create account

HiveSigner is INSECURE? - discussion and deep dive by ecoinstant

View this thread on: hive.blog |  peakd.com |  ecency.com
hive-139531 · @ecoinstant ·
$14.34
HiveSigner is INSECURE? - discussion and deep dive
There was some discussion about HiveSigner, and someone said it was "secure".  I think its QUITE INSECURE, and I said as much.  I got some pushback, which motivated me to make this post - by the way, this is how discussions happen.  We can all (probably) agree that discussions are good, so we shouldn't feel bad about disagreeing.  

The basic argument is, people who are not quite sure how it works, think its secure, and are sure that anyone saying its not, is spreading disinformation.  Like this comment from @tibfox this morning:


![image.png](https://files.peakd.com/file/peakd-hive/ecoinstant/Eo44qAMA2AvNbbQS7Zex63s7QC5jY26jfzFXmDifG66HvUkwSTjCRT7zYv8BYVDrr8Q.png)


Notice the use of "as far as I know".  I am spreading disinformation, because "as far as someone knows", HiveSigner is fine, it must be fine, we are pretty sure its fine, because its still around, and if it wasn't fine, someone would say something.

Except whenever someone says something, we are just assured that "as far as I know", its secure and safe and wonderful.  

## Trust me bro

The words "secure", "safe", "valid" - they are adjectives.  Technically, they don't mean much, and it might be the case that one part of an app is totally "safe", and another part completely "dangerous".  We should probably define our terms, talk about the reality, go through the app - and talk about it.  That is what I plan to do today.  To go through all the UNSAFE, INSECURE and INVALID parts of HiveSigner that I clearly see - on my screen, right in front of my face, every time I have the displeasure of finding myself interacting with HiveSigner.  These things could be fixed, and that would make HiveSigner MORE secure, more safe, and more valid.

So come along with me to "hive.vote", and once we get there - hit "login" and we are taken to this page.


![image.png](https://files.peakd.com/file/peakd-hive/ecoinstant/23wN1su9vaGyJTyA9P7QPy2g5ZMq9Ztmkh2TMsAZ1DNYjcWuA4rD4315vY6pKjJNSpdkW.png)
  
For security, I have created a new account using our new [account creation tool](https://rc.thecrazygm.com/claim-account), which one of these days I will get around to announcing - I like it because I get to pick my master password, which is fun.  


![image.png](https://files.peakd.com/file/peakd-hive/ecoinstant/23uRJEXHnVzy6VcKJJnXpudn6ndjACeCmKQHZb5PYiJVvUySgac7xihhoQHVNpU8ioKa5.png)


Now let's go ahead and use our memo key, some might say this is the least worrisome, or "most secure" key, and it is clearly *recommended* by HiveSigner - and see what happens.


![image.png](https://files.peakd.com/file/peakd-hive/ecoinstant/EpGX3BoPaBKT3YYw194RXBATu2bt2kdiscT4jacKQMMWHyUzdjpi7Qxm3V5waHMK1T2.png)

It doesn't like the memo key - now it tells me I should use the *master password* or AT LEAST the posting key, whatever that means.  Very safe and secure, the instructions have changed half way through.  Okay, well, let's try that posting key then.  According to the page we are using, HiveSigner just wants to "see our current account username".  Super safe and secure experience for users.


![image.png](https://files.peakd.com/file/peakd-hive/ecoinstant/Eo6SGJLztMetPzzduGqF41XPTLhNSdSEyo9s8xjMyP2XtXeNpPj3EPNZcXQQ9Pb7aww.png)


So we go back to our txt file and copy the private posting key, put it in and we do get to log in to hive.vote.  I tested the owner key, it actually does work to log in, as well as the master password.  They work to log in with!  Just the memo key is a lie, on this page.

So now we are into hive.vote - the only autovoter left in our ecosystem, and we have this wonderful message:


![image.png](https://files.peakd.com/file/peakd-hive/ecoinstant/23u6ZA178ocpTRy5H76TvoBKByqHRhvog4HRCCKDt8EHZmk5cAwmThY3XaUtb33ao8upg.png)

Very cryptic stuff, but this article is not about how hive.vote is garbage, but we must once again use hivesigner to add "posting authority".  Now you can do that here https://thecrazygm.com/hivetools/account/authority, if you have Keychain browser extension or Keychain Mobile App, but assuming we don't have that, let's try to use HiveSigner again.

The trick is here, that changing authorities, even posting authorities, is an active key transaction.  Let's see what HiveSigner says:


![image.png](https://files.peakd.com/file/peakd-hive/ecoinstant/23viTFEswxqPXiukup7Kd4kWY5ZntajPtsx9Y8PcjgQNiLrsncvafpRhumVRCcT4Djn8W.png)

This was actually a pleasant surprise to me, I believe this has been updated since the last time I raged against this app, but it correctly informs us that we will be required to put in our active key (since we have only logged in with posting key).

While playing around, I also confirmed that if you log in with owner key or master password (probably active key too), it will just let you click authorize.  We can assume that these things are "just" stored in our browser cache, since I was able to delete them (which by the way is NOT a secure place to put keys unencrypted, anyone remember the recent Leo fiasco with browser stored keys?), but its also not really a great idea to assume things about key management either.  

So now I hit continue and get....


![image.png](https://files.peakd.com/file/peakd-hive/ecoinstant/EpVHLZTc6eZPAAJwZuZjQTpRdjxBZFiuthSLExyYoyNVS9GLMGLnrX3ctudAEqNVZ6Z.png)

Hmmmm, this is not quite expected, a little unclear, but I guess we need to "Add another account"?


![image.png](https://files.peakd.com/file/peakd-hive/ecoinstant/23wXR5Z9XyTK7Jx9gEuLDG8JZvnTwE1NAo8aaVW2LyJHPzLr94C399wk3FPyd2MKAvw9x.png)


## Welcome back!

And we are back to our good old friend, the "add any key to get scolded" page.  Sure, we were told that we would need "at least" the active key (by the way, I don't think four different keys are necessarily in an order, or if there is an order, its somewhat subjective), but once again we are being recommended options including MEMO KEY (which never works for anything) and Posting Key - which we already know is "not enough", and won't work.  

So for fun I added my Owner Key, and we are taken back to the option to authorize the app.


![image.png](https://files.peakd.com/file/peakd-hive/ecoinstant/23u6YysaGftHioR9sd5oSPfY75vSLKvsoyasbZESYw5owqze6NXXTbx1WqEtUJtwm6DXn.png)

Once we click authorize, we are quickly flashed a screen that explains we have given posting auth to 'steemauto', and redirected back to Hive.Vote.

