Myetherwallet OffLINE question

[luchins]

Hello,  I  know this  place  is for  bitcoin core

But I have  a question

Is  it possible that  the Github  documents  have been manipulated?

I have downloaded  the  MEW OFFLINE  from github here : https://github.com/kvhnuke/etherwallet/releases/tag/v3.21.11

And  between  the files  I have   (index.html,  embed.html) I have found  a  file  called ''Phishing.html''


In the  ''how  to run MEW offline''  guide  there is no mention of  this  file

https://kb.myetherwallet.com/offline/running-myetherwallet-locally.html

There  are   ''index'',  ''embed.html'' In the images,  there is no  ''phising.html''  file


SO my concern is :  Is  it  possible that  the gibhub has been hacked  and  that file  has been put to stolen  private keys?


Can someone  explaine   what is  this  ''phishing.html  file?

[1714631244]

1714631244

[1714631244]

1714631244

[1714631244]

1714631244

[Sellingaccs]

First of all, this section is for Bitcoin support only so it needs to be moved.

Also it is hard to say what that file could be, if we don't contents of it. I guess it could have something to do with the new Warning guide lines on the front page (Myetherwallet is not a bank etcetra).

Could you upload the contents of the phishing.html and insert them into between the code tags?

[DarkStar_]

If you look at the code for the phishing.html file, it's simply a page that warns you if you try to access a page flagged as suspicious by the community (ie, phishing pages)

You should be able to delete it without an issue if you're worried

[cissrawk]

No need to worry about phishing.html, its just show page which contain text "DON'T GET PHISHED"
You can open it by yourself if you want. Image : https://ibb.co/g08aFd

[luchins]

Thank you  very much,.  I have  suspected  it  was not  harmful

JUst  to be  safe, I have asked


Anyway is  it  possible that  hacker  could  corrupt gibt hub?

I always  check  the  sig  file   but  it's  the safest  way?

with gpg

[Sellingaccs]

Anyway is  it  possible that  hacker  could  corrupt gibt hub?

Yes. However this kind of thing would need the dev/contributor account getting compromised, which i doubt heavily as dev's such as this has pretty good OPSEC usually.

I always  check  the  sig  file   but  it's  the safest  way?

with gpg

Absolutely. However this needs to be verified with the real dev's PGP key as they could change that from the github possibly if they compromised the account. Using MyEtherwallet only with the keystore file is very unsecure. You should use it with metamask or one of the hardware wallets.

[luchins]

But  I  want to use it  local... there will be no  internet connection.  Why to use metamask

[Sellingaccs]

But  I  want to use it  local... there will be no  internet connection.  Why to use metamask

As far metamask, it is basically just a browser plugin that makes Ethereum a bit safer and easier to use. Transactions are always signed on Metamask rather than on MEW's website. This happened while ago, and metamask users were not affected: https://qz.com/1261540/mew-ethereum-hack-the-internets-infrastructure-was-compromised-to-target-myetherwallet/


And also even if you download the MEW's script from their page, you still need internet connection to broadcast that transaction. However if you only use MEW for signing, this should be done on an offline computer and broadcasted with other.

[Oilacris]

No need to worry about phishing.html, its just show page which contain text "DON'T GET PHISHED"
You can open it by yourself if you want. Image : https://ibb.co/g08aFd

Was supposed the same thing but you already mentioned it.

Thank you  very much,.  I have  suspected  it  was not  harmful

JUst  to be  safe, I have asked

Since  its already been clarified and answered better to lock this thread.

Quite glad to see that you are really cautious into things even myself in first encounter i was bit skeptical into that file and figured it out on my own.

[luchins]

Since  its already been clarified and answered better to lock this thread.

Quite glad to see that you are really cautious into things even myself in first encounter i was bit skeptical into that file and figured it out on my own.

I  have  another  question, please


Can  I put  safetly   the  signed  transaction (made in MEW off-line in an airgapped computer)   into a compromised  computer?

there  is a  remote  way to  recover  the  Key  using  the  signed  transaction made off line in Myetherwallet?

[Sellingaccs]

Can  I put  safetly   the  signed  transaction (made in MEW off-line in an airgapped computer)   into a compromised  computer?

there  is a  remote  way to  recover  the  Key  using  the  signed  transaction made off line in Myetherwallet?

You can safely broadcast a signed transaction as it does not include the private key. Just be sure that you only export the transaction. However this transaction should be written by hand because USB Flash drives and storage media after all can get infected. Or use a scanner.

There is no way of deriving a private key from public key or transaction hash known for now.

[luchins]

Can  I put  safetly   the  signed  transaction (made in MEW off-line in an airgapped computer)   into a compromised  computer?

there  is a  remote  way to  recover  the  Key  using  the  signed  transaction made off line in Myetherwallet?

You can safely broadcast a signed transaction as it does not include the private key. Just be sure that you only export the transaction. However this transaction should be written by hand because USB Flash drives and storage media after all can get infected. Or use a scanner.

There is no way of deriving a private key from public key or transaction hash known for now.

I  MADE A  MISTAKE


I have filled both addresses  (address  from  sending  coins,  and  address    to   send the coins to)  IN  THE ON LINE  myether wallet,  I HAVE  PUT  BOTH ADDRESSes  IN THE  ONLINE  FORM of MYETHERWALLET.COM


Then  I tried  to send  the transaction,  but the  nounce  wasn't  set properly, so  it said  to me ''Try  to  adjust the nounce''

So  I have put  ''100''  as  nounce

and  the transaction went trouht

it  said to me:   ''The  transaction  has been  broadcast  to  the network. That does not mean it  will  be mined  or sent..''  and so on


I am  worried....  I  just  checked  on Ether scan  and  my tokens did not move to the address...  they are  in my old address... so  why it said to me  ''the transaction has been  broadcastes''?


I am  also worried about   the  mistake of  putting BOTH ADDRESSES  (the one to  send coins to, and the one to send  the coins from)  IN THE ON LINE MYETHERWALLET  FORM  OF THE WEBSITE

WHo mined this  transaction?

Why it says  it has been  ''broadcasted''?

Can  an  attackker  with  1 address,  and second  address  +  the SIGNED  transaction recover my private key?