Log-in via QR code, Challenge-Response

dzham

I'm procrastinating on reviewing Build Challenge entries today, and instead came up with this,
and want to get some idea about how useful something like this would really be.

QR code format would be

{
	"stellar": {
		"challenge": {
			"id":		ACCOUNT_ID,
			"message":	MESSAGE,
			"url":		WEBHOOK_URL
		}
	}
}

The user scans the QR code, and POSTs (id, message, signature) to the web-hook, which in turn verifies the signature.

It's trivial to implement, about 50 lines of code, but there are a couple of gotchas, especially with hashing the message before signing.

dzham

Fundamentally, it's a proof-of-ownership, a way of verifying that the user is in control of a specific private key.
As an anchor, maybe you want to make sure that you are sending assets to the right recipient?

pacngfar

dzham "As an anchor, maybe you want to make sure that you are sending assets to the right recipient?"
I don't understand this example. Why does someone would give a destination address that he doesn't own ? If he wants to get the assets, he must give his address for which it can sign...
But the idea is interesting simply for logging-in.

centaurus

Interesting idea! But it would have to see wide adoption in all wallets out there, before an anchor would decide to make this proof of ownership mandatory for payouts.

dzham

If we're going for lowest common denominators, anchors wouldn't even exist, since Lobstr doesn't support non-native assets. Someone has to go first, that's how progress works.

dzham

pacngfar
The anchor example was based on something I came across w/ bitcoin, wanting to have the user sign something before sending BTC, so they're less likely to succeed with doing a charge-back.

sacarlson

I would think there would be a use for this at times to login to a site on your computer with your android phone so why not add it? but I would again put the twist of a callback at least as an option to pull the json data with something like:
{"tx_tag":"123", "callback":"https://callback.website.com","ver":"2.5"} .
with also the version added to specify what might be expected. in this manner the data size of the qr-code is reduced. As my camera on my computer can't even read Centaurus export key format with just secret and public key gives you some idea of the limits of qr-code size for some systems. Do you have the code for this in your stargazer working already? If so I'll also put it into my_wallet no big deal. Whats a few added lines of code going to hurt especially if I don't have to write it?

dzham

Adding code is almost never an issue, changing or removing is (cf the soft fork vs hard fork debate in Bitcoin)
I've added challenge-response to the most recent version of Stargazer, and I'm using it already for the send-to-email feature.

For QR-code size reductions, one way to go could be to use XDR, which would get rid of a lot of redundancies.

sacarlson

I noted the challenge code when I was editing your code the other day. looks like it would be no big deal to add to other wallets. Also I was going to mention that an example on the server side would be good to show others how it can be used but looks you already did that. I just haven't seen the code or seen how well that works yet.

I already send XDR in my system when I send tx envelopes for remote signing. these aren't small, they can be very big depending on the complexity of the transaction or even multiple operations within envelopes can make them quite large. callback makes any complexity all about the same size (small). All the big stuff is contained on the wire. Also there are no XDR formats setup for the details needed in escrow transactions that also take up more space. And not to worry my branch or your stargazer has it already implemented and working. All you guys have to is try them all out and decide on one or keep them all. They are all implemented to see on the OpenCart Stellar Payment Plugin to try and see for yourself.