I was a little surprised that I could sign authority operations with owner key, but I guess it is possible, so I am learning something today.  After all, its THE FIRST recommendation of HiveSigner (but at least it works, unlike many of its other front page instructions).

## What's in the browser?


![image.png](https://files.peakd.com/file/peakd-hive/ecoinstant/246b57yUVUWXpm4HrQRkQpwzVNJ8vaeN7rLjGMV5uvzDxKoxCJDZBNFMguCPM9Pvfhrcg.png)

So by navigating around in my Opera GX browser, and learning a few things along the way, I was able to find my private Owner key in the Local Browser storage.  I am actually not sure how secure this is, so I just asked google, here is what google says:


![image.png](https://files.peakd.com/file/peakd-hive/ecoinstant/Eo45GghScEasnbh2ee5K2pYz9oFfSHvpQCmDX7iJKsYSxXuLH1BT6tsvGJVDEHohdpT.png)

## Tell me I am a crazy disinformation spreader, but suddenly I don't feel like "trust me bro" "as far as I recall its secure" is a good enough answer; I don't feel safe or secure - in fact, people also ask:


![image.png](https://files.peakd.com/file/peakd-hive/ecoinstant/23tRxJCr5hwAKnKhiN8dLSboLd5Ygfzei6WqxV9U9fQy6MvAiTMtwjf2xSWs6nJ6h2YFi.png)

## @good-karma?

I want to be clear, I like (and "trust") @good-karma, who (as far as I know), is in charge of making sure HiveSigner keeps working, as a legacy piece of software.  And he has done that.  I don't think he is phishing keys or in any way would host or build something that would actually BE an attack vector.  But that doesn't mean that this piece of software he inherited is GOOD, or safe, or secure or valid.  

HiveSigner - in my humble opinion - is not only confusing and uncomfortable, based on my deep dive today - seems literally INSECURE, and UNSAFE.  Please stop insisting that it is safe and secure because someone told you it was.  

And since I did reveal them here, I guess I will go ahead and change my keys now, using our amazing, and actually safe and secure, [best key changer for HIVE](https://keys.thecrazygm.com). 


![image.png](https://files.peakd.com/file/peakd-hive/ecoinstant/23tSt3NZiwDmqNMDW1mjJscVgnVWP8BktKVa5v2HcXAUz3RuYNmkASMZoJxrMZETHgCFK.png)


Go ahead and let me know what you think, in the comments below.



