<p>I would argue the Yoroi browser extension is much safer than the iOS application.</p>
<p>Browser extensions provides double-sandboxing and is considered safer than most of the desktop applications. The browser itself is sandboxed from the rest of your computer and the extensions itself is sandboxes from talking directly to other extensions or to other websites unless you explicitly approves it can do so.</p>
<p>That being said, the most important element in the this process are your private keys. So, whatever you are using Daedalus or Yoroi, always protect your private keys by using a hardware wallet.</p>

CC BY-SA 4.0
2021-05-01T13:15:50.853Z
I'm not too sure about this. iOS has a ton of control around it, whereas the user can install any browser extension and the browser is exposed to _much_ more than a standard app. 

All code in the iOS app/browser extension being equal. iOS apps are probably closest to a hardware wallet you can get (assuming the device is not rooted). 

I'm not an iOS or Apple user myself.
DaedelusDaemon
CC BY-SA 4.0
2021-05-01T17:14:12.703Z
My argument was mostly around the fact, that the browser extension is sandboxed. If he is using the Yoroi official website, the user should be fine, which cannot be said about the official iOS app store, that has recently officially approved and listed a scam Trezor application and someone lost $1M+ of BTC to it. https://coingeek.com/man-loses-btc-worth-1m-to-fake-trezor-app/
Marek Mahut - StakeNuts
CC BY-SA 4.0
2021-05-02T10:26:21.057Z
You make interesting points about browser extension sandboxing. Thanks for the useful info. It still seems there is a contradiction between the cybersecurity guidelines page for Cardano (and general safety recommendations I see around the web), and the recommendation to install a wallet via a browser extension.
a-fro
CC BY-SA 4.0
2021-05-02T11:15:09.637Z
@a-fro oh, actually that page is only about Daedalus, which is a specific wallet software and is a full-node wallet. On the other hand, Yoroi is a light-weight wallet.
Marek Mahut - StakeNuts
CC BY-SA 4.0
2021-05-04T10:00:23.793Z
@MarekMahut-StakeNuts I understand that the page is about Daedalus, but that's part of what's confusing. It's called "Cybersecurity Guidelines for Cardano Users", is written by IOHK, only discusses Daedalus, and recommends "If possible, have a dedicated machine for your cryptocurrency activities...Ideally, you won’t use that machine to surf the web, read emails, download software, etc." If I'm not a security expert, but trying to understand how to be safe with my Ada, this page and its advice confuses me in relationship to the support recommendation to install Yoroi in a browser.
a-fro
CC BY-SA 4.0
2021-05-06T13:14:36.193Z
actually, iOS apps are sandboxed too https://support.apple.com/en-gb/guide/security/sec15bfe098e/web#:~:text=All%20third%2Dparty%20apps%20are,making%20changes%20to%20the%20device.&text=Most%20iOS%20and%20iPadOS%20system,is%20mounted%20as%20read%2Donly.
vaz
CC BY-SA 4.0
2021-05-01T12:37:41.473Z
2021-05-01T12:37:41.473Z
Marek Mahut - StakeNuts
<p>Keep in mind that in the future IOG is planning to have lightweight version of Daedalus. For now Yoroi is very convinient and in terms of security is in the same level as Daedalus.</p>
<p>In fact Charles Hoskinson discussed that is debatable if they did a mistake by going in the current direction with Daedalus instead of implementing mobile lightweight solution as Yoroi.
IOG is planning to have not only browser and lighweight desktop client but also Daedalus mobile version for Android and iOS.</p>
<p>For many of my friends is very hard to use the current version of Daedalus and from usability point of view Yoroi is the only option.</p>

CC BY-SA 4.0
2021-05-03T06:14:08.880Z
2021-05-03T06:14:08.880Z
Petar Enchev
<p>I received an IOHK support ticket response this week that recommended I install the Yoroi wallet:</p>
<blockquote>
<p>The Daedalus wallet is a full-node wallet, so it can take time to
install and can be difficult to use depending on your machine and your
network connection. We have a light wallet that is a chrome extension,
which is easy to install and use. You can find more info at
<a href="https://yoroi-wallet.com/#/" rel="nofollow noreferrer">https://yoroi-wallet.com/#/</a>.</p>
</blockquote>
<p>This statement appears to be in direct conflict with their article on <a href="https://iohk.zendesk.com/hc/en-us/articles/900005141163" rel="nofollow noreferrer">Cybersecurity Guidelines for Cardano Users</a>. Of course, that article is about Daedalus, but for the end user, it seems confusing. Honestly, I was a bit baffled by the contradiction. I thought Yoroi was primarily an iOS app. Even in Apple's locked down ecosystem, I was having doubts about installing and using it. But as a <em>browser extension</em>? How is that safe enough for them to recommend?</p>

<wallet><security><yoroi>
Is Yoroi secure as a primary wallet?
# Is Yoroi secure as a primary wallet?

