SetPrivatekey is leaking private keys

[drwatson84]

Hi.
$tron->setPrivateKey('privateKey') is leaking private keys. There is an ongoing attack https://x.com/AbuShaheer4/status/1988550070808039821?s=19

Please use locally signed transactions to avoid this.

[ddv88]

I don't quite understand how this is related.

[stevenstc]

The documentation states that this function should not be used in user-facing web applications, but only on servers or in isolated applications, not in user-facing applications.

https://tronweb.network/docu/docs/API%20List/utils/setPrivateKey

[ddv88]

The documentation states that this function should not be used in user-facing web applications, but only on servers or in isolated applications, not in user-facing applications.

https://tronweb.network/docu/docs/API%20List/utils/setPrivateKey

yeah. and also don't film the interview against the background of stickers with passwords from corporate services.

[ExchangeAssets]

public function generateAddress(): TronAddress
    {
        $ec = new EC('secp256k1');

        // Generate keys
        $key = $ec->genKeyPair();
        $priv = $ec->keyFromPrivate($key->priv);
        $pubKeyHex = $priv->getPublic(false, "hex");

        $pubKeyBin = hex2bin($pubKeyHex);
        $addressHex = $this->getAddressHex($pubKeyBin);
        $addressBin = hex2bin($addressHex);
        $addressBase58 = $this->getBase58CheckAddress($addressBin);

        return new TronAddress([
            'private_key' => $priv->getPrivate('hex'),
            'public_key'    => $pubKeyHex,
            'address_hex' => $addressHex,
            'address_base58' => $addressBase58
        ]);
    }

Is this safe? GPT chat says weak keys are generated and the attacker already knows them.

[ExchangeAssets]

The fact is that funds have already been stolen twice.
All keys are generated and stored on the server.
This doesn't look like the server was hacked.
This is either a key leak in the library or a weak key was generated.