## Freedom and Friendship
👍  , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , and 379 others
👎  
properties (23)
authorecoinstant
permlinkhivesigner-is-insecure-discussion-and-deep-dive
categoryhive-139531
json_metadata{"app":"peakd/2025.6.2","format":"markdown","tags":["hive","dev","development","hivesigner","archon","tribes","leofinance","neoxian","pimp","proofofbrain"],"users":["tibfox","good-karma"],"image":["https://files.peakd.com/file/peakd-hive/ecoinstant/23wN1su9vaGyJTyA9P7QPy2g5ZMq9Ztmkh2TMsAZ1DNYjcWuA4rD4315vY6pKjJNSpdkW.png","https://files.peakd.com/file/peakd-hive/ecoinstant/Eo44qAMA2AvNbbQS7Zex63s7QC5jY26jfzFXmDifG66HvUkwSTjCRT7zYv8BYVDrr8Q.png","https://files.peakd.com/file/peakd-hive/ecoinstant/23uRJEXHnVzy6VcKJJnXpudn6ndjACeCmKQHZb5PYiJVvUySgac7xihhoQHVNpU8ioKa5.png","https://files.peakd.com/file/peakd-hive/ecoinstant/EpGX3BoPaBKT3YYw194RXBATu2bt2kdiscT4jacKQMMWHyUzdjpi7Qxm3V5waHMK1T2.png","https://files.peakd.com/file/peakd-hive/ecoinstant/Eo6SGJLztMetPzzduGqF41XPTLhNSdSEyo9s8xjMyP2XtXeNpPj3EPNZcXQQ9Pb7aww.png","https://files.peakd.com/file/peakd-hive/ecoinstant/23u6ZA178ocpTRy5H76TvoBKByqHRhvog4HRCCKDt8EHZmk5cAwmThY3XaUtb33ao8upg.png","https://files.peakd.com/file/peakd-hive/ecoinstant/23viTFEswxqPXiukup7Kd4kWY5ZntajPtsx9Y8PcjgQNiLrsncvafpRhumVRCcT4Djn8W.png","https://files.peakd.com/file/peakd-hive/ecoinstant/EpVHLZTc6eZPAAJwZuZjQTpRdjxBZFiuthSLExyYoyNVS9GLMGLnrX3ctudAEqNVZ6Z.png","https://files.peakd.com/file/peakd-hive/ecoinstant/23wXR5Z9XyTK7Jx9gEuLDG8JZvnTwE1NAo8aaVW2LyJHPzLr94C399wk3FPyd2MKAvw9x.png","https://files.peakd.com/file/peakd-hive/ecoinstant/23u6YysaGftHioR9sd5oSPfY75vSLKvsoyasbZESYw5owqze6NXXTbx1WqEtUJtwm6DXn.png","https://files.peakd.com/file/peakd-hive/ecoinstant/246b57yUVUWXpm4HrQRkQpwzVNJ8vaeN7rLjGMV5uvzDxKoxCJDZBNFMguCPM9Pvfhrcg.png","https://files.peakd.com/file/peakd-hive/ecoinstant/Eo45GghScEasnbh2ee5K2pYz9oFfSHvpQCmDX7iJKsYSxXuLH1BT6tsvGJVDEHohdpT.png","https://files.peakd.com/file/peakd-hive/ecoinstant/23tRxJCr5hwAKnKhiN8dLSboLd5Ygfzei6WqxV9U9fQy6MvAiTMtwjf2xSWs6nJ6h2YFi.png","https://files.peakd.com/file/peakd-hive/ecoinstant/23tSt3NZiwDmqNMDW1mjJscVgnVWP8BktKVa5v2HcXAUz3RuYNmkASMZoJxrMZETHgCFK.png"]}
created2025-06-25 21:55:18
last_update2025-06-25 21:55:18
depth0
children41
last_payout2025-07-02 21:55:18
cashout_time1969-12-31 23:59:59
total_payout_value7.190 HBD
curator_payout_value7.146 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length8,635
author_reputation868,883,123,304,099
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id143,568,391
net_rshares49,820,888,790,917
author_curate_reward""
vote details (444)
@anderssinho ·
$0.22
Isnt this the same issue LeoAuth got a ton a crap about a while ago?
👍  , , , , , , , , , , ,
properties (23)
authoranderssinho
permlinkre-ecoinstant-syh05g
categoryhive-139531
json_metadata{"tags":["hive-139531"],"app":"peakd/2025.6.2","image":[],"users":[]}
created2025-06-26 15:53:42
last_update2025-06-26 15:53:42
depth1
children4
last_payout2025-07-03 15:53:42
cashout_time1969-12-31 23:59:59
total_payout_value0.112 HBD
curator_payout_value0.111 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length71
author_reputation87,305,631,121,776
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id143,585,644
net_rshares781,420,328,907
author_curate_reward""
vote details (12)
@ecoinstant ·
$0.76
I am pretty sure if its not EXACTLY THE SAME, then its like, 99% the same issue 😅
👍  ,
properties (23)
authorecoinstant
permlinkre-anderssinho-syh1q0
categoryhive-139531
json_metadata{"tags":["hive-139531"],"app":"peakd/2025.6.2","image":[],"users":[]}
created2025-06-26 16:27:39
last_update2025-06-26 16:27:39
depth2
children1
last_payout2025-07-03 16:27:39
cashout_time1969-12-31 23:59:59
total_payout_value0.380 HBD
curator_payout_value0.381 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length81
author_reputation868,883,123,304,099
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id143,586,607
net_rshares2,637,953,813,208
author_curate_reward""
vote details (2)
@anderssinho ·
$0.12
@anderssinho "Man khal and team got sooo much crap over that 😅 ..."
Man khal and team got sooo much crap over that 😅
Good that you acknowledge it though because its like you say not that secure 😅
👍  , , , , , , , ,
properties (23)
authoranderssinho
permlinkre-ecoinstant-z4tgm1jr
categoryhive-139531
json_metadata{"app":"leothreads/0.3","format":"markdown","tags":["leofinance"],"canonical_url":"https://inleo.io/threads/view/anderssinho/re-ecoinstant-z4tgm1jr","isPoll":false,"pollOptions":{},"dimensions":[]}
created2025-06-26 16:29:15
last_update2025-06-26 16:29:15
depth3
children0
last_payout2025-07-03 16:29:15
cashout_time1969-12-31 23:59:59
total_payout_value0.062 HBD
curator_payout_value0.061 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length128
author_reputation87,305,631,121,776
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id143,586,648
net_rshares429,504,723,541
author_curate_reward""
vote details (9)
@tibfox · 
Nope they have stored the keys in a cookie. Now they store them in the local storage but other than hivesigner they are encrypted with a pincode. On top of the cookie thing they have sent the private key over the internet at the beginning - thats when the whole thing blew off
properties (22)
authortibfox
permlinkre-anderssinho-2025628t01332347z
categoryhive-139531
json_metadata{"links":[],"type":"comment","tags":["hive-139531"],"app":"ecency/3.3.3-mobile","format":"markdown+html"}
created2025-06-27 22:13:33
last_update2025-06-27 22:13:33
depth2
children1
last_payout2025-07-04 22:13:33
cashout_time1969-12-31 23:59:59
total_payout_value0.000 HBD
curator_payout_value0.000 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length276
author_reputation194,035,142,248,693
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id143,614,279
net_rshares0
@anderssinho · 
Alright, noted! :)
properties (22)
authoranderssinho
permlinkre-tibfox-synmun
categoryhive-139531
json_metadata{"tags":["hive-139531"],"app":"peakd/2025.6.4"}
created2025-06-30 05:49:33
last_update2025-06-30 05:49:33
depth3
children0
last_payout2025-07-07 05:49:33
cashout_time1969-12-31 23:59:59
total_payout_value0.000 HBD
curator_payout_value0.000 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length18
author_reputation87,305,631,121,776
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id143,660,796
net_rshares0
@ecency · (edited)
$0.32
For some reason, we have missed this post and didn't notice mention. Apologies, any application (web, extension, mobile app) that helps you to sign transaction stores or uses your keys for intended purpose. Security of Hivesigner depends on security of your own device of course, hivesigner doesn't send your keys anywhere in anyway, only keep them in your local browser. Just like Keychain, just like another other direct ways of login. That's why there are different levels of keys so you only use it in trusted and opensource apps to specific operations you need to sign. Working of Hivesigner is slightly different in that you can give posting authority to application once and don't need to use Active, Owner, Master password keys ever again even on Hivesigner itself and you can take away posting authority anytime from any app. In your example, hive.vote it is utilizing posting authority, so you are required to give that authority with your active key, if you know that you just use your active key and can remove your account from Hivesigner that's it. All other keys are used for specific use cases within Hivesigner, memo key or other key login suggests because if you are unsure what key you need, you can try any key until you find one that works. Yes this can be improved but here you are not talking about improvement suggestions.

Hivesigner is opensource and maintained by our team so if you don't trust Ecency team, always do check source code to know what it does with your keys: https://github.com/ecency/hivesigner-ui.

When we have inherited the Hivesigner codebase, we have done extensive review and complete rewrite of most logic, so it is reviewed at least by previous creators and our team.

Deep dive like this should be done on all apps so people know what's doing what. Only be objective about what you find and/or ask team if you have concerns/questions, tell team if you find bugs after all that, release findings along with suggestions.
👍  , , , , , , ,
properties (23)
authorecency
permlinkre-ecoinstant-202579t14148475z
categoryhive-139531
json_metadata{"tags":["hive","dev","development","hivesigner","archon","tribes","leofinance","neoxian","pimp","proofofbrain"],"app":"ecency/4.2.0-vision","format":"markdown+html"}
created2025-07-09 11:14:09
last_update2025-07-09 11:57:00
depth1
children0
last_payout2025-07-16 11:14:09
cashout_time1969-12-31 23:59:59
total_payout_value0.159 HBD
curator_payout_value0.159 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length1,969
author_reputation628,550,208,526,238
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id143,888,765
net_rshares953,177,209,736
author_curate_reward""
vote details (8)
@fjworld ·
$0.12
Ah Thank You for confirming my suspicion. !LOLZ

I looked at HiveSigner when I started on Hive and when I compared it to how KeyChain does security I stuck to KeyChain.

Much appreciated review.

