Are Ethereum contract function securable

Question

I am using testrpc and web3.

I used the idiom below to ensure that only a previously defined user should be able to do something:

function doSomethingProtected() {
        if ( msg.sender != authorizedUser )
                throw;

        flagSomething = true;
   }

When calling the function on an instantiated contract with web3 as follows:

myContract.doSomethingProtected( { from: "0x..." } );

it worked. At first I was pleased but then I realized the web3 API had not required me to provide any passphrase for a private key or such like.

Can anyone with the simple knowledge of someones public key/address call this function?

The use of this idiom in the examples led me to believe a benefit of the Ethereum contracts was that it ensured msg.sender was cryptographically assured.

Answer 1

The reason is that you are using testRPC, which doesn't lock it's accounts, so you don't need a password.

If you were to do this with geth, you would need to unlock the account before sending from it.

Without the private key, that function will throw an error, so you are correct in using that authorization method.