Gal Weizman @ ReactNext 24`
summary
Claims that browser wallets change the threat model: the client holds private keys so theft is irreversible not your keys not your coins. Traditional XSS defenses help but supply chain attacks remain a real, ongoing risk. The concrete mitigation is SES / compartments (Agoric’s proposal moving through TC39): virtualized same‑realm sandboxes that avoid identity discontinuity and preserve synchronicity; wallets like MetaMask already use compartments to confine dependencies and reduce real-world compromises.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 3:16Centralized vs decentralized
- 7:12Security in decentralized apps
- 10:43Crypto wallets as clients
- 12:52Malicious code in wallets
- 17:25Sandboxing supply chain attacks
- 20:17CES: Secure ECMAScript compartments
- 24:51Key takeaways and industry lessons
related talks
46mWhat Can Traditional Web App Security Learn From Browser Wallet Extensions?
36mDeciphering Web3 Security: Implications and Innovations
24mBitcoin Web Application Security
14mWallets 3.0: How will the next generation of web3 wallets look?
19mThe Last Wallet You'll Ever Open
30mAchieving the Web Isolation Nirvana - How far along are we?
48mSecurity Risk: Single-Page Applications.
41mThe Last XSS Defense Talk: Why XSS Defense has radically changed in the past 7 years