!PIMP
👍  , , , , , , ,
properties (23)
authorfjworld
permlinkre-ecoinstant-sygog7
categoryhive-139531
json_metadata{"tags":["hive-139531"],"app":"peakd/2025.6.2","image":[],"users":[]}
created2025-06-26 11:40:54
last_update2025-06-26 11:40:54
depth1
children1
last_payout2025-07-03 11:40:54
cashout_time1969-12-31 23:59:59
total_payout_value0.058 HBD
curator_payout_value0.058 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length201
author_reputation13,636,635,329,449
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id143,578,494
net_rshares411,193,654,542
author_curate_reward""
vote details (8)
@lolzbot · 
<div class='pull-right'><center><img src="https://lolztoken.com/lolz.png"><br><a href="https://lolztoken.com">lolztoken.com</a></p><br><br><br><br></center></div><p><center><strong>Why does Humpty Dumpty love autumn?<br>Because he always has a great fall!</strong><br><sub>Credit: <a href="https://peakd.com/@reddit">reddit</a></sub><br>@ecoinstant, I sent you an <a href="https://lolztoken.com">$LOLZ</a> on behalf of fjworld<br><br>(3/10)<br>Farm <strong><a href='https://lolztoken.com'>LOLZ tokens</a></strong> when you <strong><a href='https://peakd.com/hive-155986/@lolztoken/earn-10percent-apr-on-hive-power-delegations-to-the-lolz-project'>Delegate Hive</a> or <a href='https://peakd.com/hive-155986/@lolztoken/introducing-lolz-defi-now-you'>Hive Tokens</a>.</strong><br>Click to delegate: <a href='https://hivesigner.com/sign/delegateVestingShares?delegator=&delegatee=lolzbot&vesting_shares=10%20HP'>10</a> - <a href='https://hivesigner.com/sign/delegateVestingShares?delegator=&delegatee=lolzbot&vesting_shares=20%20HP'>20</a> - <a href='https://hivesigner.com/sign/delegateVestingShares?delegator=&delegatee=lolzbot&vesting_shares=50%20HP'>50</a> - <a href='https://hivesigner.com/sign/delegateVestingShares?delegator=&delegatee=lolzbot&vesting_shares=100%20HP'>100</a> HP</center></p>
properties (22)
authorlolzbot
permlinkre-re-ecoinstant-sygog7-20250626t114506z
categoryhive-139531
json_metadata"{"app": "beem/0.24.19"}"
created2025-06-26 11:45:15
last_update2025-06-26 11:45:15
depth2
children0
last_payout2025-07-03 11:45:15
cashout_time1969-12-31 23:59:59
total_payout_value0.000 HBD
curator_payout_value0.000 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length1,296
author_reputation196,069,782,190,056
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id143,578,601
net_rshares0
@hivebuzz · 
Congratulations @ecoinstant! You have completed the following achievement on the Hive blockchain And have been rewarded with New badge(s)

<table><tr><td><img src="https://images.hive.blog/60x70/https://hivebuzz.me/@ecoinstant/payout.png?202506260719"></td><td>You received more than 35000 HP as payout for your posts, comments and curation.<br>Your next payout target is 36000 HP.<br><sub>The unit is Hive Power equivalent because post and comment rewards can be split into HP and HBD</sub></td></tr>
</table>

<sub>_You can view your badges on [your board](https://hivebuzz.me/@ecoinstant) and compare yourself to others in the [Ranking](https://hivebuzz.me/ranking)_</sub>
<sub>_If you no longer want to receive notifications, reply to this comment with the word_ `STOP`</sub>
properties (22)
authorhivebuzz
permlinknotify-1750922856
categoryhive-139531
json_metadata{"image":["https://hivebuzz.me/notify.t6.png"]}
created2025-06-26 07:27:36
last_update2025-06-26 07:27:36
depth1
children0
last_payout2025-07-03 07:27:36
cashout_time1969-12-31 23:59:59
total_payout_value0.000 HBD
curator_payout_value0.000 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length781
author_reputation370,686,196,484,985
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id143,574,561
net_rshares0
@holoz0r ·
$0.12
Here's a hot take: People who use autovoters deserve to have their keys compromised :P
👍  , , , , ,
properties (23)
authorholoz0r
permlinkre-ecoinstant-sygch1
categoryhive-139531
json_metadata{"tags":["hive-139531"],"app":"peakd/2025.6.2","image":[],"users":[]}
created2025-06-26 07:22:15
last_update2025-06-26 07:22:15
depth1
children0
last_payout2025-07-03 07:22:15
cashout_time1969-12-31 23:59:59
total_payout_value0.058 HBD
curator_payout_value0.058 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length86
author_reputation546,790,859,012,393
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id143,574,501
net_rshares411,427,531,297
author_curate_reward""
vote details (6)
@mengao ·
$0.12
Storing private keys in local storage definitely not secure.
👍  , , , , , , , , , ,
properties (23)
authormengao
permlinkre-ecoinstant-syfn0a
categoryhive-139531
json_metadata{"tags":["hive-139531"],"app":"peakd/2025.6.2","image":[],"users":[]}
created2025-06-25 22:12:12
last_update2025-06-25 22:12:12
depth1
children4
last_payout2025-07-02 22:12:12
cashout_time1969-12-31 23:59:59
total_payout_value0.060 HBD
curator_payout_value0.060 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length60
author_reputation114,986,366,551,361
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id143,568,643
net_rshares427,628,746,898
author_curate_reward""
vote details (11)
@ecoinstant · 
In my opinion, the fact that the app encourages Owner key or Master password just makes this worse.
properties (22)
authorecoinstant
permlinkre-mengao-syfnba
categoryhive-139531
json_metadata{"tags":["hive-139531"],"app":"peakd/2025.6.2","image":[],"users":[]}
created2025-06-25 22:18:48
last_update2025-06-25 22:18:48
depth2
children3
last_payout2025-07-02 22:18:48
cashout_time1969-12-31 23:59:59
total_payout_value0.000 HBD
curator_payout_value0.000 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length99
author_reputation868,883,123,304,099
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id143,568,752
net_rshares0
@mengao ·
$0.12
terrible! hive.vote is probably one the most used services on Hive and doesn't have keychain integration.

