4 ms·

He’s getting downvoted because that’s a solved problem in the wider crypto-space. To log in you sign a message using your hardware wallet. Nostr hasn’t grown u

He’s getting downvoted because that’s a solved problem in the wider crypto-space. To log in you sign a message using your hardware wallet. Nostr hasn’t grown up to that yet, and pointing out that pasting private keys is a bad idea is fair game. But implying that public private key cryptography can’t be used to log into web apps is just silly given that value worth billions is being moved around daily using such web apps.

halfmatthalfcat 3y ago
There's a reason why social logins, magic links and SMS login codes are so ubiquitous now - end users want 0 friction getting into their accounts. This increases friction beyond what is currently common practice. No, the public doesn't want nor care about using a key to log in.
- wholinator2 3y ago
  Although i have heard of SQRL [1] which purports to be a frictionless way of securely logging in with public private key encryption. I've never seen it discussed here though so I'm unsure if there's significant downside [1]: https://www.grc.com/sqrl/sqrl.htm https://www.grc.com/sqrl/sqrl.htm
  - Retr0id 3y ago
    This sounds a lot like passkeys https://developers.google.com/identity/passkeys https://developers.google.com/identity/passkeys - I'd be interested to see a more thorough comparison of the two. Both of these do a challenge-response style authentication with a particular website, and wouldn't really work as part of a decentralized system. You could use the same signing key ordinarily used to sign authentication challenges to sign nostr notes, but then you're back to square 1 really. Edit: slightly better passkey info here https://developers.yubico.com/Passkeys/How_passkeys_work.html https://developers.yubico.com/Passkeys/How_passkeys_work.htm...
    - Ajedi32 3y ago
      SQRL is indeed pretty similar to passkeys. It was just invented before passkeys (before WebAuthn even) and designed to work without requiring any new web standards or changes to the existing web browsers at the time. That greater compatibility came with some UX trade-offs though. Now that passkeys exist and are widely supported by web browsers there's really no need for SQRL anymore; passkeys are a far more polished version of the same concept.
- vezycash 3y ago
  >end users want 0 friction getting into their accounts. Why not offer both, the easy one for normal users and an option to use the more secure option.
  - krapp 3y ago
    Why not have the secure option also be easy so normal users will use it?
- Thorrez 3y ago
  Does public key necessarily have to be high friction? Couldn't there be a few-step UI similar to "Sign in with Google/Facebook/etc"?
  - rglullis 3y ago
    For People who are already familiar with metamask, "Sign in with Ethereum" is so easy that makes people wish it was universal. It is even easy to generate new identities on demand: generate a new address/public key is literally a one-button operation. The only thing that bugs me about is that is actually all your identities are still tied to same master passphrase, so if that gets compromised all of your identities get revealed.
- jgilias 3y ago
  You should try logging into a “web3” app to see what I’m talking about. No need to buy crypto or anything, of course. Just for the science. A short guide, assuming a mobile device: 1. Install MetaMask, next, next, finish to create a wallet. 2. Open app.uniswap.org on your favorite browser. See if you can figure out how to ‘connect’. You can of course use the MetaMask built-in browser, but that’d be cheating.
  - J_Shelby_J 3y ago
    I’ve actually seen this used for non-crypto sites. I think… it was fetlife? If you already have MetaMask/Phantom extensions installed it’s easier than email verification.
vnuge 3y ago
I am glad Zach posted here also, I think nostr devs need some reality pull from "non-crypto normies". To be clear it is (hopefully) becoming more common practice to use a nip-07 web-extension for signing (hardware or software) or other methods such as NIP-46. To be clear though, a user on nostr will HAVE to interact with cryptography in some way as every message on the network is signed. Im working on https://github.com/VnUgE/NVault https://github.com/VnUgE/NVault as an option for more paranoid users that want a self hosted networked approach. But there are others listed here https://github.com/nostr-protocol/nips/blob/master/07.md https://github.com/nostr-protocol/nips/blob/master/07.md Finally, I wholly dislike the practice of offering an option of entering an nsec. Use a signing extension!
jazzyjackson 3y ago
the wider crypto space still has no empathy for normies. if you can't somehow recover or rotate your password, it's a nonstarter by virtue of being a worse UX

halfmatthalfcat 3y ago

There's a reason why social logins, magic links and SMS login codes are so ubiquitous now - end users want 0 friction getting into their accounts. This increases friction beyond what is currently common practice. No, the public doesn't want nor care about using a key to log in.

