MisterTicot That's really exciting to watch how you keep diverting the context of the conversation.
- I described UX issues of using pubkey in the login form in addition to transaction signing – you proudly reply that signing interface never requests it.
- I pointed that the entire flow takes at least 3 redirects (website->CosmicLink->wallet->website callback) – you keep denying that and claim that "There's no configuration under which Equilibre.io requires 3 browser redirections + providing credential for tx signing" despite the screenshots that prove your statement is wrong. What's next? I can suggest you a case without redirects at all - when a user visits CosmicLink and closes the page at once. See, the problem of redirect is solved!
- I expanded my statement about ecosystem websites using private key copy-pasting at some point – you slapped this as "unrelated" to the problem of secret keys copy-pasting.
- I said that the problem of copy-pasting secret keys in the compromised environment is hyperbolized as the signing process in the untrusted system can't be considered fully secure by definition – you focus entirely on abstract concepts of secret keys sharing ignoring everything else.
- I illustrated an example of compromised privacy (leaked public key) vs stolen money (leaked secret key) to show that you concentrated only on one side of the problem – you are making fun of it.
- I agreed that the "clipboard problem" exists, it is ubiquitous, and should be addressed, debating only the UX of the proposed solution – you keep repeating your "secrets sharing" mantra to generalize the problem. "Do you agree that secret key should be safe? If yes, I'm right about everything else."
- I stated that any other project can be accused of the secret key copy-pasting just because there is no other way to implement some scenarios – you mention the fictional "private keys copy/pasting promotion" (I re-read twice and didn't spot any "promotion", only the technical process description plus standard marketing stuff), admitting that you selectively and intentionally attacked a single person based on generalized argument. So it is all personal, despite your previous excuses.
Re: StellarExpertID
Yes, I have presented it more than a year ago, it was one of the SCF round finalists, it is still on our roadmap. Originally, it was a prototype, and I offered SDF(the most reputable entity in the ecosystem) to curate the development and host it, but they were reluctant to run the service (as it potentially concentrates even more power in their hands) and wanted to see it as a community effort. Back then I offered collaboration to you and Paul, but Paul was focused on multisig, while you had your own adamant vision.
Since then, the project has undergone a dozen major refactorings, two security audits, has been rewritten almost from scratch to address a huge list of issues, required features, and security considerations. Some questions about UX I asked earlier were directly related to the real-world problems we faced once we tried to integrate our signer into our own products. I spent an enormous amount of time to design a bullet-proof architecture that is both secure and flexible enough to build a good UI on top of it. We even had a dedicated developer working exclusively on this project for some time. Currently, the entire project code is in private repositories and will be open-sourced immediately after we release the public beta version. The old repository is there just for the sake of keeping history.
The only reason why it is not released yet is my reluctance to ship the imperfect application. We'll be dealing with other's people money and privacy, so the security on top of the bulletproof two-way protocol is paramount here. Contract stability is essential for all other apps who will use the API in the future. Changing things like encryption schemes, key storage format, or communication protocol can be really tricky since we don't have access to user data on our side.
Again, someone with lower standards could say that it is production-ready for more than a year; it just doesn't look particularly attractive and has some known limitations. But I say that it will be released only when we ensure that core functionality works flawlessly and we can be certain that our users are safe and enjoy the improved UX instead of cursing us.
The "inspired by my work" assertion looks hilarious considering the fact that our project has completely different architecture and much wider functionality. It was inspired by Metamask, MyEtherWallet, and OAuth. But if you are by chance the inventor of the delegated signing concept or maybe even public-key cryptography (as one might think based on your dogmatic statements), then, of course, kudos to you.
