Permit：一个平平无奇的签名 如何骗走你的资产？

Do you still think that as long as I don't initiate the transaction, I will not lose my assets if I sign my name and log on to the website? If you nod, your safety awareness may have stayed at the point of view of the victims that the fished assets were tokens years ago, and the main fishing method was fishing signature, which was only a stolen transaction with an average asset value in the middle of this year, in which all the pens were principal tokens stolen by fishing signature. It's a horror movie. One day, I suddenly found that the assets were removed and checked, thinking that the private key had been stolen. Finally, I found that there was a casual offline signature, but all this could have been avoided. It is clear that in order to save time, I won't talk too much about the knowledge of encrypted textbooks introduced or introduced here. Maybe you will start to have a headache just by reading this sentence. You just need to realize that the times have changed and the signature with heavy eyes is not simple. You can directly and rudely understand that there are many token authorizations now. It will be managed through an intermediary. In the past, your token quota was authorized to each contract one by one, and each authorization cost. Now, there are a considerable number of applications through technology. You only need to authorize tokens to this intermediary, and anyone who integrates this technology can request to authorize them even in batches by simply signing this authorization quota, without spending a double-edged sword again and again. Although this type of signature upgrade brings to cross-application operations, In order to facilitate and save costs, there are various benefits, but there are also some hidden dangers. The danger lies in the fact that in the last round of bull market encryption, users have developed the operating habit of signing to connect, and the default common signature is safe and unguarded. I don't know that the new version of the signature will be caught if you don't pay attention to distinguish between blind signatures, which poses new challenges to users' security awareness and various infrastructures such as wallets. For hackers, it is better to use the knife to kill people. The attacker only needs to deploy a phishing contract to obtain an authorization signature from you, and then submit a transaction to steal your assets. You can even wait for a few days before submitting it, and you can also allow hackers to obtain the rights of all your authorized tokens in batches. For example, in this case recently shared by founder Cosine, a user was signed and fished the authorization of the relevant tokens during the pledge period, but he didn't know anything about it and didn't pay attention to checking the hacker's position when he proposed the tokens to his wallet. It seems that fishing has become easier from the perspective of camouflage means. They can completely make an airdrop inspection website for you to connect your wallet to check airdrops or make a tool website for you to log in to meet your needs in some hot events. There are endless varieties, and during the use, you are likely to be induced to make a type of signature and look forward to the future. With the promotion of account abstraction in Ethereum, you can even directly authorize the whole. Giving the address control authority to a contract allows the contract address to directly operate the user's wallet address, which will also introduce new fishing risks at the same time. Of course, this is another story. How to prevent this type of fishing? Are there any regrets? There have been countless tweets about the prevention methods of fishing, and we have taken the trouble to sum up again. It is worthwhile not to blindly sign, just like a legally binding contract in the real world. No one will give his signature at will to identify disguised fishing. Fish website belongs to the basic operation of encryption and security, and the login request of strange local dog website is the same. Be careful that hackers will try their best to disguise the intention of buttons to trick you into signing. Everyone's commonly used foxes can recognize the signature. If you pop up this type of signature interactively, it's best to confirm whether you want to authorize the relevant tokens again and again. If it's just an ordinary signing message, it's impossible to pop up a special type of signature. Besides classes, there are many combination operations, even the beginning is completely unreadable. All kinds of signatures may endanger the safety of your assets. In short, if you don't know the contents and consequences of the pop-up signature, you must be cautious, especially if there are many assets in your wallet. Wet and dry are often separated and you often walk by the river. Where are your wet shoes? If you really want to have high-risk behaviors frequently, do a good job of isolating assets. A small wallet that is often used for interaction does not store a lot of assets. It is definitely not an appropriate metaphor when you go out shopping at will. I will take my belongings with me. I will only put a little money in my wallet, and I will change my assets every once in a while, and I will cancel my authorization and signature to reduce my risk exposure as much as possible. For wallets that store a lot of assets, I don't want to connect to websites at will or simply put them in my hardware wallet and turn them out for interaction when necessary. This is also a cliche way to prevent phishing. If it is not used intensively, I suggest choosing it when I authorize the token amount for the first time. Choose on-demand authorization, that is, how much authorization is used instead of the default maximum unlimited amount. If you have authorized an unlimited amount, you can also take regret medicine. You can check your risk exposure of token authorization in, and you will clearly see how much a token is authorized. The tool also supports canceling signatures. You can also find signatures in it to cancel. Before hackers activate related signatures and steal your assets, it should be noted that the type of signature is an offline signature, and there is no one on the chain before it is used. Hackers with traces usually store these stolen signatures on the server. It is a good habit to use tools to check the authorization and signature regularly. Conclusion If you are unlucky, you'd better seek the help of a professional security team in time, transfer the assets in time and make up for the loss, and even use some technical means to save the assets. It is worth noting that these signature phishing has tended to be specialized and industrialized, and it is clear that if the assets have been transferred and laundered by a professional hacker team, there is a high probability that they will not be able to get them back, so it is necessary to prevent them from taking any opportunities. 比特币今日价格行情网_okx交易所app_永续合约_比特币怎么买卖交易_虚拟币交易所平台

注册有任何问题请添加 微信：MVIP619 拉你进入群

文章转载注明 网址：https://netpsp.com/?id=63340