wholinator2 3y ago
Although i have heard of SQRL [1] which purports to be a frictionless way of securely logging in with public private key encryption. I've never seen it discussed here though so I'm unsure if there's significant downside [1]: https://www.grc.com/sqrl/sqrl.htm https://www.grc.com/sqrl/sqrl.htm
- Retr0id 3y ago
  This sounds a lot like passkeys https://developers.google.com/identity/passkeys https://developers.google.com/identity/passkeys - I'd be interested to see a more thorough comparison of the two. Both of these do a challenge-response style authentication with a particular website, and wouldn't really work as part of a decentralized system. You could use the same signing key ordinarily used to sign authentication challenges to sign nostr notes, but then you're back to square 1 really. Edit: slightly better passkey info here https://developers.yubico.com/Passkeys/How_passkeys_work.html https://developers.yubico.com/Passkeys/How_passkeys_work.htm...
  - Ajedi32 3y ago
    SQRL is indeed pretty similar to passkeys. It was just invented before passkeys (before WebAuthn even) and designed to work without requiring any new web standards or changes to the existing web browsers at the time. That greater compatibility came with some UX trade-offs though. Now that passkeys exist and are widely supported by web browsers there's really no need for SQRL anymore; passkeys are a far more polished version of the same concept.
vezycash 3y ago
>end users want 0 friction getting into their accounts. Why not offer both, the easy one for normal users and an option to use the more secure option.
- krapp 3y ago
  Why not have the secure option also be easy so normal users will use it?
Thorrez 3y ago
Does public key necessarily have to be high friction? Couldn't there be a few-step UI similar to "Sign in with Google/Facebook/etc"?
- rglullis 3y ago
  For People who are already familiar with metamask, "Sign in with Ethereum" is so easy that makes people wish it was universal. It is even easy to generate new identities on demand: generate a new address/public key is literally a one-button operation. The only thing that bugs me about is that is actually all your identities are still tied to same master passphrase, so if that gets compromised all of your identities get revealed.
jgilias 3y ago
You should try logging into a “web3” app to see what I’m talking about. No need to buy crypto or anything, of course. Just for the science. A short guide, assuming a mobile device: 1. Install MetaMask, next, next, finish to create a wallet. 2. Open app.uniswap.org on your favorite browser. See if you can figure out how to ‘connect’. You can of course use the MetaMask built-in browser, but that’d be cheating.
- J_Shelby_J 3y ago
  I’ve actually seen this used for non-crypto sites. I think… it was fetlife? If you already have MetaMask/Phantom extensions installed it’s easier than email verification.

vnuge 3y ago

I am glad Zach posted here also, I think nostr devs need some reality pull from "non-crypto normies". To be clear it is (hopefully) becoming more common practice to use a nip-07 web-extension for signing (hardware or software) or other methods such as NIP-46. To be clear though, a user on nostr will HAVE to interact with cryptography in some way as every message on the network is signed. Im working on https://github.com/VnUgE/NVault https://github.com/VnUgE/NVault as an option for more paranoid users that want a self hosted networked approach. But there are others listed here https://github.com/nostr-protocol/nips/blob/master/07.md https://github.com/nostr-protocol/nips/blob/master/07.md Finally, I wholly dislike the practice of offering an option of entering an nsec. Use a signing extension!

jazzyjackson 3y ago

the wider crypto space still has no empathy for normies. if you can't somehow recover or rotate your password, it's a nonstarter by virtue of being a worse UX