Quote from: realstarlord on July 24, 2017, 10:17:46 AM

Quote from: ngin-x on July 24, 2017, 05:14:45 AM

Quote from: afrorc on July 23, 2017, 05:22:09 PM

Quote from: ngin-x on July 22, 2017, 06:39:19 AM

Quote from: blg42598 on July 22, 2017, 06:10:59 AM

This doesn't look good. Still time to fix this, but I'm surprised there was no urgency even when they knew about it

After getting the above response, I asked the devs when the new version of the web wallet will be released. No response so far. I'll post here if I get any.

This needs to be fixed on an urgent basis. After what happened with Parity hack, I don't think I can sleep easy until this is fixed.

Shift also needs a desktop lite client. Web wallets cannot be trusted.

No answer about it yet ?

Nope.

This is the response a dev named Ralph S gave the Ryder forum a few days ago.

Some of you mentioned this post about a warning for LSK, SHIFT, RISE.
https://boards.4chan.org/biz/thread/2836956

There is no reason to panic, we are aware of that API endpoint and the security risk this could cause. They do have a point, and it is important to repeat: ALWAYS use the OFFICIAL https wallet, if you are not running your own node!
No need to say that we NEVER log input. Some users who lost their keys wish we would though.

We do have a fix for this, to be released in the next wallet update. Where we don't use this endpoint at all, and sign transactions at the client side to broadcast to our main nodes.
That way your private keys are safe, because they aren't sent at all. You can compare it to the way MyEtherWallet works.

We hope this explains the case and answers your questions.

Why are you copy pasting Ralph's response everywhere? Your answer is not relevant to the question asked.