StellarGuard.me Announcing StellarGuard.me, an app that secures your precious XLM by using Stellar's multisignatures and two factor authentication. StellarGuard is currently available for testing using Stellar's testnet at: https://test.stellarguard.me and will be available for the public net by March 15. Project Motivation and Goals Every time I enter my secret key to sign a transaction I get a sense of dread that it might be intercepted or stolen by a hacker and all of my XLM would be gone. After the Blackwallet hack, it became clear to me that there are so many different attack vectors on the web that there needed to be a way to keep your XLM safe even if your computer or wallet was compromised. Thankfully, Stellar multisignatures can help make that possible, but you still need a safe and secure way to handle the 2nd signature. That's where StellarGuard comes in. StellarGuard was built with 3 driving principles in mind: Your XLM should be safe even if your computer is hacked and your secret key is stolen. Your XLM should be safe even if StellarGuard is hacked and it's secret keys are stolen. The only way you should ever be able to lose your XLM is if someone gets your secret key AND StellarGuard's. StellarGuard should be able to work with other wallets, including paper wallets. Its primary goal is not to be a wallet itself, but to add an additional layer of protection. How it works Sign up for a StellarGuard account Add a StellarGuard public key as an additional signer to your Stellar Account. Submit your half-signed transactions directly to StellarGuard. Enter your authorization code (emailed to you, or authenticator app). StellarGuard signs the transaction and submits it to horizon. Two Factor Authorization StellarGuard currently supports two methods for authorizing transactions. Email: An authorization code is emailed to you when you submit a transaction. Authenticator: A rotating passcode from a supported authenticator app must be entered to authorize a transaction. Screenshots Work still to be done Make it easier to deactivate StellarGuard (currently you must build a transaction manually to remove the StellarGuard signer) - DONE Optionally allow you to build and sign transactions in the app itself (client side only) so you don't have to be copy/pasting XDRs around Wallet Integrations - contact Stellar wallet developers to see if they'd be interested in integrating StellarGuard. It's a simple API call to submit the transaction to StellarGuard instead of to Horizon. UI/UX improvements. Looking for feedback on this. If anyone has suggestions for improvements please let me know! Allow you to toggle authorization modes for an account. Right now once you enable authenticator it always requires it. Allow you to authorize via SMS codes Get it live on production/public network - DONE Feedback and suggestions would be GREATLY appreciated.

Cool! This was the first thing I tried myself when multi-sig was added to Stellar

Instead of pasting the XDR or building a transaction, maybe add QR-code as the method to input the XDR that is to be signed. https://galactictalk.org/d/12-formats-for-qr-codes-uris-nfcs/36

sacarlson How common is this? Is it typically unsigned transactions that are in the QR code -- since my app requires that you send it a signed transaction? And are there examples out there of wallets or apps that generate these QRs already?

