search

near / near-wallet-roadmap

near-wallet-roadmap
Apache License 2.0
8 stars 0 forks source link

Improved email recovery using Google Mail (will be via Tor.us) #13

Open kcole16 opened 3 years ago

kcole16 commented 3 years ago

Summary We will utilize Tor.us, a non-custodial, distributed key management protocol, to improve the email recovery experience. Instead of needing to save an email with a magic link, users will be able to access their accounts by verifying they control their email account.

Intended Outcome The user-friendly, and currently "less secure", recovery option will be both more secure and convenient than the current email recovery implementation.

How will it work? Users will verify access to an email account they control, which will generate a keypair via Tor.us, then add this key to their account. To login again, users simply verify access to their account, similar to "Sign in with Google"

mattlockyer commented 3 years ago

Context for partners who already onboarded users with their Torus api key.

The user's key for NEAR will only work via that partners app. e.g. the key is deterministic based on:

User Email/SMS/... x Partner Api Key x Torus -> Key

If we were to allow these users to "import" their account into NEAR Wallet we would need to have something like the following:

From partner website with THEIR torus api key, the user signs to add a full access key, creating and sending a recovery link through OUR contract helper (exactly how it's done in wallet) Then user just clicks this link. Existing flow. Account imported.

@kcole16 correct me if I'm wrong here?

stefanopepe commented 3 years ago

@mattlockyer I'm trying to visualize the process here, but I'm missing some steps in the original creation process.

Can you provide an example of partner I can use to login/create account, and have me take it from there?

If I got it right, instead of sending a six digits code along with the recovery passphrase, we send a one-time URL to confirm Torus account?

mattlockyer commented 3 years ago

Can you provide an example of partner I can use to login/create account, and have me take it from there?

It's basically just signing up with your email. Then the app gets a public key and creates an account with that public key as the full access key. The user signing is done via Torus API.

The key point is that we don't have access to the app, the UI or any way for the user to "login with NEAR Wallet" because, as I mentioned above, the key generated for user signing via Torus API is specific to the App's Torus API Key.

So one of the only ways to import such an account is for the App to........

Present an option for where the user signs to add a full access key. Then the App signs and sends a request to contract-helper which emails a recovery link (exactly how it's done in wallet when user sets up email recovery).

Then user just clicks this link. Existing flow. Account imported.