great job testing it! I never use hive signer, even though I never did this research, I never trusted it. and it's one of the oldest sign in options still accepted by all frontends?
👍  , , , , , , ,
properties (23)
authormengao
permlinkre-ecoinstant-syfnsm
categoryhive-139531
json_metadata{"tags":["hive-139531"],"app":"peakd/2025.6.2"}
created2025-06-25 22:29:12
last_update2025-06-25 22:29:12
depth3
children1
last_payout2025-07-02 22:29:12
cashout_time1969-12-31 23:59:59
total_payout_value0.060 HBD
curator_payout_value0.059 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length288
author_reputation114,986,366,551,361
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id143,568,920
net_rshares425,980,940,486
author_curate_reward""
vote details (8)
@pompeylad ·
$0.13
Hive.vote is as much the problem here by not updating to using Keychain. I've always been dubious of hivesigner but that is shocking, time to sunset it we have a better, easier, safer way now.
👍  , , , , , , , , ,
properties (23)
authorpompeylad
permlinkre-ecoinstant-syifw7
categoryhive-139531
json_metadata{"tags":["hive-139531"],"app":"peakd/2025.6.2"}
created2025-06-27 10:31:24
last_update2025-06-27 10:31:24
depth3
children0
last_payout2025-07-04 10:31:24
cashout_time1969-12-31 23:59:59
total_payout_value0.067 HBD
curator_payout_value0.066 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length192
author_reputation630,592,356,987
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id143,604,365
net_rshares447,723,909,030
author_curate_reward""
vote details (10)
@osomar357 ·
$0.12
Hola feliz tarde, antes que nada esta muy bueno  el post, y creo que en su contenido, demostraste las razones por las cuales dices que es inseguro.
Yo realmente no lo uso mucho, ya que se me hace confuso y con poca información para los usuarios, solo lo use en Hive-vote y creo que un par de veces para apoyar unas propuestas.
Pero, en realidad, demuestras que tienes razón en el planteamiento que realizas con respecto a la seguridad de la aplicación.
También quiero aprovechar, para darte gracias por las dos herramientas que recomiendas, la del cambio de claves y la de  creación de cuentas.
Me parece un post, bien informativo, que educa al usuario y le explica de manera simple, algunos datos que no se conocen en el área de seguridad de las aplicaciones.
Lo mismo queda claro, para el resguardo de las claves, ya que hay muchas personas que las usan en el navegador y eso suele ser muy peligroso a la hora de un hackeo.
Me parece muy buena y educativa la información, muchas gracias.

------

Hello happy afternoon, first of all the post is very good, and I think that in its content, you showed the reasons why you say that it is unsafe.
I really don't use it much, since it gets confusing and with little information for users, I only used it in Hive-vote and I think a couple of times to support some proposals.
But, in reality, you prove that you are right in the approach you make regarding the security of the application.
I also want to take this opportunity to thank you for the two tools that you recommend, the password change tool and the account creation tool.
It seems to me a post, very informative, that educates the user and explains in a simple way, some data that are not known in the area of application security.
The same is clear, for the protection of the keys, since there are many people who use them in the browser and that is usually very dangerous at the time of a hack.
I find the information very good and educational, thank you very much.

<center>


---

![](https://images.ecency.com/DQmWfDbrdi4kwywjTpaniBy82aPFLoNbwvW9cRdz3F7EVEe/curacion_nueva.gif)

<div class="phishy"><b><i><h3>

Este post fue votado desde Ecency.


</h3></i></b></div>

!HUESO
!ALIVE


</center>
👍  , , , , , , ,
properties (23)
authorosomar357
permlinkre-ecoinstant-2025625t182039481z
categoryhive-139531
json_metadata{"tags":["hive","dev","development","hivesigner","archon","tribes","leofinance","neoxian","pimp","proofofbrain"],"app":"ecency/4.2.0-vision","format":"markdown+html"}
created2025-06-25 22:20:39
last_update2025-06-25 22:20:39
depth1
children1
last_payout2025-07-02 22:20:39
cashout_time1969-12-31 23:59:59
total_payout_value0.060 HBD
curator_payout_value0.060 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length2,208
author_reputation172,783,694,009,870
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id143,568,778
net_rshares425,305,310,114
author_curate_reward""
vote details (8)
@bot-bdbhueso · 
<center>[![](https://media.discordapp.net/attachments/1024769431500509294/1342589583346503690/1_COMANDO_HUESO_ING.gif?ex=67ba2f7c&is=67b8ddfc&hm=802e08ed8ea13a5048dd02fc5e242e9f04fb7cf4294c6f99db57f3a7f520d91a&=&width=1000&height=188)](https://discord.gg/WdSDtH8GZg)</center>

<center>Uses: 6/18
!LUV</center>
properties (22)
authorbot-bdbhueso
permlinkre-osomar357-re-ecoinstant-2025625t182039481z-20250625t222047434z
categoryhive-139531
json_metadata{"app":"hive-bot/0.6.3"}
created2025-06-25 22:20:48
last_update2025-06-25 22:20:48
depth2
children0
last_payout2025-07-02 22:20:48
cashout_time1969-12-31 23:59:59
total_payout_value0.000 HBD
curator_payout_value0.000 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length309
author_reputation498,145,470,434
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id143,568,783
net_rshares0
@pardinus ·
$0.12
Thanks for the deep dive! I'm not technical savvy security wise, but I never felt that confortable on putting my keys in hivesigner. I would love to have a similar app to hive.vote with decent UX and buffed security... let's see if it comes true one  day!
👍  , , , , , , ,
properties (23)
authorpardinus
permlinkre-ecoinstant-2025626t1648710z
categoryhive-139531
json_metadata{"links":[],"type":"comment","tags":["hive-139531","hive","dev","development","hivesigner","archon","tribes","leofinance","neoxian","pimp","proofofbrain"],"app":"ecency/3.3.3-mobile","format":"markdown+html"}
created2025-06-26 00:06:48
last_update2025-06-26 00:06:48
depth1
children0
last_payout2025-07-03 00:06:48
cashout_time1969-12-31 23:59:59
total_payout_value0.058 HBD
curator_payout_value0.057 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length255
author_reputation383,534,221,669,637
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id143,570,260
net_rshares405,949,822,089
author_curate_reward""
vote details (8)
@shmoogleosukami ·
$0.11
I remember hearing talk about making it that at the blockchain level hive nodes will reject transactions that use of keys far above the permissions required. like using owner to sign active key transactions, I'm not sure if it's already in effect though.

One reason HiveSigner asks for the master password is it is a quick way to import all keys since all keys are derived from said password but still I wouldnt even do that. I'd rather take the time to import each one.

Now here's a question.. How does one clear your keys from your local storage if you previously used hivesigner?

Since I hardly use it I'd prefur to not have my keys sitting there potentially insecure.

---

<sup>[I'm a Hive Witness supporting the blockchain, please consider voting for me.](https://vote.hive.uno/@shmoogleosukami) - [find out more here!](https://ureka.social/@shmoogleosukami/shmoogle-osukamis-witness-info-for-prospective-voters)</sup>
👍  , , , ,
properties (23)
authorshmoogleosukami
permlinkre-ecoinstant-sygm5d
categoryhive-139531
json_metadata{"tags":["hive-139531"],"app":"peakd/2025.6.2","image":[],"users":[]}
created2025-06-26 10:51:15
last_update2025-06-26 10:51:15
depth1
children3
last_payout2025-07-03 10:51:15
cashout_time1969-12-31 23:59:59
total_payout_value0.054 HBD
curator_payout_value0.055 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length927
author_reputation227,684,395,918,816
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id143,577,348
net_rshares384,217,476,629
author_curate_reward""
vote details (5)
@ecoinstant ·
$0.53
So I can go to manage site data in this browser, and it allows me to delete it.  