I test to ues my temp account on testnet. After I created transaction and submit XDR then error as below detail. It's show blank screen. There is no detail of pending or not complete transaction at main screen. https://test.stellarguard.me/transactions/1 65ed3ccc18e0a6174aa03922462f051a.js:719 TypeError: e.value is not a function at e.get (65ed3ccc18e0a6174aa03922462f051a.js:2815) at un (65ed3ccc18e0a6174aa03922462f051a.js:746) at e.computeValue (65ed3ccc18e0a6174aa03922462f051a.js:746) at e.trackAndCompute (65ed3ccc18e0a6174aa03922462f051a.js:746) at e.get (65ed3ccc18e0a6174aa03922462f051a.js:746) at e.<anonymous> (65ed3ccc18e0a6174aa03922462f051a.js:746) at e.get (65ed3ccc18e0a6174aa03922462f051a.js:746) at t.value (65ed3ccc18e0a6174aa03922462f051a.js:2740) at Object.W [as allowStateChanges] (65ed3ccc18e0a6174aa03922462f051a.js:746) at 65ed3ccc18e0a6174aa03922462f051a.js:748 at un (65ed3ccc18e0a6174aa03922462f051a.js:746) at e.track (65ed3ccc18e0a6174aa03922462f051a.js:746) at u (65ed3ccc18e0a6174aa03922462f051a.js:748) at t.render (65ed3ccc18e0a6174aa03922462f051a.js:748) at i (65ed3ccc18e0a6174aa03922462f051a.js:719) at beginWork (65ed3ccc18e0a6174aa03922462f051a.js:719) i @ 65ed3ccc18e0a6174aa03922462f051a.js:719 l @ 65ed3ccc18e0a6174aa03922462f051a.js:719 x @ 65ed3ccc18e0a6174aa03922462f051a.js:719 k @ 65ed3ccc18e0a6174aa03922462f051a.js:719 batchedUpdates @ 65ed3ccc18e0a6174aa03922462f051a.js:719 ut @ 65ed3ccc18e0a6174aa03922462f051a.js:719 gn @ 65ed3ccc18e0a6174aa03922462f051a.js:746 xn @ 65ed3ccc18e0a6174aa03922462f051a.js:746 Xt @ 65ed3ccc18e0a6174aa03922462f051a.js:746 G @ 65ed3ccc18e0a6174aa03922462f051a.js:746 N @ 65ed3ccc18e0a6174aa03922462f051a.js:746 n @ 65ed3ccc18e0a6174aa03922462f051a.js:746 (anonymous) @ 65ed3ccc18e0a6174aa03922462f051a.js:2843 L @ 65ed3ccc18e0a6174aa03922462f051a.js:670 (anonymous) @ 65ed3ccc18e0a6174aa03922462f051a.js:670 t.(anonymous function) @ 65ed3ccc18e0a6174aa03922462f051a.js:670 n @ 65ed3ccc18e0a6174aa03922462f051a.js:2843 (anonymous) @ 65ed3ccc18e0a6174aa03922462f051a.js:2843 Promise resolved (async) n @ 65ed3ccc18e0a6174aa03922462f051a.js:2843 (anonymous) @ 65ed3ccc18e0a6174aa03922462f051a.js:2843 (anonymous) @ 65ed3ccc18e0a6174aa03922462f051a.js:2843 (anonymous) @ 65ed3ccc18e0a6174aa03922462f051a.js:2843 N @ 65ed3ccc18e0a6174aa03922462f051a.js:746 n @ 65ed3ccc18e0a6174aa03922462f051a.js:746 (anonymous) @ 65ed3ccc18e0a6174aa03922462f051a.js:2742 L @ 65ed3ccc18e0a6174aa03922462f051a.js:670 (anonymous) @ 65ed3ccc18e0a6174aa03922462f051a.js:670 t.(anonymous function) @ 65ed3ccc18e0a6174aa03922462f051a.js:670 n @ 65ed3ccc18e0a6174aa03922462f051a.js:2742 (anonymous) @ 65ed3ccc18e0a6174aa03922462f051a.js:2742 (anonymous) @ 65ed3ccc18e0a6174aa03922462f051a.js:2742 (anonymous) @ 65ed3ccc18e0a6174aa03922462f051a.js:2742 F.i @ 65ed3ccc18e0a6174aa03922462f051a.js:748 commitLifeCycles @ 65ed3ccc18e0a6174aa03922462f051a.js:719 t @ 65ed3ccc18e0a6174aa03922462f051a.js:719 x @ 65ed3ccc18e0a6174aa03922462f051a.js:719 k @ 65ed3ccc18e0a6174aa03922462f051a.js:719 m @ 65ed3ccc18e0a6174aa03922462f051a.js:719 h @ 65ed3ccc18e0a6174aa03922462f051a.js:719 updateContainer @ 65ed3ccc18e0a6174aa03922462f051a.js:719 (anonymous) @ 65ed3ccc18e0a6174aa03922462f051a.js:719 unbatchedUpdates @ 65ed3ccc18e0a6174aa03922462f051a.js:719 no @ 65ed3ccc18e0a6174aa03922462f051a.js:719 render @ 65ed3ccc18e0a6174aa03922462f051a.js:719 require.2../polyfills @ 65ed3ccc18e0a6174aa03922462f051a.js:2849 t @ 65ed3ccc18e0a6174aa03922462f051a.js:1 require.484 @ 65ed3ccc18e0a6174aa03922462f051a.js:1 (anonymous) @ 65ed3ccc18e0a6174aa03922462f051a.js:1

StellarGuard Well the qr-code "transaction envelope" can be sent signed or unsigned. my_wallet is a prototype example that both reads and writes this format of "transaction envelope" qr-code that it can send signed or unsigned and also accepts and generates other qr-code operations and formats. Also there is stargazer that accepts some parts of this qr-code standard that include payments with a branch of stargazer that also accepts the escrowed payment version. But at present this extension of "transaction envelope" or any of the qr-code formats are not really fully supported or accepted as standard. It requires other programmers and users to find value in them to make use of them and tweak the ideas of standards we now have or don't yet have.

@StellarGuard I like your idea. Looks like we could both benefit working together. I offer a way to issue transactions as links with cosmic link protocol and to sign them using Stellar Authenticator. You could issue transaction to be signed as URL & it would be safely handled by my platform. I could include native support for your service in Stellar Authenticator as an optional security measure. I designed those tools as an answer to webwallet hacks aswell. More info: https://galactictalk.org/d/1130-stellar-authenticator-sign-transactions-securely-phone-app-web-app The last link in my presentation will give you a complete idea of the design. Edit: I'll make the first release next week for testing purposes.

PitchayasakSenachai Thanks for finding that -- it was an issue with how I was displaying transactions with memo text that I didn't catch locally. I've pushed a fix just now (as well as a new logo and color scheme ? ). You've also inspired me to look into React error boundaries a bit more so a simple error like this doesn't take out the whole page.

MisterTicot Looking forward to trying it out. If it makes sense to integrate (mutually beneficial) I'm very open to external integrations. I've had another request now to add support for this service as a whitelabeled service, but I think I'm pretty far away from supporting that. If there is more interest I'll move it up my priority list though.

StellarGuard Very nice. Well I think at this time we both have a lot to do so I propose we talk about it when things calm down a bit ? Is it good for you?

Loading...

Something went wrong while trying to load the full version of this site. Try hard-refreshing this page to fix the error.

StellarGuard.me - Secure your Lumens with Multisig and Two Factor Auth

« Previous Page