5 ms·

I know that crypto/blockchain is not super popular here, but the experience of logging-in to various dapps is pretty nice. The ”login” is the dapp showing the

I know that crypto/blockchain is not super popular here, but the experience of logging-in to various dapps is pretty nice. The ”login” is the dapp showing the user a message to sign to prove they own the key, then you can sign the message, and that’s the whole login. There’s various ways to implement it, but here’s a quick tutorial for doing login with MetaMask. https://docs.metamask.io/wallet/how-to/sign-data/siwe/ https://docs.metamask.io/wallet/how-to/sign-data/siwe/

tptacek 2y ago
There is no less attractive use of blockchain tech than login. The biggest problem with login security isn't attesting to an identity, it's account recovery; blockchains make that incredibly difficult.
- radicality 2y ago
  Fair enough, I guess for crypto wallets there isn’t any recovery that can be done if you lose the private key. In the end a cryptocurrency wallet is usually just a pub/priv keypair, so purely for login/identity purposes it’s similar to passkeys. And can be backed up easily. What I wanted to say is that hopping around different ‘dapps’ is quite seamless from a login point of view (and has benefits like ability to pay for goods immediately). Often I don’t even proceed exploring some website if it asks me to create an account since the friction is high. In any case, this popped into my head as I was exploring openrouter.ai yesterday (routing layer for LLMs, you buy credits and can use many models), and they had a “Login with MetaMask” option, which is rare for non-crypto websites, and it worked quite seamlessly.
  - tptacek 2y ago
    It's easy to make things seamless if you define away the corner cases!
  - vdelitz 2y ago
    There's a new trend coming up of "Smart Wallets" which make use of synced passkeys for authentication. I can share a blog post about this topic that I recently wrote if you're interested in some details (e.g. Coinbase did it this way).
martinky24 2y ago
Ah, the crypto industry known for being exceptionally secure in their practices, always vetting their security, and never cutting corners. We should do what they do. (Don't ask about what happened to the Ronin Network, Poly Network, FTX, Coincheck, etc, etc)
- fragmede 2y ago
  just like we have to separate the art getting the artist, we have to separate cryptocurrency from the cryptography. The underlying primitives are sound. Still not gonna factor 4096-bit keys any time soon, quantum computers won't be able break that for at least another decade.
wepple 2y ago
This looks like any other public key crypto authentication (U2F) but more complex and less universally adopted? How is this better than OIDC?
- radicality 2y ago
  I guess it’s pretty similar, it’s just pub/priv key verification in the end. Imo the benefit would be that on top of just proving you’re you (logging in), you can perform many other actions. One example where could be used is micropayments, which is imo unsolved problem on the internet. Sometimes I’m browsing and end up on some newspaper paywall which asks me for credit card and yearly subscriptions. Not doing that. But if I were to click a button and get a message to sign saying “Spend 2 cents to view this article?”, and see the article 2 seconds later, I would go ahead and do it.

tptacek 2y ago

There is no less attractive use of blockchain tech than login. The biggest problem with login security isn't attesting to an identity, it's account recovery; blockchains make that incredibly difficult.

radicality 2y ago
Fair enough, I guess for crypto wallets there isn’t any recovery that can be done if you lose the private key. In the end a cryptocurrency wallet is usually just a pub/priv keypair, so purely for login/identity purposes it’s similar to passkeys. And can be backed up easily. What I wanted to say is that hopping around different ‘dapps’ is quite seamless from a login point of view (and has benefits like ability to pay for goods immediately). Often I don’t even proceed exploring some website if it asks me to create an account since the friction is high. In any case, this popped into my head as I was exploring openrouter.ai yesterday (routing layer for LLMs, you buy credits and can use many models), and they had a “Login with MetaMask” option, which is rare for non-crypto websites, and it worked quite seamlessly.
- tptacek 2y ago
  It's easy to make things seamless if you define away the corner cases!
- vdelitz 2y ago
  There's a new trend coming up of "Smart Wallets" which make use of synced passkeys for authentication. I can share a blog post about this topic that I recently wrote if you're interested in some details (e.g. Coinbase did it this way).

martinky24 2y ago

Ah, the crypto industry known for being exceptionally secure in their practices, always vetting their security, and never cutting corners. We should do what they do. (Don't ask about what happened to the Ronin Network, Poly Network, FTX, Coincheck, etc, etc)

fragmede 2y ago
just like we have to separate the art getting the artist, we have to separate cryptocurrency from the cryptography. The underlying primitives are sound. Still not gonna factor 4096-bit keys any time soon, quantum computers won't be able break that for at least another decade.

wepple 2y ago

This looks like any other public key crypto authentication (U2F) but more complex and less universally adopted? How is this better than OIDC?

radicality 2y ago
I guess it’s pretty similar, it’s just pub/priv key verification in the end. Imo the benefit would be that on top of just proving you’re you (logging in), you can perform many other actions. One example where could be used is micropayments, which is imo unsolved problem on the internet. Sometimes I’m browsing and end up on some newspaper paywall which asks me for credit card and yearly subscriptions. Not doing that. But if I were to click a button and get a message to sign saying “Spend 2 cents to view this article?”, and see the article 2 seconds later, I would go ahead and do it.