The one thing I didn't test is, if I "save and encrypt", can I still clear it from my local cache?  If not, where does it "go"?  


![image.png](https://files.peakd.com/file/peakd-hive/ecoinstant/23wBeChUGnvn62MVSRhe2cGgy9VsRzL5vwpCiPgH6br9VQ3DAVSpajtNNMpkEncJgZyYk.png)
👍  
properties (23)
authorecoinstant
permlinkre-shmoogleosukami-sygscd
categoryhive-139531
json_metadata{"tags":["hive-139531"],"app":"peakd/2025.6.2","image":["https://files.peakd.com/file/peakd-hive/ecoinstant/23wBeChUGnvn62MVSRhe2cGgy9VsRzL5vwpCiPgH6br9VQ3DAVSpajtNNMpkEncJgZyYk.png"],"users":[]}
created2025-06-26 13:05:15
last_update2025-06-26 13:05:15
depth2
children2
last_payout2025-07-03 13:05:15
cashout_time1969-12-31 23:59:59
total_payout_value0.266 HBD
curator_payout_value0.266 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length354
author_reputation868,883,123,304,099
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id143,580,835
net_rshares1,841,120,826,827
author_curate_reward""
vote details (1)
@shmoogleosukami ·
$0.63
I've noticed something, when not logged into hivesigner, the keys are not in local storage, I assume they are elsewhere encrypted with the password you set up on hivesigner. It's only if you are logged in to hivesigner are they exposed.

So as long as you haven't logged in on a compromised device or browser you 'should' be fine. But this does beg the question I think all extensions can access local storage data if enabled so there is also potential for malicious action there too.

I generally have my browser extensions restricted to certain sites so I'm fine there.

There also is no way to actually sign out of hive-signer except by probably closing the complete browser.

Donno if the local storage is ever accessible besides the site being open in a tab.

You can actually remove accounts from hivesigner via hivesigner which is the best way to go about it I think.

---

<sup>[I'm a Hive Witness supporting the blockchain, please consider voting for me.](https://vote.hive.uno/@shmoogleosukami) - [find out more here!](https://ureka.social/@shmoogleosukami/shmoogle-osukamis-witness-info-for-prospective-voters)</sup>
👍  , , , , , , ,
properties (23)
authorshmoogleosukami
permlinkre-ecoinstant-sygudk
categoryhive-139531
json_metadata{"tags":["hive-139531"],"app":"peakd/2025.6.2","image":[],"users":[]}
created2025-06-26 13:48:57
last_update2025-06-26 13:48:57
depth3
children1
last_payout2025-07-03 13:48:57
cashout_time1969-12-31 23:59:59
total_payout_value0.316 HBD
curator_payout_value0.315 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length1,127
author_reputation227,684,395,918,816
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id143,582,098
net_rshares2,178,230,843,740
author_curate_reward""
vote details (8)
@sopel ·
$0.11
Anything in web browser or on mobile phone is not secure for large financial transactions, fortunately in hive we have several keys: active (required for financial transactions) and posting (for blogging like here). Bank mobile apps have limited functionality compared to web browser interface, in web browser it is still required to perform 2FA.
👍  , , , ,
properties (23)
authorsopel
permlinksygn6i
categoryhive-139531
json_metadata{"app":"hiveblog/0.1"}
created2025-06-26 11:13:30
last_update2025-06-26 11:13:30
depth1
children1
last_payout2025-07-03 11:13:30
cashout_time1969-12-31 23:59:59
total_payout_value0.054 HBD
curator_payout_value0.054 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length346
author_reputation24,082,760,817
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id143,577,887
net_rshares381,149,981,905
author_curate_reward""
vote details (5)
@thedd · 
My bank app can do more than their webbank. And in the webbank I have to use the app as 2fa.
properties (22)
authorthedd
permlinkre-sopel-szv898
categoryhive-139531
json_metadata{"tags":["hive-139531"],"app":"peakd/2025.7.3"}
created2025-07-23 18:48:51
last_update2025-07-23 18:48:51
depth2
children0
last_payout2025-07-30 18:48:51
cashout_time1969-12-31 23:59:59
total_payout_value0.000 HBD
curator_payout_value0.000 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length92
author_reputation610,855,738,228
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id144,338,873
net_rshares0
@steevc ·
$0.12
Any site that asks for a 'master key' seems dodgy to me. They shouldn't need that level of access.

Key security is not an easy problem to solve and so we have to trust the developers for such tools. I would hope that anyone with real concerns can feel free to speak out, but obviously should go to the devs first if there is an immediate risk.
👍  , , , , , ,
properties (23)
authorsteevc
permlinkre-ecoinstant-syhbd2
categoryhive-139531
json_metadata{"tags":["hive-139531"],"app":"peakd/2025.6.2","image":[],"users":[]}
created2025-06-26 19:55:54
last_update2025-06-26 19:55:54
depth1
children1
last_payout2025-07-03 19:55:54
cashout_time1969-12-31 23:59:59
total_payout_value0.062 HBD
curator_payout_value0.061 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length344
author_reputation1,394,291,349,669,101
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id143,591,679
net_rshares422,936,518,306
author_curate_reward""
vote details (7)
@ecoinstant ·
$0.03
This is legacy software, as you say (and @techcoderx mentioned) these are tricky issues.

I never made a post before, I just ignored this legacy login method (which was more secure in its day than copy pasting keys).  

But I felt compelled to look into it and make a post when I felt mistreated for not drinking the koolaid and exclaiming that it was the most safe and secure app in the world, which it is not.
👍  
properties (23)
authorecoinstant
permlinkre-steevc-syheq1
categoryhive-139531
json_metadata{"tags":["hive-139531"],"app":"peakd/2025.6.2","image":[],"users":["techcoderx"]}
created2025-06-26 21:08:27
last_update2025-06-26 21:08:27
depth2
children0
last_payout2025-07-03 21:08:27
cashout_time1969-12-31 23:59:59
total_payout_value0.014 HBD
curator_payout_value0.014 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length413
author_reputation868,883,123,304,099
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id143,592,783
net_rshares100,331,260,827
author_curate_reward""
vote details (1)
@techcoderx · (edited)
$0.54
The broader issue here is the lack of other installation/hardware-free login options that are user-friendly to newbies, other than another OAuth2 solution (web2 logins) which currently only works on very specific apps and for that app/platform only (i.e. VSC-related transactions [which are signed EVM txs behind the scenes](/vsc/@vsc.network/vsc-and-hive-accounts-explainer), InLeo social logins specifically for that only, just to name a few). These accounts cannot be ported to another Hive app without the user exporting the keys and importing it somewhere else.

