Unlock mechanism flaw mist opens 2 second unlock timout window.

[pat-kim]

Geth version: All verions
OS & Version: All operating systems

Expected behaviour:

From user perspective API call communication between mist and geth scheme does not allow man in middle attack.

Actual behaviour:
Mist calls geth in order to send tx with account unlocking for 2 second. Not likely other wallet singed tx itself and send before sending to the geth this allows man in middle attack via IPC and RPC while making a transaction by mist.

Steps to reproduce the behaviour:
Simple batch script successfully hijack transaction to IPC with default mist and geth settings.
Refer the following video.

https://www.youtube.com/watch?v=PNSwFy__m-8

[bas-vk]

Addressed in #2564.
Will leave this open to prevent duplicates.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.