A user needs to check their NFT portfolio while at a coffee shop, or monitor a liquidity position from a shared office computer. Rabby Wallet’s availability as a browser extension and mobile app makes these scenarios tempting, but the question is not whether the wallet works in those environments. The question is whether using a self-custodial wallet on untrusted networks or devices introduces risks that the wallet’s built-in security features cannot fully mitigate, and what practical precautions actually reduce exposure.
Rabby Wallet offers transaction simulation, pre-sign security checking, and risk alerts designed to catch suspicious activity before it happens. These features are valuable, and they operate on the device itself. But a device connected to public WiFi, a shared computer with multiple user accounts, or a system that has been compromised by malware faces threats that originate outside the wallet’s architecture. Understanding which threats Rabby’s security model addresses and which ones remain the user’s responsibility is essential for deciding when it is safe to interact with your wallet, and when abstinence is the better choice.
What Rabby Wallet’s security checking actually protects
Rabby’s transaction simulation and pre-sign security checking run on the user’s device before any transaction is broadcast to the blockchain. The wallet analyzes the transaction, predicts balance changes, identifies suspicious contract interactions, and alerts the user to potential risks. This is a meaningful layer of protection because it prevents one broad category of error: approving a transaction without understanding what it does. If a deceptive interface or phishing site presents a malicious approval, Rabby’s preview can reveal that the user is about to transfer all holdings to an unknown address, not simply approve a small amount to a trusted protocol.
The security features do not, however, protect against every threat that exists on a public network or shared device. They assume the user’s device is not compromised, that the browser extension has not been replaced with a malicious version, and that the user themselves is not being monitored or coerced. These assumptions hold in many ordinary situations. They break down when the attack originates from the network, the operating system, another user with local access, or malware.
The distinction matters because Rabby’s security model is local and defensive: it prevents the user from approving the wrong transaction. It does not prevent a keystroke logger from recording the private key or recovery phrase. It does not encrypt traffic to arbitrary services the wallet might contact. It does not isolate your session from other users on a shared computer who might run their own malicious code. Rabby Wallet’s protection is powerful within its scope, but its scope is narrower than a user might initially assume.
Public WiFi risks and why they persist despite good wallet design
Public WiFi networks, especially unsecured ones without WPA3 encryption, allow an attacker to intercept traffic between a device and external services. An open network at an airport or café makes it possible for someone to observe which websites a user visits, which addresses they query, and metadata about their behavior. This does not immediately compromise a self-custodial wallet because Rabby stores the private key locally and does not transmit it over the network. Signing transactions happens on the device, not on a server.
The practical risks on public WiFi are more subtle. A network attacker can intercept DNS requests and redirect a user to a phishing website that mimics Rabby’s interface or a service the user intends to interact with. They can inject code into unencrypted HTTP traffic, though most legitimate services now enforce HTTPS. They can observe which Ethereum addresses the user is querying, which NFTs they are viewing, and which services they are interacting with. Over time, this metadata can build a profile: a user who frequently checks a particular address, queries the same tokens, and transacts at predictable times becomes easier to target or surveil.
The mitigation is not to abandon Rabby or crypto wallets entirely on public networks. The mitigation is to reduce the amount of identifying information exposed. Use a VPN that encrypts traffic before it reaches the public network, reducing what a network eavesdropper can see. Limit activities to viewing balances or monitoring positions rather than initiating transactions. Use Tor for additional network privacy if the service is compatible. Most importantly, avoid public WiFi when initiating transfers, approving high-value transactions, or using connected services that already have your identity.
Shared computers and the problem of local access
A shared office computer, library terminal, or family device introduces a different threat than a public network. Other users with accounts on that machine can, depending on the operating system and configuration, inspect browser extension storage, access browser auto-fill data, or install their own monitoring tools. If you use Rabby Wallet on a Windows machine shared with a roommate, that person might be able to access the browser profile folder where the extension stores data, or use administrative tools to capture keyboard input.
The operating system is the relevant boundary here. Windows and macOS both provide some user isolation: files belonging to one user account are typically not readable by others without administrative privilege. But if someone has administrative access to the machine, or if the browser profile is not protected, the isolation fails. Linux with proper file permissions can offer stronger isolation, but only if permissions are configured correctly. A user account without a strong password is also inadequate, because physical access to an unattended computer makes it easy to log in and remain undetected.
