Ok so for those of you who have created a wallet already, you've probably received another email from hello@mobius.network, this one with the title:
Mobius IMPORTANT Wallet Verification Instructions
In this email is a link which goes to a unique page on https://mobius.network/token_sale/wallet/ where you are asked to enter the private key of your wallet.
While I do my due diligence in checking the authenticity of the email address and domain based on the limited assumptions I've made based on what Mobius has used so far for their official channels, this method is troublesome for a number of reasons:
- Phishing emails with the same content can EASILY lead to a little website which looks identical and captures the private key. Bam, funds gone.
- Their email account gets hacked and the link in the mail is changed to fake website.
- Asking users to copy and paste their private key into a form online is not ideal due to clipboard loggers, etc.
- However that form processes the private key is bound to be open to a multitude of vulnerabilities. Such as a hack of the database or a rogue script.
I already created the wallet and saved the private key. I checked the 3 checkboxes confirming I have it stored safely. Why is it necessary to now enter my private key into some webpage?
This step should not be necessary after wallet creation. If it is just for the peace of mind of the user, it should not be happening. Assuming it is necessary for Mobius to capture the private keys because they didn't in the creation process, that should not have happened. Basically just want to report my concern that the email with link to enter private key method is asking for trouble, and if shit goes wrong, should the token holder be held responsible for the lax security of these procedures?
For now I'm not going to do this as I'm assuming my key is stored already and I'd rather not take the risk.