Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

[venus-messager] 对于敏感消息限制，由链服务维护者确认后上链 #5253

Closed
1 of 11 tasks
cloudxin opened this issue Sep 1, 2022 · 8 comments
Closed
1 of 11 tasks

[venus-messager] 对于敏感消息限制，由链服务维护者确认后上链 #5253

cloudxin opened this issue Sep 1, 2022 · 8 comments
Assignees
@hunjixin
Labels
C-enhancement Category: feature enhancement C-triage Category: Need triage CU-force-community Category: from force community

Comments

@cloudxin
Copy link

cloudxin commented Sep 1, 2022

链服务模块 / Chain Service Components

  • venus
  • venus-auth
  • venus-gateway
  • venus-messager
  • venus-miner
  • 文档 / docs

订单服务模块 / Deal Service Components

  • venus-market
  • 文档 / docs

算力服务模块 / Storage Power Service Components

  • venus-sector-manager
  • venus-worker
  • 文档 / docs

描述 / Description

对ChangeOwnerAddress、ChangeWorkerAddress和Send这种敏感消息加以限制，需要由链服务维护者二次确认后，再往链上发送
@cloudxin cloudxin added the C-enhancement Category: feature enhancement label Sep 1, 2022
@hunjixin
Copy link
Contributor

hunjixin commented Sep 1, 2022

什么使用场景

@Fatman13 Fatman13 added C-triage Category: Need triage CU-force-community Category: from force community labels Sep 2, 2022
@Fatman13
Copy link
Contributor

Fatman13 commented Sep 2, 2022

这个感觉上好像不是最符合协议？

@cloudxin
Copy link
Author

cloudxin commented Sep 2, 2022

从安全层面考虑，ChangeOwnerAddress消息上链后会立即生效；如果任何消息都不加以限制，会有很大安全隐患，用户服务器被非法入侵或者接入token被无意泄漏，会导致恶意发送ChangeOwnerAddress消息，即使无法从venus-wallet中获取私钥；也可以通过这个功能修改owner地址

@Fatman13
Copy link
Contributor

Fatman13 commented Sep 2, 2022

owner不要同意就可以换吗？我记得是不是owner得同意一下？

@hunjixin
Copy link
Contributor

hunjixin commented Sep 2, 2022

更好的做法是不把owner地址关联到云服务， 通过离线工具例如lotus-shed这种工具进行类型的敏感工具。

@Fatman13
Copy link
Contributor

Fatman13 commented Sep 2, 2022

并推荐用户把owner自己保存，和worker地址分离？

@hunjixin
Copy link
Contributor

敏感信息自行控制

@hunjixin
Copy link
Contributor

#5304

@hunjixin hunjixin moved this to Done in Venus Project Sep 17, 2022
# for free to join this conversation on GitHub. Already have an account? # to comment
Assignees

@hunjixin hunjixin

Labels
C-enhancement Category: feature enhancement C-triage Category: Need triage CU-force-community Category: from force community
Projects
Venus Project
Archived in project
Milestone
No milestone
Development

No branches or pull requests
3 participants
@Fatman13 @hunjixin @cloudxin