Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[venus-messager] 对于敏感消息限制，由链服务维护者确认后上链 #5253

Closed
1 of 11 tasks
cloudxin opened this issue Sep 1, 2022 · 8 comments
Closed
1 of 11 tasks

[venus-messager] 对于敏感消息限制，由链服务维护者确认后上链 #5253

cloudxin opened this issue Sep 1, 2022 · 8 comments
Assignees
@hunjixin
Labels
C-enhancement Category: feature enhancement C-triage Category: Need triage CU-force-community Category: from force community

Comments

@cloudxin
Copy link

cloudxin commented Sep 1, 2022

链服务模块 / Chain Service Components

  • venus
  • venus-auth
  • venus-gateway
  • venus-messager
  • venus-miner
  • 文档 / docs

订单服务模块 / Deal Service Components

  • venus-market
  • 文档 / docs

算力服务模块 / Storage Power Service Components

  • venus-sector-manager
  • venus-worker
  • 文档 / docs

描述 / Description

对ChangeOwnerAddress、ChangeWorkerAddress和Send这种敏感消息加以限制，需要由链服务维护者二次确认后，再往链上发送
@cloudxin cloudxin added the C-enhancement Category: feature enhancement label Sep 1, 2022
@hunjixin
Copy link
Contributor

hunjixin commented Sep 1, 2022

什么使用场景

@Fatman13 Fatman13 added C-triage Category: Need triage CU-force-community Category: from force community labels Sep 2, 2022
@Fatman13
Copy link
Contributor

Fatman13 commented Sep 2, 2022

这个感觉上好像不是最符合协议？

@cloudxin
Copy link
Author

cloudxin commented Sep 2, 2022

从安全层面考虑，ChangeOwnerAddress消息上链后会立即生效；如果任何消息都不加以限制，会有很大安全隐患，用户服务器被非法入侵或者接入token被无意泄漏，会导致恶意发送ChangeOwnerAddress消息，即使无法从venus-wallet中获取私钥；也可以通过这个功能修改owner地址

@Fatman13
Copy link
Contributor

Fatman13 commented Sep 2, 2022

owner不要同意就可以换吗？我记得是不是owner得同意一下？

@hunjixin
Copy link
Contributor

hunjixin commented Sep 2, 2022

更好的做法是不把owner地址关联到云服务， 通过离线工具例如lotus-shed这种工具进行类型的敏感工具。

@Fatman13
Copy link
Contributor

Fatman13 commented Sep 2, 2022

并推荐用户把owner自己保存，和worker地址分离？

@hunjixin
Copy link
Contributor

敏感信息自行控制

@hunjixin
Copy link
Contributor

#5304

@hunjixin hunjixin moved this to Done in Venus Project Sep 17, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@hunjixin hunjixin

Labels
C-enhancement Category: feature enhancement C-triage Category: Need triage CU-force-community Category: from force community
Projects
Venus Project
Archived in project
Milestone
No milestone
Development

No branches or pull requests
3 participants
@Fatman13 @hunjixin @cloudxin