” work in the way that there is a single “signing key” that is used to approve transactions. In addition, there are at least 3 “guardians”. A majority of them can cooperate to change the “signing key” of the account. Also, the signing key has the ability to add or remove guards, but only after a delay (often 1-3 days).
Basically, sending payments works like a normal wallet, so each signed transaction can be sent with a single confirmation click. If a user loses their signing key, then the social recovery feature kicks in.
The user can simply reach out to their guardians and ask them to sign a special transaction to change the signing pubkey registered in the wallet contract to a new one. This is easy: they can simply go to a webpage such as security.loopring.io, sign in, see a recovery request and sign it.
Other devices or paper mnemonics owned by the wallet owner himself, friends and family members, and institutions are all eligible for guardian selection. In addition, to reduce the risk of attacks on the guardians and collusion, the guardians do not have to be publicly known. This can be achieved in two ways, according to Buterin.
First, instead of the guardians’ addresses being stored directly on chain, a hash of the list of addresses can be stored on chain, and the wallet owner would only need to publish the full list at recovery time.
Second, each guardian can be asked to deterministically generate a new single-purpose address that they would use just for that particular recovery; they would not need to actually send any transactions with that address unless a recovery is actually required.
What happens if the signing key is stolen?
However, as Buterin also states, under the assumptions described, there is still the problem of the signing key being stolen through a hack. Because of this, social recovery can be extended to include a “vault.” The cryptocurrencies can be moved to this vault by sending them to the address of the vault, but they can only be withdrawn from the vault after a delay.
During that delay, the signing key (or, by extension, the guardians) can cancel the transaction. If desired, the vault could also be programmed so that some limited financial operations (eg. Uniswap trades between some whitelisted tokens) can be done without delay.
Currently, the two main wallets that have implemented social recovery are the Argent wallet and the Loopring wallet, according to Buterin.
Credit: Source link
