5 ms·

I’ve used a basic version of OAuth before and found it very simple, so I’m amazed wallet authentication can even be simpler. How does the user prove they have t

I’ve used a basic version of OAuth before and found it very simple, so I’m amazed wallet authentication can even be simpler. How does the user prove they have the private key, do they make a verification transaction? From the user’s perspective I see the (dubious) benefit of being able to use the same key for your money and online accounts, but that’s about it …

CuriousCosmic 5y ago
You don't even need to make a transaction. Cryptocurrency based authentication mechanisms use the ledger as a "trust-less" root of trust. You know anything that's been on the ledger long enough is valid. From their all you need to do is authenticate with the same PKI that corresponds to said wallet. A simplified example: You own an NFT and want to prove that you own it. You can produce some chunk of data (not a transaction) that includes a reference to the NFT (be it the UTxO, Tx, or some hash) and sign it with the same key that owns the NFT (or a derivative key depending on the design of the system). Since it's not a transaction it doesn't cost anything to produce and you can share it with the interested parties however you wish. In a sense you can think of it like GPG (and GPG based SSH keys) except instead of the web of trust being a federated set of servers and key cross signing, it's a decentralised ledger. It's not simpler but it can be easier because it largely comes out of the box set up. The PKI is already well established and you don't need to really spin up or configure anything complicated to use it. You just launch a wallet with the supported features and it "just works".
shiohime 5y ago
I've been working on Solana and Ethereum dapps and it does rely on browser extensions at the moment (MetaMask or Phantom wallet for example). But basically they expose an API that lets you connect a wallet. In one app I'm working on right now in Solana, I'm able to connect in a one line api call (granted if I want to support other wallets I'll need to use an adapter npm module). Since you need to have the private key to set up a wallet, connecting is essentially "logging in". So really, I can make a website that lets you use a wallet with no money on it as authentication, if I wanted to, since it proves you are who you say you are unless your wallet's private keys are compromised.
- LindyTalker 5y ago
  Would love to learn more about the dapps you’re building. Any site or anything I can check out?
  - shiohime 5y ago
    edit: Sorry, I think I misread your question. My current ongoing project is not yet public but will be unveiled and live in a few weeks, the others were entries into hackathons for proofs of concept, but I don't have those live. I'll leave the rest of my message (targetted for dev resources in general) below in case you or anyone else finds it helpful. The only way I can recommend getting started is the way that I did a few months back - I strongly encourage checking out and entering random hackathons! https://gitcoin.co/hackathons https://gitcoin.co/hackathons There's a lot going on in the space currently - many projects are trying to attract development talent so they will sponsor / participate in hackathons. imo they're fantastic opportunities to learn something new and potentially win some extra money. I'd probably recommend ethereum as a first ecosystem to really dive into - the tooling is more mature than other dev-centric blockchains. However, keep in mind that ethereum as a base can be a tricky place to launch your app because of high transactional fees, and you would likely want to integrate a layer 2 like Arbitrum or support alternative coins in a final application. I'll link some pages to a few technologies I used when building some ethereum dapps https://www.trufflesuite.com/truffle https://www.trufflesuite.com/truffle https://www.trufflesuite.com/ganache https://www.trufflesuite.com/ganache for wallet integration, either of these work https://github.com/ChainSafe/web3.js https://github.com/ChainSafe/web3.js https://github.com/ethers-io/ethers.js https://github.com/ethers-io/ethers.js I highly recommend checking out The Graph too - it allows for you to leverage graphQL on your smart contract data by creating a dedicated subgraph. With some careful integration, you can replace a dedicated backend that would normally be required for various APIs with this. It's a very exciting project imo. https://thegraph.com/en/ https://thegraph.com/en/ And of course, the solidity documentation is very helpful. Coming from a scripting heavy background, solidity was very easy for me to pick up and write a simple escrow service. https://docs.soliditylang.org/en/v0.8.9/ https://docs.soliditylang.org/en/v0.8.9/ I'd also recommend checking out other chains once you become more comfortable with the system. I'm currently working on Solana and it's a bit more difficult to work with due to the tooling not being as mature, but it is a very interesting chain to work with and I hope that it can scale better than Ethereum has.

