I believe the Achilles' heel of Web3 is really that is was built on Web1&2.
Whatever opinion you might have about this industry, the core work is done by the Bitcoin and Ethereum teams and it is pretty admirable. They have been progressing for 10 years in a system where any mistake can collapse the entire system.
But ultimately those wallets and Web3 apps are built with web technologies and run in a browser and this is just not made for this.
This hack was targeting seed phases or private key because the keys have to be stored in the browser extension. How insane is that? But there isn't really any other ways to do it within the framework of a web browser.
Ultimately if the extension or web app is compromised an hardware wallet cannot really ultimately protect you (at least you would only be compromised when interacting with it).
Ethereum also now built in the secp256r1 signature checker so passkey/yubikey can be used but, same problem the "web" is the weak link.
Bottom line if they want that thing to succeed they will have to create a way to interact with smart contracts outside of the web browser. Maybe it will take building a simpler "dapp browser". Their apps are pretty basic in the end, a TUI would be enough to swap a token and approve a transaction...
It's not true that seed phrases have to be connected to the web browser though. Take a look at Trezor. There is a web plugin but the keys never leave the hardware wallet. The issue is users prefer the convenience of not needing to use a HW wallet for the transaction signing, which leads to a plce where keys are stored in digital space and can be stolen.
Whatever opinion you might have about this industry, the core work is done by the Bitcoin and Ethereum teams and it is pretty admirable. They have been progressing for 10 years in a system where any mistake can collapse the entire system.
But ultimately those wallets and Web3 apps are built with web technologies and run in a browser and this is just not made for this.
This hack was targeting seed phases or private key because the keys have to be stored in the browser extension. How insane is that? But there isn't really any other ways to do it within the framework of a web browser.
Ultimately if the extension or web app is compromised an hardware wallet cannot really ultimately protect you (at least you would only be compromised when interacting with it).
Ethereum also now built in the secp256r1 signature checker so passkey/yubikey can be used but, same problem the "web" is the weak link.
Bottom line if they want that thing to succeed they will have to create a way to interact with smart contracts outside of the web browser. Maybe it will take building a simpler "dapp browser". Their apps are pretty basic in the end, a TUI would be enough to swap a token and approve a transaction...