<p>Depending on the nature of the implementation, yes.</p>

<p>If you are considering hosted wallets such as exchanges, then yes - an MITM that is able to bypass SSL protections, a fairly common implementation on many corporate and organizational networks, will trivially be able to change data.</p>

<p>Certain wallets work around this by either storing the private keys locally and signing information retrieved from a remote server (such as metamask, or ledger live), which might still be susceptible to an MITM on the information being retrieved, or by using a local secret to sign requests to the remote server, which prevents in flight modification without detection.</p>

<p>Wallets further work around that by using systems such as the SPV protocol to both retrieve and verify data prior to signing it.</p>

CC BY-SA 4.0
2020-02-28T18:19:58.367Z
You should always download a wallet and make sure this wallet does not require you to sign up and give any information.

A secure wallet will generate the 12 to 24 word mnemonic phrase and tell you to back it up.
ecavero
CC BY-SA 4.0
2020-02-20T10:35:53.913Z
2020-02-20T10:35:53.913Z
Raghav Sood
<p>i have a question: in the web wallets(hosted wallets)when user want to make a transaction and send the information to the wallet server , can a one change the information(man in the middle attack)?</p>

<transactions><wallet><wallet-security>
MITM attack in hosted wallets
john
# MITM attack in hosted wallets

(Asked by: username_0 on 2020-02-20)

i have a question: in the web wallets(hosted wallets)when user want to make a transaction and send the information to the wallet server , can a one change the information(man in the middle attack)?

**Tags:** transactions, wallet, wallet-security


---

## 1 answers

### Answer by username_1 on 2020-02-20. Score: 1 | Accepted answer

Depending on the nature of the implementation, yes.

If you are considering hosted wallets such as exchanges, then yes - an MITM that is able to bypass SSL protections, a fairly common implementation on many corporate and organizational networks, will trivially be able to change data.

Certain wallets work around this by either storing the private keys locally and signing information retrieved from a remote server (such as metamask, or ledger live), which might still be susceptible to an MITM on the information being retrieved, or by using a local secret to sign requests to the remote server, which prevents in flight modification without detection.

Wallets further work around that by using systems such as the SPV protocol to both retrieve and verify data prior to signing it.

> **Comments:**
> **username_2**: You should always download a wallet and make sure this wallet does not require you to sign up and give any information.  A secure wallet will generate the 12 to 24 word mnemonic phrase and tell you to back it up.  

---

