Internet Identity Lack Of Security

No, if you have staked with II then you can’t change that. Maybe a future upgrade to the NNS will allow changing the controller of neurons. If that happened then you could change it. But I don’t know when or if that will ever happen. The reason that the neuron controller cannot be changed is so that neurons can’t be sold. That’s something the community has to decide if it wants to continue to prevent the sale of neurons and how. If someone comes up with mechanisms that allow to change the controller of a neuron while at the same time preventing a sale then changing the controller can be allowed.

Anyway, to your question what to do now in the short term. If you already have staked a significant amount with II then I would suggest the following:

Take a dedicated laptop for managing your neurons. Here, “managing” means changing dissolve delays, dissolving, disbursing, spawning. Those actions should happen infrequently. “Managing” does not mean voting. For voting you can configure a hotkey and you can vote from your everyday phone/laptop. The dedicated laptop can be old. If it is so old that it does not have a biometric sensor then you can use a Yubikey with it or you can type in the recovery phrase every time you need to manage your neurons. What is important is that you don’t use the dedicated laptop for anything else than opening a browser and going to nns.ic0.app. That way you can get almost as secure as with quill or a hardware wallet. The more you restrict the laptop the better. The security is gradual. You could for example, configure a dedicated Wifi network in your router and let that dedicated laptop be the only device connected to it, so that your dedicated laptop and your everyday devices don’t share the same Wifi, etc.

This unfortunately also means to create a second II for every day use. Don’t log in with the II that control the neurons on any other devices than your dedicated laptop.

You can configure your second II for every day use as the hotkey of the neurons. That way you can vote and monitor from your everyday devices.

In the medium term, you should request the feature to allow hotkeys for the “merge maturity” action. I understand that is the main reason why people want to manage their neurons frequently. Some people are merging daily. The easiest answer to that would be to allow hotkeys to trigger the merging. Or, alternatively, an auto-merge feature that you only have to enable once would also work. I think auto-merge is already being worked on.

In the medium term you can also push for improvements to the II that you started with. But please understand that over the dedicated laptop it will be a relatively small security gain.

4 Likes