Rabby Wallet does not run in a sandbox that prevents other processes from inspecting its memory or storage. A keylogger installed by another user, or by malware that has already compromised the machine, can record everything typed, including seed phrases if they are manually entered or copied to clipboard. The pre-sign security checking does not prevent this because the threat is not a malicious transaction on the blockchain. The threat is a compromised device that captures secrets before they reach the wallet.
The mitigation is to avoid using shared computers for wallet operations entirely, or to use the computer only for viewing read-only information. If you must use a shared device, use a hardware wallet connected to the computer instead of allowing the device to store the private key. Or use a watch-only wallet in Rabby to monitor positions without exposing the ability to sign transactions. The security model of a shared computer is fundamentally incompatible with self-custodial operations unless additional isolation is enforced.
Browser extension vulnerabilities and extension installation hygiene
Rabby is distributed as an open-source browser extension available from official channels including the Chrome Web Store and rabby.io. The open-source nature means the code can be audited, and official distribution reduces the risk of installing a backdoored version. However, risks remain. A malicious actor could theoretically create a nearly identical extension with a name like “Rabby Wallet Pro” or “Rabby Finance” and distribute it through the same channels, banking on users missing the distinction. This attack has succeeded for other wallet extensions in the past.
Additionally, a compromise of the official distribution channel, or an update that introduces a vulnerability, could put users at risk. Browser extensions have access to sensitive data including the ability to observe which websites you visit, intercept traffic, and modify page content. An attacker who compromises an extension can potentially steal private keys or intercept approvals. This is not a theoretical threat: wallet extensions have been targeted by supply-chain attacks and vulnerabilities have been discovered and patched.
The user’s responsibility is to verify the source before installation. Install only from official channels, verify the publisher name carefully, check the number of downloads and reviews, and inspect the extension’s source code if you have the technical capability. After installation, review the extensions list periodically to confirm that unexpected extensions have not been added. If you suspect compromise, remove the extension, verify that your funds are intact using a different device and wallet, and if necessary, move assets to a new address using a hardware wallet or a device you trust.
A rabby wallet installed from the official Chrome Web Store is significantly lower-risk than one installed from an arbitrary website, but it is not risk-free. The extension has permission to observe all websites you visit while logged in, unless you restrict it using browser settings. Consider setting the extension to “run on click” rather than running on all sites, which reduces its exposure surface.
Rabby wallet setup and the recovery phrase problem
When setting up Rabby Wallet, a user generates a recovery phrase (seed phrase) that grants access to all private keys and funds. This phrase is the single point of failure for the entire wallet. If an attacker obtains it, they can recover the wallet on another device and transfer all assets. The security of this phrase depends entirely on how it is stored and who has access to it.
On a public computer or shared device, writing down or copying the recovery phrase is particularly risky because the device may be monitored or compromised. Some shared devices have password managers or auto-fill services that could accidentally store the phrase. The browser itself might cache or log data. A user who sees the recovery phrase appear on a public computer has already failed the critical security checkpoint.
The correct procedure is to generate the recovery phrase on a device you trust, write it down on paper (never digitally on that same computer), and store the paper in a secure location. If you have already used Rabby Wallet on a shared device and have not used a hardware wallet, consider the device compromised and move assets to a new address using a different, trusted device. Do not attempt to migrate by exporting the recovery phrase and importing it on another device; assume the phrase may have been captured by monitoring software.
For users who want to use Rabby Wallet securely on occasional devices, hardware wallet integration is the answer. Rabby Wallet supports hardware wallets such as Ledger and Trezor. With hardware wallet integration, the device itself does not store the private key. Instead, signing happens on the hardware wallet, which remains isolated even if the computer is compromised. This is the most practical way to use Rabby Wallet on shared or untrusted computers because the threat model changes fundamentally.
Network observation and address privacy
When using Rabby Wallet, the wallet connects to blockchain nodes and services to fetch balances, transaction history, and NFT data. Depending on the configuration, these requests may reveal which addresses the user is interested in. A network observer on public WiFi, or an ISP, can see that you queried a specific Ethereum address even if they cannot see the transaction details on the blockchain itself.
