source avatarChai

Share

What actually happens to your private key when you tap 'Sign in with Google' to open a crypto wallet? Your "sign in with google" wallet rebuilds the private key on your device every time you log in. Google never holds that key. google only answers one question: is this person who they say they are? after that, a different system takes over. Here is what actually happens: Your key is split into 3 shares. any 2 rebuild it. Share A: on your device Share B: locked behind your login, kept in their storage Share C: recovery (password, backup, another device) When you tap "sign in with Google/Apple": 1. Google or Apple checks it's you and hands your app a login token. 2. Your app doesn't blindly send that token to one server. it first sends a hash of the token to their node network, waits until enough nodes have acknowledged it, then reveals the token. that's meant to stop a rogue node from grabbing your login and impersonating you. 3. Each node checks the token on its own and returns its piece of your encryption key. 4. More than half the nodes have to be honest for that encryption key to come back together. generating brand-new keys is stricter: more than three-quarters of the nodes have to be honest. their docs say they picked those thresholds on purpose. they'd rather the whole system fail than a thief reconstruct keys. 5. That encryption key unlocks share B from storage. 6. Share B plus share A, sitting on your device, rebuild the actual wallet private key. two points on a line, key at the crossing. the technical name is lagrange interpolation. 7. Now you can sign. when you log out, the reconstructed key is supposed to go away. next login, rebuild it again. So "no seed phrase" does not mean no key. it means someone else's network decides when you get your key back. That is the layer that broke in recent Keplr Hack. web3auth says the issue was in its own infrastructure and exposed keys for some keplr google/apple wallets. Social login is fine for airdrop dust. for money you would miss, use a seed you control, or hardware. Would you still keep real money in a social login wallet?

No.0 picture
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information. Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.