3 ms·
With most of the comments here criticizing blockchains, it's hard to get any meaningful discussion on the topic. Having set up a lot of SSO and other auth mech
by Fiahil 5y ago
With most of the comments here criticizing blockchains, it's hard to get any meaningful discussion on the topic.
Having set up a lot of SSO and other auth mechanisms, I think there is a good opportunity for a combination of NFT-access-token + WebAuthn [1]. The nice thing about that would be a secure login without email/passwords combination that you can access with your biometrics. Imagine the same flow as login with 1Password without having to fill the form.
On the developer side, you don't have to setup the OIDC flow, database, or anything. You just rely on a generic service to provide you with a token. Less opportunity to mess it up, and it can work on localhost too.
Now, would be the question of a similar exercise for authorization.
[1] https://fr.m.wikipedia.org/wiki/WebAuthn https://fr.m.wikipedia.org/wiki/WebAuthn
- shiohime 5y agoI haven't thought of combining access tokens with biometrics, that could actually be pretty slick. I have no real exposure to WebAuthn, but yeah the more I work in the 3.0 space the more I think that NFTs are one the most misrepresented technologies I can imagine. I'm writing an app that utilizes NFT ownership to authorize access to a service, and it's been really easy to implement, though I'm certain I'll need to continue making improvements to it. But my theory is that I can sign a message with my wallet on the frontend using NaCl, send that message and the signature to my backend and verify it, then verify token ownership using RPC. My PoC implementations have been working pretty well, but I am not sure of any holes that may exist in this approach, so it's still a work in progress.