PSA: Blockfolio is not secure. Reddit link with additional info in the comments.

like
Posting as :
works at
You are currently posting as works at

How do you track your crypto assets in blockfolio? You input type of coin, date of transaction, amount and price at purchase. Then the app just adds it all up and let's you see total $ invested verses current portfolio amount based on prices from the last API fetch and how much profit/loss you made.

How does blockfolio update current crypto prices? By using APIs from various exchanges. The vulnerability is that the API call is neither authenticated nor encrypted via HTTPS/SSL. This means that if you use the blockfolio app on an unsecured wifi (airport, starbucks, etc) or a secure wifi network that has been compromised (unlikely to happen), anyone that is snooping can see the API call taking place.

What does that mean? It will show them device ID (very easy to track the person from this) and how much you have in holdings for each currency that you have in blockfolio that it attempts to refresh prices for.

Now you're right. No account info is shared in this entire process. But if you were a hacker, would you waste your time trying to hack someone only to find out they have $1K in ethereum? Or what if you easily exploit this blockfolio vulnerability and find people that have $20k+ for example? So long story short, it paints a target on your back. For a hacker to actually get your coins is a whole other process, but this vulnerability can show them how much you have.

like

Did I ever say it connects to your account? Read the link

like

http://reddit.com/r/ethtrader/comments/6kbglm/blockfolio_security_warning/

What is blockfolio?

An app to monitor and track your crypto portfolio. I personally use an excel spreadsheet with a macro that refreshes the data every 60 seconds, but I know a lot of folks on here use blockfolio

u should sell ur shit now. ur doomed.

-.- blockfolio doesn't connect to ur account dude.

Not following, I read the article but at no point do you put any account information in. Not seeing the vulnerability.

and within an airport, logging onto wifi, how likely will u run into a hacker that will do this specific activity

Related Posts

EY has 6 months probation period,is this for all?

like

I am getting application status messages even after my offer letter is issued , can some one let me know what this means , is it common to get them @LTIMindtree

like

Just went on a first date with a gentleman. Such a lovely time...great conversation. Until he walked me to my car. Stuck his tongue down my throat and looking to cop a feel multiple times. I’m now sure I’m going to die alone and having major itch to contact ex. 😥

like

Anyone work in Citibank internal audit, capital markets and can give me insight on work/life balance and culture ?

funny

Sweet redemption from yesterday 513… 4/6

⬜️⬜️⬜️⬜️⬜️
🟩⬜️⬜️🟨⬜️
🟩🟨🟨🟩⬜️
🟩🟩🟩🟩🟩

like

Luking 4 below profile candidates. Dm
Role: Java Backend Developer (Java 8, Spring Boot)Relevant Experience: 2-8 years Positions: 6
Skills/Hands-on development skills n Java8 features like  Streams, Lambda expressions, Enhanced 4 loops, Parallel processings, etc./ Hands-on development skills n Spring Boot, Microservices & JPA/Hibernate/ Exp in designing, analyzing & troubleshooting large-scale distributed systems/Exp in any Java based rule engine implementation 4 work flows.Dockers,elastic search

like

Would you give up HSW to go to a T15/20 on a full ride? Is the brand really that much better?

likefunny

Any recommendations for full-service movers? Moving from LA to downtown SF

like

Thoughts on Tesla after they recreated the “it’s a small world” ride in Vegas? Have they really gone this far off the deep end?

like

Question how much do y’all have saved at 35years old? I am really behind on saving and investing and I’d like to gauge where my peers are and what to aim for.

like

Hi friends, please tell me how much salary can Barclays offer to 4.7+ years of experience for Senior developer position. I am already holding an offer with 70% hike. Can I ask for 100% hike with 2 months notice period is still remaining. Barclays

like

So Publicis Sapient has started firing senior associate also Publicis Sapient

likeupliftinghelpful

Hi Fishes need your suggestions. I had an interview with a small company last week and this week they scheduled a client interview. The manager person is trying hard to lock me by saying not to accept any other offers till they confirm and he made me attend a demo call today to teach on how to take client interview. I didn't feel good with this approach like treating school kids.

Should I accept the offer if I clear client interview and use this to counter for others? Or should I reject?

like

What are some ways to stop dreading work everyday? I’m beyond grateful that I have a job and have a source of income but I feel so drained every single day that I just dread having to do it all over again the next day.

like

Writer is hungry for employment nationwide. Ideally seeking junior full time and freelance roles. Would also consider an internship. Bonus attributes include being a Groundhog Day aficionado.

like

I’m about to have a final round interview with the VP of sales. What questions should I expect? Supposedly it’s just a formality and the decision is up to the manager who I interviewed with in the second round.

likehelpful

LS Senior Manager and Director (8-10 yrs)—East Coast--Must have supply chain and manufacturing experience to match your "pure" strategy expertise. Big 4. Contact me on LI for more details!

like

I hate standardized testing :(

like

Additional Posts in Everything crypto

Where is everyone buying their alts?

Thoughts on the next coin to be added to coinbase?

like

Hm to load up on OMG or buy more Ether.... 🤔

I don’t get these punks…nfts that is…crypto punks, but folks making a killing.

like

Thoughts on LiteCoin?

like

Is it a good idea to buy ALGO now? Price is around $1.60 rn. Any insights?

likefunny

Remember the days when people were so confident in the market they were using credit cards to buy bitcoin?

like

Swift vs Ripple - who will win?

Binance isn’t accepting new users at the moment... What’s your favorite exchange?

Can I send ETH from MEW to Rocketpool?

like

“...be fearful when others are greedy” - Warren Buffet

And I add, don’t take advice from stupid greedy people! We have loads of them on this group.

like

Those who invested in TIME and kept shilling/recommending here - did you do an ounce of research on it? Be honest.

likefunny

Has anyone had any success with cryptocurrency trading bots? If so, any recommendations?

like

Top ICOs I’m researching - Crypterium, Bluezelle, Coinvest, Sether, Vice - thoughts? Any other?

like

I’ve been holding BTC in hopes that it will reach 15k at some point, after which I plan to convert all to ETH. Any hopes with BTC Going up?

What are you farming?

like

Hi 🐠 read many comments talking about earning interest while buying different crypto, where are you getting interest is there different platform? I am new to crypto and currently using coinbase pro, purchased few SOL and ALGO but not seeing any interest earn.

like

Relatively new to the crypto space. Where do folks buy into coins that aren’t yet available on Coinbase?

like

There is coin for it!

like
like

New to Fishbowl?

Download the Fishbowl app to
unlock all discussions on Fishbowl.
That was just a preview…
Sign Up to see all discussions
  • Discover what it’s like to work at companies from real professionals
  • Get candid advice from people in your field in a safe space
  • Chat and network with other professionals in your field
Sign up in seconds to unlock all discussions on Fishbowl.

Already a user?
Login here

Share

Embed this post

Copy and paste embed code on your site

Preview

Download the
Fishbowl app

See what’s happening in your industry
from the palm of your hand.

A phone with Fishbowl app

Scan your QR code to download
Fishbowl app on your mobile

Download app

Sign up for free to view this conversation on Fishbowl

By continuing you agree to Terms of Use and Privacy Policy

Already have an account? Log in

Sign up for free to continue using Fishbowl

By continuing you agree to Terms of Use(New) and Privacy Policy(New)
Messaging rates may apply

Already have an account? Log in

For account settings, visit Fishbowl on Desktop Browser or

General

Legal