Cast by 10xchris.eth
Show the cast this replies toYo @balajis.eth the statement about entering seed phases caught my eye. So I asked Ai… “Is entering seed phrases safe in this context?” > No. I would strongly discourage entering your existing Farcaster seed phrase into a new or untrusted client. It's an unnecessary security risk, especially when the purpose is simply to authorise the client to post on your behalf. The concerning part of the prize announcement is: "The client should be able to import an existing seed phrase for an account that already has storage, use that seed phrase to issue the client its own app key..." This is technically possible, but it is not the security model I would recommend for onboarding users to a Farcaster client. Why this is dangerous… (see images) Cc @quazia
1 reply
Ai continued: > My assessment of the prize The competition itself is not necessarily malicious. It may be encouraging developers to demonstrate complete self-custodial account management. However, the wording encourages a potentially unsafe pattern, particularly if winners publish tutorials that normalise pasting seed phrases into unfamiliar applications. I would recommend: 1. Never enter your primary Farcaster seed phrase into a competition demo, unfamiliar website or downloaded script. 2. For testing, use a newly generated, disposable account with no valuable assets. 3. For production clients, require wallet-based signing and delegated app keys, preferably with limited permissions and expiration. 4. Review what you're signing, even when a client doesn't request your seed phrase. P.s: Why encourage seed phrase imports when the protocol already supports delegated signer authorisation without exposing the custody secret? CC @topocount.eth