(Asked by: username_0 on 2021-05-01)

I received an IOHK support ticket response this week that recommended I install the Yoroi wallet:

> The Daedalus wallet is a full-node wallet, so it can take time to
> install and can be difficult to use depending on your machine and your
> network connection. We have a light wallet that is a chrome extension,
> which is easy to install and use. You can find more info at
> <https://yoroi-wallet.com/#/>.

This statement appears to be in direct conflict with their article on [Cybersecurity Guidelines for Cardano Users](https://iohk.zendesk.com/hc/en-us/articles/900005141163). Of course, that article is about Daedalus, but for the end user, it seems confusing. Honestly, I was a bit baffled by the contradiction. I thought Yoroi was primarily an iOS app. Even in Apple's locked down ecosystem, I was having doubts about installing and using it. But as a *browser extension*? How is that safe enough for them to recommend?

**Tags:** wallet, security, yoroi

---

## 2 answers

### Answer by username_1 on 2021-05-01. Score: 7

I would argue the Yoroi browser extension is much safer than the iOS application.

Browser extensions provides double-sandboxing and is considered safer than most of the desktop applications. The browser itself is sandboxed from the rest of your computer and the extensions itself is sandboxes from talking directly to other extensions or to other websites unless you explicitly approves it can do so.

That being said, the most important element in the this process are your private keys. So, whatever you are using Daedalus or Yoroi, always protect your private keys by using a hardware wallet.

> **Comments:**
> **username_2**: I'm not too sure about this. iOS has a ton of control around it, whereas the user can install any browser extension and the browser is exposed to _much_ more than a standard app.   All code in the iOS app/browser extension being equal. iOS apps are probably closest to a hardware wallet you can get (assuming the device is not rooted).   I'm not an iOS or Apple user myself.  
> **username_1**: My argument was mostly around the fact, that the browser extension is sandboxed. If he is using the Yoroi official website, the user should be fine, which cannot be said about the official iOS app store, that has recently officially approved and listed a scam Trezor application and someone lost $1M+ of BTC to it. https://coingeek.com/man-loses-btc-worth-1m-to-fake-trezor-app/  
> **username_0**: You make interesting points about browser extension sandboxing. Thanks for the useful info. It still seems there is a contradiction between the cybersecurity guidelines page for Cardano (and general safety recommendations I see around the web), and the recommendation to install a wallet via a browser extension.  
> **username_1**: @a-fro oh, actually that page is only about Daedalus, which is a specific wallet software and is a full-node wallet. On the other hand, Yoroi is a light-weight wallet.  
> **username_0**: @MarekMahut-StakeNuts I understand that the page is about Daedalus, but that's part of what's confusing. It's called "Cybersecurity Guidelines for Cardano Users", is written by IOHK, only discusses Daedalus, and recommends "If possible, have a dedicated machine for your cryptocurrency activities...Ideally, you won’t use that machine to surf the web, read emails, download software, etc." If I'm not a security expert, but trying to understand how to be safe with my Ada, this page and its advice confuses me in relationship to the support recommendation to install Yoroi in a browser.  
> **username_3**: actually, iOS apps are sandboxed too https://support.apple.com/en-gb/guide/security/sec15bfe098e/web#:~:text=All%20third%2Dparty%20apps%20are,making%20changes%20to%20the%20device.&text=Most%20iOS%20and%20iPadOS%20system,is%20mounted%20as%20read%2Donly.  

---

### Answer by username_4 on 2021-05-03. Score: 2

Keep in mind that in the future IOG is planning to have lightweight version of Daedalus. For now Yoroi is very convinient and in terms of security is in the same level as Daedalus.

In fact Charles Hoskinson discussed that is debatable if they did a mistake by going in the current direction with Daedalus instead of implementing mobile lightweight solution as Yoroi.
IOG is planning to have not only browser and lighweight desktop client but also Daedalus mobile version for Android and iOS.

For many of my friends is very hard to use the current version of Daedalus and from usability point of view Yoroi is the only option.


---