All wallet providers supported on Aioha that isn't HiveSigner either requires installing something on user's browser/phone or having a hardware device (only one exists that I strongly [do not recommend](/backdoor/@techcoderx/new-ledger-firmware-opens-up-a-backdoor-to-your-seed-phrase)). The [only FAQ](https://aioha.dev/docs/faq) of adding a "plaintext key" provider ([beekeeper](https://gitlab.syncad.com/hive/hive/-/tree/develop/programs/beekeeper/beekeeper_wasm?ref_type=heads) maybe?) probably won't do much other than safeguarding potential DNS hijacking on hivesigner.com but the same can happen to the app itself.
👍  , , , ,
properties (23)
authortechcoderx
permlinkre-ecoinstant-sygsh2
categoryhive-139531
json_metadata{"tags":"hive-139531"}
created2025-06-26 13:07:51
last_update2025-06-26 13:09:12
depth1
children0
last_payout2025-07-03 13:07:51
cashout_time1969-12-31 23:59:59
total_payout_value0.272 HBD
curator_payout_value0.271 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length1,189
author_reputation47,798,058,051,301
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id143,580,902
net_rshares1,876,514,753,603
author_curate_reward""
vote details (5)
@themarkymark ·
$0.11
You can pre-add the authority through other interfaces like PeakD and Hive.blog.
I believe everything should support keychain, but even that isn't audited.
👍  , , , , ,
👎  , , , , , , , , ,
properties (23)
authorthemarkymark
permlinkre-ecoinstant-syhhs6
categoryhive-139531
json_metadata{"tags":["hive-139531"],"app":"peakd/2025.6.2","image":[],"users":[]}
created2025-06-26 22:14:30
last_update2025-06-26 22:14:30
depth1
children6
last_payout2025-07-03 22:14:30
cashout_time1969-12-31 23:59:59
total_payout_value0.056 HBD
curator_payout_value0.056 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length155
author_reputation1,780,045,201,740,099
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id143,593,649
net_rshares389,120,973,465
author_curate_reward""
vote details (16)
@ecency · (edited)
I agree on auditing or more eyes on codebase and what apps are doing by checking their source code if open. Hivesigner is opensource, audited at least by Ecency team and previous creators, anyone still can check codebase. A lot of misinformation will push people using unsecure or closed source solutions which isn't helping.
properties (22)
authorecency
permlinkre-themarkymark-202579t143415672z
categoryhive-139531
json_metadata{"tags":[],"app":"ecency/4.2.0-vision","format":"markdown+html"}
created2025-07-09 11:34:15
last_update2025-07-09 11:34:57
depth2
children1
last_payout2025-07-16 11:34:15
cashout_time1969-12-31 23:59:59
total_payout_value0.000 HBD
curator_payout_value0.000 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length325
author_reputation628,550,208,526,238
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id143,889,394
net_rshares0
@thedd · 
Audited code is way more secure than closed source or unaudited code. BUT, reviewing a githib repo won't make the app secure! What stops the dev to alter the deployed version of the codebase and add some malicious parts?

 The repo would look nice and shiny but a small change on the real server could be dangerous. So the full review should check the live webserver too. And it wouldn't be bulletproof either as you can swap dns record overnight or add changes after the audit.
properties (22)
authorthedd
permlinkre-ecency-szv8qc
categoryhive-139531
json_metadata{"tags":["hive-139531"],"app":"peakd/2025.7.3"}
created2025-07-23 18:59:03
last_update2025-07-23 18:59:03
depth3
children0
last_payout2025-07-30 18:59:03
cashout_time1969-12-31 23:59:59
total_payout_value0.000 HBD
curator_payout_value0.000 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length478
author_reputation610,855,738,228
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id144,339,214
net_rshares0
@ecoinstant · 
Yes, which is probably the most secure way to use HiveSigner!
properties (22)
authorecoinstant
permlinkre-themarkymark-syhi8e
categoryhive-139531
json_metadata{"tags":["hive-139531"],"app":"peakd/2025.6.2","image":[],"users":[]}
created2025-06-26 22:24:15
last_update2025-06-26 22:24:15
depth2
children0
last_payout2025-07-03 22:24:15
cashout_time1969-12-31 23:59:59
total_payout_value0.000 HBD
curator_payout_value0.000 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length61
author_reputation868,883,123,304,099
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id143,593,922
net_rshares0
@ecoinstant · 
What would an "audit" or auditor do?

Keep an eye on the github repo?
Look for exploits in the live app?
"PenTest" the company itself?
properties (22)
authorecoinstant
permlinkre-themarkymark-syimwh
categoryhive-139531
json_metadata{"tags":["hive-139531"],"app":"peakd/2025.6.2","image":[],"users":[]}
created2025-06-27 13:02:45
last_update2025-06-27 13:02:45
depth2
children2
last_payout2025-07-04 13:02:45
cashout_time1969-12-31 23:59:59
total_payout_value0.000 HBD
curator_payout_value0.000 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length134
author_reputation868,883,123,304,099
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id143,606,706
net_rshares0
@themarkymark ·
$0.12
Generally review the code for security issues and/or exploits.  Ideally, regularly, but most are lucky if it is even done once halfassed.
👍  , , , , , , ,
👎  , , , , , , , , , ,
properties (23)
authorthemarkymark
permlinkre-ecoinstant-syimzm
categoryhive-139531
json_metadata{"tags":["hive-139531"],"app":"peakd/2025.6.2","image":[],"users":[]}
created2025-06-27 13:04:33
last_update2025-06-27 13:04:33
depth3
children1
last_payout2025-07-04 13:04:33
cashout_time1969-12-31 23:59:59
total_payout_value0.062 HBD
curator_payout_value0.062 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length137
author_reputation1,780,045,201,740,099
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id143,606,732
net_rshares414,512,753,494
author_curate_reward""
vote details (19)
@tibfox ·
$0.10
Because you demanded my response so intensely on discord:

Good post that highlights some of the many things we can call insecure on Hive. It always depends on how you view it and your position is valid for sure. Hivesigner stores the keys in the local storage unencrypted and that's not very secure. 

