Dogecoin Contributor Warns Against Social Signing Risks

What Is Social Signing and Why Is It Causing Concern?

Crypto wallets have come a long way in making things easier for newcomers. Instead of writing down a complex 12-word seed phrase, many wallets now allow social signing.

Social signing lets you create and access a blockchain wallet using everyday logins. You can sign in with your Google account, Apple ID, Telegram, or email address.

However, prominent DogecoinDOGE-1.95% community contributor Mishaboar recently raised serious concerns about this feature. He warned that relying on social logins creates hidden security vulnerabilities for users.

Recent Incidents Highlight Vulnerabilities in Social Logins

This security warning comes directly on the heels of real-world wallet issues. Keplr, a multichain wallet supporting networks like Cosmos, BitcoinBTC-0.13%, EthereumETH+0.18%, and Starknet, received concerning reports from users.

Multiple Keplr users experienced unauthorized transactions on accounts created using Google or Apple login methods.

Keplr escalated the incident to Web3Auth, an infrastructure provider for Web3 wallets. The two teams launched a joint investigation to determine the root cause.

Prior to Keplr's public disclosure, Web3Auth acknowledged a security issue affecting services used by select third parties. Web3Auth temporarily paused its embedded wallet service to prevent further issues.

After conducting an initial investigation, Web3Auth confirmed that no evidence was found showing MetaMask users were impacted by the issue.

Why Newbies Face the Biggest Threat from Social Signing

Mishaboar expressed his concerns openly on social media platform X, criticizing wallet developers who push social logins onto users.

Social signing, the feature you may want to add to your wallet if you hate your users. The worst part is that the users that use the social signing option - and who will end up being hacked through it - are also often newbies, entering crypto for the first time. And the risk goes beyond the funds in your wallet - data leaks could link your real-life identity to your holdings, which can have terrible consequences.

New crypto users often choose social logins because seed phrases seem confusing. But this convenience comes at a hidden price tag.

If a social account gets compromised, attackers gain access to the linked wallet. Worse yet, data leaks can connect your real-world name to your private wallet address.

Mishaboar also pointed out issues with cloud key backups. Backing up keys to the cloud simply means storing them on someone else's server, which introduces external risks.

Additional Threat: Device-Level Exploits Target iOS Users

Social signing is not the only threat crypto users face right now. Security researchers recently issued an urgent advisory for Apple iOS users.

Researchers identified two dangerous exploit kits named Coruna and Dark Sword. These tools specifically target iPhones running older versions of iOS.

These exploits do not rely on flaws inside specific wallet apps. Instead, once the entire operating system is compromised, attackers can extract local wallet data.

Apple device owners are strongly urged to update their operating systems immediately to protect their digital assets from potential breaches.

Essential Steps to Keep Your Crypto Safe

• Avoid social login features for high-value wallet storage whenever possible.
• Store your recovery seed phrases offline on paper or metal backup devices.
• Keep your smartphone and computer operating systems updated to the latest versions.
• Never store unencrypted private keys or seed phrases in cloud storage folders.

Past performance of digital assets is not an indicator of future performance. Always conduct thorough research and evaluate security risks carefully before managing digital assets.