This is not unique to Rabby; it applies to any wallet or blockchain explorer. The mitigation is to use a VPN that hides your IP address and encrypts the traffic to the node or service. Configure Rabby to use a custom RPC endpoint that you trust, or one run through Tor. For very high-privacy scenarios, combine these measures: VPN plus Tor plus a private node. This adds latency and may not be practical for frequent checking, but it reduces the information leaked about which addresses you control.
The default Rabby Wallet setup uses public RPC endpoints that are not encrypted by default. A user who cares about address privacy should enable encryption or use a VPN. A user on public WiFi should use both. This is not a flaw in Rabby’s design; it reflects the reality that blockchain networks are public and queries about addresses can be observed.
Device-specific hardening and practical guidelines
If you need to use Rabby Wallet on a device you do not fully control, follow these layers of defense. First, use a separate browser profile or user account dedicated to crypto activity if the operating system supports it. This reduces cross-contamination from other activities on the machine. Second, use a VPN and enable all available privacy options in the browser. Third, use hardware wallet integration if possible rather than storing the private key on the device. Fourth, limit the time the wallet is active and logged in. Fifth, never enter the recovery phrase on a shared device under any circumstances.
On a personal device, hardening is simpler but still necessary. Keep the operating system and browser updated. Disable unnecessary browser extensions and permissions. Use strong, unique passwords and enable multi-factor authentication on any associated accounts. Periodically audit the list of installed extensions and installed applications. Use antivirus software if available, though it is not a substitute for safe behavior.
For frequent traders or those holding significant value, a dedicated device is the most practical choice. An older laptop or phone used only for crypto reduces the attack surface and the amount of unrelated software that might be compromised. This device should be secured with a strong password, updated regularly, and not used for general browsing or email. It is more secure than shared devices, but still less secure than a hardware wallet for the most critical operations like recovery or high-value transfers.
When to avoid Rabby Wallet on untrusted networks and devices
The safest rule is to never conduct sensitive wallet operations on public WiFi or shared computers. This means never initiating transfers, never approving contracts with significant allowances, never entering recovery phrases, and never managing critical accounts. Use these devices only for read-only activities: checking balances, viewing transaction history, or monitoring positions. If you need to transact, wait until you reach a trusted network and trusted device.
The risk scales with the value at stake and the sensitivity of the operation. Checking an NFT collection balance on public WiFi is low-risk if you accept the address privacy implications. Approving a new protocol on a shared device is medium risk and requires careful review of what you are approving. Importing a recovery phrase or accessing a large account is high risk and should only happen on a device you trust completely. Moving significant amounts of cryptocurrency should happen on a private network, ideally with a hardware wallet present for signing.
Rabby Wallet’s transaction simulation and security checking are valuable tools that reduce certain risks. They do not eliminate the risks posed by compromised networks or shared devices. Use Rabby Wallet safely by understanding its threat model, using it primarily on trusted devices, and reserving untrusted networks and devices for monitoring only. This discipline is more effective than any single security feature the wallet can provide.
Frequently asked questions
Can I safely use Rabby Wallet on public WiFi if I am only checking my balance?
Checking a balance on public WiFi is relatively low-risk because no transaction is being signed. However, your network traffic reveals which addresses you are interested in. Use a VPN to encrypt this information. Never initiate transfers or approve contracts on public WiFi, regardless of whether you use Rabby Wallet or another wallet.
What is the safest way to use Rabby Wallet on a shared computer?
The safest approach is to use a watch-only wallet in Rabby that only displays balances without storing the private key. For signing transactions, use hardware wallet integration, which keeps the private key off the shared device. Never enter your recovery phrase on a shared computer.
Does Rabby Wallet’s security checking protect against malware?
Rabby’s pre-sign security checking prevents many on-chain attacks by warning you about suspicious transactions before you approve them. It does not protect against malware that steals your recovery phrase or keystrokes. Protection against malware depends on the device itself being secure, not on the wallet application.
Should I use Rabby Wallet on a public computer if I encrypt it with a password?
A password on Rabby Wallet protects your account within the browser, but it does not protect against malware, keyloggers, or other users with administrative access to the shared computer. If the device is compromised, your password is insufficient. For shared devices, use hardware wallet integration or watch-only wallets instead of storing secrets on the device.
