I'm a full stack developer and a early investor (2nd week). I like Lisk because of  JavaScript as main language. I have just started looking at the dapp development, noticed some serious security concerns with dapp development.

My understanding with dapps is (correct me if I'm wrong), a dapp is hostable component that exposes an http external api and is capable of doing some transactions (withdrawals and deposits). Every dapp can be hosted within in some sidechain. Users can access dapp functionality with the help of exposed api by passing secret and transaction info. It means you have to pass your pass phrase to every dapp you want to do a transaction lets say a withdrawal (paying to dapp owners).

Apple, Microsoft, and google stores are centralized. Every app has to go rigorous review process before getting published in stores ( I published few apps in google and windows stores). The review process mainly includes scanning for malicious code that exposes user phone to external attackers.

Situation 1:

Lisk has no such review process but the code can be viewed by others. Lets say if dapp included with some malicious code that records pass phrases somewhere (not in the dapp), lisk-cli just creates a foundation base for dapp development and users extends it with their own api. How lisk prevents user from accessing dapp and removes from store if malicious code found.  

Situation 2:

Lisk dapps and their sidechains can be hosted by third party entities. Lets say owner setup two VMS. One with actual sidechain with clean dapp code internally and installed a reverse proxy on another VM(that sits on external point and forwards request to internal VM that hosted dapp). The reverse proxy receives the request from user first and records pass phrase and then forwards same request to internal VM without modifying request headers.

Situation 3:

Man in the middle attacks.

If the dapp owner not hosting sidechain with SSL, How Lisk ensures user data not compromised.

Just wondering how lisk handles these situations and prevents owner from misusing pass phrases. Last year, I encountered similar issue with NXT and lost around 10K coins. I used a remote nxt web node to check my transactions frequently. I suspect they recorded my pass phrase and transferred my 10k to theirs account.

I think users shouldn't be forced to send pass phrases to dapp owners, its like sending your BTC private keys to others.

when will this trade and launch ?

Finally, nice to see a post for a change that is actually about the technology and not price speculation.

I am also interested in learning more about lisk Security.

Anyone who can address these questions?
@LiskHQ?

Great questions, I think I saw a similar discussion on Lisk chat about it (Situation 1).

so over 7mil was raised in the ico..   which a portion will be used to fund development of lisk.
may i suggest the devs hedge its value incase of bitcoin catastophy.

possibly something like this would be good idea.

50% vautoro gold
50% slit up over USDT, ETH, BTC.

just a thought..  as wouldnt want a btc crash, to also crash development of lisk.

I'll give you a vote!  I'll be running as "nextgencrypto".

Stability is the key!

2 and 3 does concern me a bit, I'll be waiting for Max's and Oliver's answer and maybe this can all be worked out,
or be worked ON if ever Hopefully Lisk will find a way

At the rate bankers are jumping out Windows and the cabal's failure to hijack Syria's banking system and oil,  I wouldn't use USD to hedge value at this point in time.   Gold fluctuates, but retains value through the ages.

Please someone tell me what is delegate Node and what is votes? Same like masternodes? Any link? Delegate node can earn LISKs?

Thank you!