LNURL-auth for non LNURL-auth websites (generate passwords)

getAlby / lightning-browser-extension

The Bitcoin Lightning Browser Extension that brings deep Lightning & Nostr integration to the web. Wallet interface to multiple lightning nodes and key signer for Nostr, Liquid and onchain use.

https://getalby.com/#extension

MIT License

533 stars 193 forks source link

LNURL-auth for non LNURL-auth websites (generate passwords) #219

Open bumi opened 3 years ago

bumi commented 3 years ago

LNURL-auth describes a way to create a unique signing key for each website and use that to sign a message to login. Sadly most websites do not yet support that.

We could offer the user a way to use the same flow to generate a password for websites. The user would not need to use a password manager and the password can be derived from the lightning master/root key.

johnsBeharry commented 3 years ago

Oh this is a cool idea, we could even autofill the password field. This makes the extension a bit like an "identity wallet" / password manager so backing up this data will be important.

Few questions about edge cases

LNURL-Auth is passwordless, but also anon logins. What is inputed as the email address?
How do we deal with cases when the user changes their password on another device?

bumi commented 3 years ago

the extension still will hold no data as those passwords can be derived on the fly. - similar to the lnurl-auth flow right now. The extension will hold no sensitive data (except of the connection to the lightning node as currently)

regarding email/username: I guess that's still up to the user. changing passwords would not work. - at least then the generated password would not work anymore.

pseudozach commented 3 years ago

as you've mentioned lnurl-auth is specific to websites that have implemented it.

If you want to extend it to regular websites with email/password requirement and tie it to lnurl-auth, you could do: 1- since you already have implemented https://github.com/fiatjaf/lnurl-rfc/blob/luds/13.md you could derive pubkey from this privkey 2- use that as an email address with a domain pubkey@getalbyemailservice.com. 3- for the same domain, getalby (and even other wallets that implement LUD-13) will derive same pubkey/privkey pair. 4- this may be too ambitious but you (or someone else) could run this email service and forward to users own email if they opt-in.

MoritzKa commented 3 years ago

Do you know FIDO2 better? Maybe a LN node's priv. keys are compliant with FIDO specs. That could open up the whole non-LNURL space.