4 ms·

I've been playing around with creating a few dapps here and there and I do have to say I really enjoy being able to use wallets as a proof of identity rather th

I've been playing around with creating a few dapps here and there and I do have to say I really enjoy being able to use wallets as a proof of identity rather than hooking in a dedicated authentication server. I haven't created anything to scale yet but I think simply using wallets instead of relying on oauth for simple applications is really lowering the amount of time I have to put up front into creating proof of concept applications. Also, I really do think that NFT ownership serving as an access token into a service is a very neat feature that we'll start to see more of as people start getting more creative with NFTs instead of simply being an art asset. There's a lot there and we're barely scratching the surface imo.

albertgoeswoof 5y ago
The auth thing is great! But from the end user and the developer perspective there’s no difference between an oauth provider and a wallet. You still have to set it up on the machine and “login”, same for the app developer
- shiohime 5y ago
  Yeah, they are comparable, but there is definitely a difference, from both an end user, and developer. The flow is similar - you have to have a wallet, and you have to authenticate it. But really, that's about it. From an end user perspective, all I need to do is press a button to connect my wallet, and I'm in. The site doesn't even need to reload or hit a callback uri. It's a much simpler flow than any of the oauth authentication flows. Also, as anyone can create a wallet and it is not tied to any other identifying information, it's a breath of fresh air to have some vague sense of anonymity than hooking everything into a centralized email account. From a developer standpoint, all I need to do is use an API with a callback function that on success takes whatever data I need and update my application state appropriately. It really is smooth, and I don't need to do things like maintain session or handle access token expiration and request refresh tokens. I can sign messages on the frontend & verify signatures on the backend to ensure the user is who they claim to be. It's so simple compared to the stuff I had to implement in the corporate world for OAuth (granted, the projects I've been working on in the space are much less complex). If you want to try it out yourself as an end user, just download a wallet extension and check out an nft marketplace such as solanart or opensea. You simply have to connect, and that's it. I find it fascinating personally and it's one of the pieces of web3 that I'm most excited for. I believe we're going to continue to see a lot of innovation in the space.
Fiahil 5y ago
With most of the comments here criticizing blockchains, it's hard to get any meaningful discussion on the topic. Having set up a lot of SSO and other auth mechanisms, I think there is a good opportunity for a combination of NFT-access-token + WebAuthn [1]. The nice thing about that would be a secure login without email/passwords combination that you can access with your biometrics. Imagine the same flow as login with 1Password without having to fill the form. On the developer side, you don't have to setup the OIDC flow, database, or anything. You just rely on a generic service to provide you with a token. Less opportunity to mess it up, and it can work on localhost too. Now, would be the question of a similar exercise for authorization. [1] https://fr.m.wikipedia.org/wiki/WebAuthn https://fr.m.wikipedia.org/wiki/WebAuthn
- shiohime 5y ago
  I haven't thought of combining access tokens with biometrics, that could actually be pretty slick. I have no real exposure to WebAuthn, but yeah the more I work in the 3.0 space the more I think that NFTs are one the most misrepresented technologies I can imagine. I'm writing an app that utilizes NFT ownership to authorize access to a service, and it's been really easy to implement, though I'm certain I'll need to continue making improvements to it. But my theory is that I can sign a message with my wallet on the frontend using NaCl, send that message and the signature to my backend and verify it, then verify token ownership using RPC. My PoC implementations have been working pretty well, but I am not sure of any holes that may exist in this approach, so it's still a work in progress.
solarkraft 5y ago
I’ve used a basic version of OAuth before and found it very simple, so I’m amazed wallet authentication can even be simpler. How does the user prove they have the private key, do they make a verification transaction? From the user’s perspective I see the (dubious) benefit of being able to use the same key for your money and online accounts, but that’s about it …
- CuriousCosmic 5y ago
  You don't even need to make a transaction. Cryptocurrency based authentication mechanisms use the ledger as a "trust-less" root of trust. You know anything that's been on the ledger long enough is valid. From their all you need to do is authenticate with the same PKI that corresponds to said wallet. A simplified example: You own an NFT and want to prove that you own it. You can produce some chunk of data (not a transaction) that includes a reference to the NFT (be it the UTxO, Tx, or some hash) and sign it with the same key that owns the NFT (or a derivative key depending on the design of the system). Since it's not a transaction it doesn't cost anything to produce and you can share it with the interested parties however you wish. In a sense you can think of it like GPG (and GPG based SSH keys) except instead of the web of trust being a federated set of servers and key cross signing, it's a decentralised ledger. It's not simpler but it can be easier because it largely comes out of the box set up. The PKI is already well established and you don't need to really spin up or configure anything complicated to use it. You just launch a wallet with the supported features and it "just works".
- shiohime 5y ago
  I've been working on Solana and Ethereum dapps and it does rely on browser extensions at the moment (MetaMask or Phantom wallet for example). But basically they expose an API that lets you connect a wallet. In one app I'm working on right now in Solana, I'm able to connect in a one line api call (granted if I want to support other wallets I'll need to use an adapter npm module). Since you need to have the private key to set up a wallet, connecting is essentially "logging in". So really, I can make a website that lets you use a wallet with no money on it as authentication, if I wanted to, since it proves you are who you say you are unless your wallet's private keys are compromised.

