New wallet uses Amazon hardware security modules to eliminate seed words

1 year ago

A caller crypto wallet has conscionable launched successful Apple’s App Store store that uses Web2 trickery to guarantee users don’t request to interact with effect phrases oregon passwords.

According to a May 11 announcement from the app’s developer, Kresus, the caller wallet stores users’ backstage keys successful an Amazon Web Services Hardware Security Module (HSM) and uses “magic links” and 2FA to authenticate users.

Most crypto wallets necessitate users to constitute down a betterment operation oregon “seed words” erstwhile they acceptable up an account. If the idiosyncratic loses their betterment operation and their instrumentality crashes, they suffer entree to their relationship forever.

For this reason, immoderate crypto users similar to store their crypto successful an speech account. But events similar the illness of FTX person besides led to fears that keeping crypto successful an speech could besides beryllium unsafe.

Speaking to Cointelegraph, the Kresus squad said that their caller wallet app attempts to hole this occupation utilizing a wallet infrastructure and bundle improvement kit (SDK) called “Magic,” which stores the user’s backstage cardinal connected an Amazon Web Services machine that is specifically designed to store highly delicate information.

The AWS machine encrypts the user’s cardinal with a Master Key that cannot permission the hardware module, overmuch successful the aforesaid mode that a hardware wallet does. This eliminates the request for effect words oregon backstage keys to beryllium stored connected the instrumentality oregon kept arsenic a insubstantial backup, the squad said.

Unlike a centralized exchange, Kresus does not usage passwords to authenticate users, since stealing password hashes and cracking them is 1 of the astir communal techniques hackers usage to get entree to web accounts. Instead, it requires users to click a nexus from wrong an email each clip they effort to log in.

The app besides uses 2FA to support the relationship successful lawsuit the user’s email code becomes compromised.

When it comes to sending crypto, users don’t request to chopped and paste crypto addresses connected Kresus. Instead, the app allows each idiosyncratic to registry for a escaped .kresus domain sanction done Unstoppable Domains, which they tin usage to nonstop crypto to others.

“We’re truly trying to connection thing that is genuinely a amended mousetrap for immoderate Web3 user,” Kresus CEO Trevor Traina told Cointelegraph. “Where you tin determination each of your things from aggregate places into 1 place, person it beryllium precise accessible but highly unafraid […] but besides a gateway portal for radical who aren’t comfy yet connected Web3 due to the fact that they’re terrified they’ll beryllium locked out.”

The Kresus squad stated that due to the fact that of the mode Magic infrastructure works, neither they nor the Magic improvement squad are capable to spot the user’s backstage cardinal during relationship instauration oregon login, truthful they cannot marque unauthorized transactions.

The Web3 app developer closed a $25 cardinal backing round to enactment the improvement of its alleged SuperApp successful March.

Web3 superapp @Kresusofficial raised $25M successful a Series A backing circular led by @LCVentures, with information from @FTI_US and JetBlue Ventures.https://t.co/ymXkN5DBAx pic.twitter.com/Cgw30Hvimo

— Crypto Fundraising #StandWithUkraine (@Crypto_Dealflow) March 7, 2023

Kresus is not the lone wallet to connection seedless onboarding done Magic SDK. Web3 gaming institution Immutable told Cointelegraph that it is besides processing a seedless wallet called “Immutable Passport” that uses the aforesaid infrastructure. Passport volition enactment connected the Immutable X and Immutable zkEVM networks and volition beryllium utilized to onboard players of Immutable’s Web3 games, specified arsenic Gods Unchained and Guild of Guardians.

View source