But: Compared to many private key logins or the majority of web2 it is definitely very secure already because your keys will never go over the internet and you dont need to trust a new interface because you do not enter your keys there. Of course private key logins are often implemented that your keys will also not go over the internet but any new interface could be a potential danger: like leo did it one time in the recent past when you login. That was the real big issue - then the storage in a cookie and then they finally made it more secure by putting the keys in local storage encrypted and not sending any key over the internet.

The challenge that hivesigner solves here is that you do not give any user interface your private key in the first place but you probably already knew that.  

Regarding the owner key: there are moments you will need to use your owner key. Maybe that's the reason why you can enter it there. Just a thought of mine.

I know there are people working on other solutions here on Hive and that there are 1000x more secure solutions on Hive already: Keychain and HiveAuth.

My favorite is definetely HiveAuth because that works everywhere not only where keychain is installed and is compatible with Keychain. So all you need is a Keychain on your mobile device and the user interface supporting hiveAuth - done.

<hr>
Maybe your criticism would have more value if you shared it with the ecency team instead pinging me (who is not part of the team at all) or good karma (who gets pinged 10x per day probably) in this post only. They have a very active discord and would be pleased to see suggestions for improvements. But instead you decided to use it as a rant / beef show here and on the hive discord server.
<hr> 
I am not going into detail how you portrayed me here or on discord but I thought that its important for you that I go over your post and to give me feedback so I did.

My heart rate is at 97 (checking my fitbit right now) because I don't like when people call me names or try to offend me as part of their defense mechanism. But I have learned to reflect myself and my feelings and to work with my emotions - not getting dragged by them or work against them. 

I'm not a native speaker (yes I play this card now) so maybe some phrases could come to you in a different way than I've intended them to be. "As far as I know" is a phrase I use when I am pretty sure but too lazy to search for source code lines. Next time I'll do that instead. But a next time between you and me will not happen: I will just read your message, give a reaction emoji and leave it like that because the way you've handled this discussion did not encourage discussion at all. Sounds weird but I need to keep myself out from these kind of shows.

<hr>

I am on Hive for fun and a good time - sharing knowledge and opinions. I will keep doing this - *trust me*.
👍  , , , , , , , ,
properties (23)
authortibfox
permlinkre-ecoinstant-2025628t102810350z
categoryhive-139531
json_metadata{"links":[],"type":"comment","tags":["hive-139531","hive","dev","development","hivesigner","archon","tribes","leofinance","neoxian","pimp","proofofbrain"],"app":"ecency/3.3.3-mobile","format":"markdown+html"}
created2025-06-28 08:28:12
last_update2025-06-28 08:28:12
depth1
children5
last_payout2025-07-05 08:28:12
cashout_time1969-12-31 23:59:59
total_payout_value0.048 HBD
curator_payout_value0.047 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length3,190
author_reputation194,035,142,248,693
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id143,620,035
net_rshares318,053,793,161
author_curate_reward""
vote details (9)
@ecency · 
> Hivesigner stores the keys in the local storage unencrypted and that's not very secure.

That's the choice by user, there is literally checkbox to encrypt it.

![](https://images.ecency.com/DQmNSWzqNK6n2EmTg7c2QfvWdubSnBYbDZ66CBfMFtW2QgJ/2025_07_09_14_44_05.png)
properties (22)
authorecency
permlinkre-tibfox-202579t144514969z
categoryhive-139531
json_metadata{"tags":["hive-139531","hive","dev","development","hivesigner","archon","tribes","leofinance","neoxian","pimp","proofofbrain"],"app":"ecency/4.2.0-vision","format":"markdown+html"}
created2025-07-09 11:45:15
last_update2025-07-09 11:45:15
depth2
children3
last_payout2025-07-16 11:45:15
cashout_time1969-12-31 23:59:59
total_payout_value0.000 HBD
curator_payout_value0.000 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length266
author_reputation628,550,208,526,238
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id143,889,750
net_rshares0
@tibfox · 
But is it then also stored encrypted in the local storage?
properties (22)
authortibfox
permlinkre-ecency-202579t15822789z
categoryhive-139531
json_metadata{"links":[],"type":"comment","tags":["hive-139531","hive","dev","development","hivesigner","archon","tribes","leofinance","neoxian","pimp","proofofbrain"],"app":"ecency/3.3.3-mobile","format":"markdown+html"}
created2025-07-09 13:08:21
last_update2025-07-09 13:08:21
depth3
children2
last_payout2025-07-16 13:08:21
cashout_time1969-12-31 23:59:59
total_payout_value0.000 HBD
curator_payout_value0.000 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length59
author_reputation194,035,142,248,693
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id143,892,671
net_rshares0
@ecoinstant · 
Sounds like we agree on a lot of things.  It was definitely when you called me names, that motivated my heart rate, and this post and subsequent pings.
properties (22)
authorecoinstant
permlinkre-tibfox-syk7xw
categoryhive-139531
json_metadata{"tags":["hive-139531"],"app":"peakd/2025.6.3","image":[],"users":[]}
created2025-06-28 09:34:45
last_update2025-06-28 09:34:45
depth2
children0
last_payout2025-07-05 09:34:45
cashout_time1969-12-31 23:59:59
total_payout_value0.000 HBD
curator_payout_value0.000 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length153
author_reputation868,883,123,304,099
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id143,620,637
net_rshares0
@tydynrain ·
$0.12
Yeah, that's not good. I try not to use HiveSigner if I can help it, but it's sometimes not an option. This is definitely worrisome. 😁 🙏 💚 ✨ 🤙
👍  , , , , ,
properties (23)
authortydynrain
permlinkre-ecoinstant-2025625t214420713z
categoryhive-139531
json_metadata{"links":[],"type":"comment","tags":["hive-139531","hive","dev","development","hivesigner","archon","tribes","leofinance","neoxian","pimp","proofofbrain"],"app":"ecency/3.3.3-mobile","format":"markdown+html"}
created2025-06-26 07:44:21
last_update2025-06-26 07:44:21
depth1
children0
last_payout2025-07-03 07:44:21
cashout_time1969-12-31 23:59:59
total_payout_value0.058 HBD
curator_payout_value0.058 HBD
pending_payout_value0.000 HBD
promoted0.000 HBD
body_length143
author_reputation206,444,403,855,200
root_title"HiveSigner is INSECURE? - discussion and deep dive"
beneficiaries[]
max_accepted_payout1,000,000.000 HBD
percent_hbd10,000
post_id143,574,712
net_rshares410,333,973,588
author_curate_reward""
vote details (6)
Help/Feedback