Polygon Chief Security Officer Mudit Gupta has urged Web3 companies to hire traditional security experts to put an end to easily preventable hacks, arguing that perfect code and cryptography are not enough.
Speaking to Cointelegraph, Gupta outlined that several of the recent hacks in crypto were ultimately a result of Web2 security vulnerabilities such as private key management and phishing attacks to gain logins, rather than poorly designed blockchain tech.
Adding to his point, Gupta emphasized that getting a certified smart contract security audit without adopting standard Web2 cybersecurity practices is not sufficient to protect a protocol and user’s wallets from being exploited:
“I’ve been pushing at least all of the major companies to get a dedicated security person who actually knows that key management is important.”
“You have API keys that are used for decades and decades. So there are proper best practices and procedures one should be following. To keep these keys secure. There should be proper audit trail logging and proper risk management around these things. But as we’ve seen these crypto companies just ignored all of it,” he added.
While blockchains are often decentralized on the backend, “users interact with [applications] through a centralized website,” so implementing traditional cybersecurity measures around factors such as Domain Name System (DNS), web hosting and email security should always “be taken care of,” said Gupta.
“Those hacks had nothing to do with blockchain security, the code was fine. The cryptography was fine, everything was fine. Except the key management was not. The private keys […] were not securely kept, and the way the architecture worked was if the keys got compromised, the whole protocol got compromised.”
Gupta suggested that the current sentiment from blockchain and Web3 firms is that if “you fall for a phishing attack, it’s your problem,” but argued that “if we want mass adoption,” Web3 companies have to take more responsibility rather than doing the bare minimum.
“For us […] we don’t want just the minimum safety that keeps the liability away. We want our product to be actually safe for users to use it […] so we think about what traps they might fall into and try to protect users against them.”
Polygon is an interoperability and scaling framework for building Ethereum-compatible blockchains, which enables developers to build scalable and user-friendly decentralized applications.