albertgoeswoof 5y ago

The auth thing is great! But from the end user and the developer perspective there’s no difference between an oauth provider and a wallet. You still have to set it up on the machine and “login”, same for the app developer

shiohime 5y ago
Yeah, they are comparable, but there is definitely a difference, from both an end user, and developer. The flow is similar - you have to have a wallet, and you have to authenticate it. But really, that's about it. From an end user perspective, all I need to do is press a button to connect my wallet, and I'm in. The site doesn't even need to reload or hit a callback uri. It's a much simpler flow than any of the oauth authentication flows. Also, as anyone can create a wallet and it is not tied to any other identifying information, it's a breath of fresh air to have some vague sense of anonymity than hooking everything into a centralized email account. From a developer standpoint, all I need to do is use an API with a callback function that on success takes whatever data I need and update my application state appropriately. It really is smooth, and I don't need to do things like maintain session or handle access token expiration and request refresh tokens. I can sign messages on the frontend & verify signatures on the backend to ensure the user is who they claim to be. It's so simple compared to the stuff I had to implement in the corporate world for OAuth (granted, the projects I've been working on in the space are much less complex). If you want to try it out yourself as an end user, just download a wallet extension and check out an nft marketplace such as solanart or opensea. You simply have to connect, and that's it. I find it fascinating personally and it's one of the pieces of web3 that I'm most excited for. I believe we're going to continue to see a lot of innovation in the space.

Fiahil 5y ago

With most of the comments here criticizing blockchains, it's hard to get any meaningful discussion on the topic. Having set up a lot of SSO and other auth mechanisms, I think there is a good opportunity for a combination of NFT-access-token + WebAuthn [1]. The nice thing about that would be a secure login without email/passwords combination that you can access with your biometrics. Imagine the same flow as login with 1Password without having to fill the form. On the developer side, you don't have to setup the OIDC flow, database, or anything. You just rely on a generic service to provide you with a token. Less opportunity to mess it up, and it can work on localhost too. Now, would be the question of a similar exercise for authorization. [1] https://fr.m.wikipedia.org/wiki/WebAuthn https://fr.m.wikipedia.org/wiki/WebAuthn

shiohime 5y ago
I haven't thought of combining access tokens with biometrics, that could actually be pretty slick. I have no real exposure to WebAuthn, but yeah the more I work in the 3.0 space the more I think that NFTs are one the most misrepresented technologies I can imagine. I'm writing an app that utilizes NFT ownership to authorize access to a service, and it's been really easy to implement, though I'm certain I'll need to continue making improvements to it. But my theory is that I can sign a message with my wallet on the frontend using NaCl, send that message and the signature to my backend and verify it, then verify token ownership using RPC. My PoC implementations have been working pretty well, but I am not sure of any holes that may exist in this approach, so it's still a work in progress.

solarkraft 5y ago

I’ve used a basic version of OAuth before and found it very simple, so I’m amazed wallet authentication can even be simpler. How does the user prove they have the private key, do they make a verification transaction? From the user’s perspective I see the (dubious) benefit of being able to use the same key for your money and online accounts, but that’s about it …

CuriousCosmic 5y ago
You don't even need to make a transaction. Cryptocurrency based authentication mechanisms use the ledger as a "trust-less" root of trust. You know anything that's been on the ledger long enough is valid. From their all you need to do is authenticate with the same PKI that corresponds to said wallet. A simplified example: You own an NFT and want to prove that you own it. You can produce some chunk of data (not a transaction) that includes a reference to the NFT (be it the UTxO, Tx, or some hash) and sign it with the same key that owns the NFT (or a derivative key depending on the design of the system). Since it's not a transaction it doesn't cost anything to produce and you can share it with the interested parties however you wish. In a sense you can think of it like GPG (and GPG based SSH keys) except instead of the web of trust being a federated set of servers and key cross signing, it's a decentralised ledger. It's not simpler but it can be easier because it largely comes out of the box set up. The PKI is already well established and you don't need to really spin up or configure anything complicated to use it. You just launch a wallet with the supported features and it "just works".
shiohime 5y ago
I've been working on Solana and Ethereum dapps and it does rely on browser extensions at the moment (MetaMask or Phantom wallet for example). But basically they expose an API that lets you connect a wallet. In one app I'm working on right now in Solana, I'm able to connect in a one line api call (granted if I want to support other wallets I'll need to use an adapter npm module). Since you need to have the private key to set up a wallet, connecting is essentially "logging in". So really, I can make a website that lets you use a wallet with no money on it as authentication, if I wanted to, since it proves you are who you say you are unless your wallet's private keys are compromised.