CuriousCosmic 5y ago

You don't even need to make a transaction. Cryptocurrency based authentication mechanisms use the ledger as a "trust-less" root of trust. You know anything that's been on the ledger long enough is valid. From their all you need to do is authenticate with the same PKI that corresponds to said wallet. A simplified example: You own an NFT and want to prove that you own it. You can produce some chunk of data (not a transaction) that includes a reference to the NFT (be it the UTxO, Tx, or some hash) and sign it with the same key that owns the NFT (or a derivative key depending on the design of the system). Since it's not a transaction it doesn't cost anything to produce and you can share it with the interested parties however you wish. In a sense you can think of it like GPG (and GPG based SSH keys) except instead of the web of trust being a federated set of servers and key cross signing, it's a decentralised ledger. It's not simpler but it can be easier because it largely comes out of the box set up. The PKI is already well established and you don't need to really spin up or configure anything complicated to use it. You just launch a wallet with the supported features and it "just works".

shiohime 5y ago

I've been working on Solana and Ethereum dapps and it does rely on browser extensions at the moment (MetaMask or Phantom wallet for example). But basically they expose an API that lets you connect a wallet. In one app I'm working on right now in Solana, I'm able to connect in a one line api call (granted if I want to support other wallets I'll need to use an adapter npm module). Since you need to have the private key to set up a wallet, connecting is essentially "logging in". So really, I can make a website that lets you use a wallet with no money on it as authentication, if I wanted to, since it proves you are who you say you are unless your wallet's private keys are compromised.

LindyTalker 5y ago
Would love to learn more about the dapps you’re building. Any site or anything I can check out?
- shiohime 5y ago
  edit: Sorry, I think I misread your question. My current ongoing project is not yet public but will be unveiled and live in a few weeks, the others were entries into hackathons for proofs of concept, but I don't have those live. I'll leave the rest of my message (targetted for dev resources in general) below in case you or anyone else finds it helpful. The only way I can recommend getting started is the way that I did a few months back - I strongly encourage checking out and entering random hackathons! https://gitcoin.co/hackathons https://gitcoin.co/hackathons There's a lot going on in the space currently - many projects are trying to attract development talent so they will sponsor / participate in hackathons. imo they're fantastic opportunities to learn something new and potentially win some extra money. I'd probably recommend ethereum as a first ecosystem to really dive into - the tooling is more mature than other dev-centric blockchains. However, keep in mind that ethereum as a base can be a tricky place to launch your app because of high transactional fees, and you would likely want to integrate a layer 2 like Arbitrum or support alternative coins in a final application. I'll link some pages to a few technologies I used when building some ethereum dapps https://www.trufflesuite.com/truffle https://www.trufflesuite.com/truffle https://www.trufflesuite.com/ganache https://www.trufflesuite.com/ganache for wallet integration, either of these work https://github.com/ChainSafe/web3.js https://github.com/ChainSafe/web3.js https://github.com/ethers-io/ethers.js https://github.com/ethers-io/ethers.js I highly recommend checking out The Graph too - it allows for you to leverage graphQL on your smart contract data by creating a dedicated subgraph. With some careful integration, you can replace a dedicated backend that would normally be required for various APIs with this. It's a very exciting project imo. https://thegraph.com/en/ https://thegraph.com/en/ And of course, the solidity documentation is very helpful. Coming from a scripting heavy background, solidity was very easy for me to pick up and write a simple escrow service. https://docs.soliditylang.org/en/v0.8.9/ https://docs.soliditylang.org/en/v0.8.9/ I'd also recommend checking out other chains once you become more comfortable with the system. I'm currently working on Solana and it's a bit more difficult to work with due to the tooling not being as mature, but it is a very interesting chain to work with and I hope that it can scale better than Ethereum has.