4 ms·

I have decided that all auth should be replaced by the bitcoin blockchain. The steps for logging into a site should be the following: 1. I generate a bitcoin

I have decided that all auth should be replaced by the bitcoin blockchain. The steps for logging into a site should be the following: 1. I generate a bitcoin address using the bitcoin client. 2. I go to foo.com where I want to log in. 3. I enter my bitcoin address into the "username" field. 4. I am then presented with a newly generated bitcoin address that foo.com created. 5. I use my bitcoin address' private key to sign a message containing the new foo.com address I was shown and send the message to the same foo.com address. 6. foo.com now verifies that it received a message from my address and that it contained the address it generated. 7. foo.com then logs me in to the profile associated with the my bitcoin address. This idea is far from being fully thought through, but I like that I don't have to let any website store my password (salted or plain text, not that I can really trust a company to use the former) so if they get hacked, all they get are my public key and potentially the private key to a now useless bitcoin addresses the website generated (and will never reuse it). I also like this better than cert auth because I don't have to upload my public key to every website I use.

clinta 12y ago
You don't need bitcoin for this at all. Just some of the crypto that bitcoin is built on. 1. Generate a random 256 bit number which is your ed25519 private key. 2. The public key is your username. 3. foo.com sends you a 256 bit nonce. 4. You sign the nonce with your private key and return the signed value to foo.com. 5. foo.com verifies the message is signed by your public key and contains the nonce they sent you. And because ed25519 can use any value as a private key, you can create deterministic private keys. For example you can use a hash of a passphrase and the domain name to create a unique private key for that domain, and you don't have to remember a random username for each domain, just your master passphrase. Steve Gibson is working on a login system that does this and uses QR codes so that a mobile device can be used to sign the nonce and return it to the server out of band. https://www.grc.com/sqrl/sqrl.htm https://www.grc.com/sqrl/sqrl.htm

clinta 12y ago

You don't need bitcoin for this at all. Just some of the crypto that bitcoin is built on. 1. Generate a random 256 bit number which is your ed25519 private key. 2. The public key is your username. 3. foo.com sends you a 256 bit nonce. 4. You sign the nonce with your private key and return the signed value to foo.com. 5. foo.com verifies the message is signed by your public key and contains the nonce they sent you. And because ed25519 can use any value as a private key, you can create deterministic private keys. For example you can use a hash of a passphrase and the domain name to create a unique private key for that domain, and you don't have to remember a random username for each domain, just your master passphrase. Steve Gibson is working on a login system that does this and uses QR codes so that a mobile device can be used to sign the nonce and return it to the server out of band. https://www.grc.com/sqrl/sqrl.htm https://www.grc.com/sqrl/sqrl.htm