WebAuthn signature support

[cybercent]

Instructions

The Web Authentication API (also known as WebAuthn) is a specification written by the W3C that allows servers to register and authenticate users using public-key cryptography instead of a password. It is already supported by all major browsers.

The attractive feature of WebAuthn is being able to use a hardware signing device in a browser without browser extensions or other installed software to sign data.

Issue To Be Solved

Update Flow to verify signatures created by a WebAuthn assertion. https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API/Attestation_and_Assertion

(Optional): Suggest A Solution

The WebAuthn creates a signature over the data from the client and the data created/used by the authenticator. Add a way to send extra data to Flow when verifying signatures. The extra data field would be used to send the data created/used by the authenticator.

(Optional): Context

Allow people to sign transactions in browsers, without any extensions.

[10thfloor]

Nice issue. @turbolent and @jordanschalm made this work on Ethereum a couple years ago during an internal hackathon :)

[bluesign]

Maybe it can be better for wallets to support WebAuthn as a secondary login option. (as in any case you will need a web-based wallet). Also, as your public key is bound to the site, you cannot access your account from two different wallets anyway.

WebAuthn is a little problematic with the key management. There is no way to have the same private key on 2 devices, the only option is to register 2 devices to your account.

Also, there is no way to show the content signed user-friendly (like in the ledger app for example), you are seeing a mess of JSON data.

It is good for login (especially if you have backup login or recovery option).

[10thfloor]

Agreed. This seems like more of a wallet-level consideration. Wallets could easily authorize the use of Flow account keys via webauthn.

[cybercent]

@bluesign the idea is to remove the signing function from the wallet.

In real life your wallet keeps your credit card but it does not do transactions in your behalf.

The wallet’s function would be to display data from the chain, but not sign.

The hardware key is designed not to give you the key, so that’s a nice security feature, similar to HSMs. Flow accounts can have multiple keys and addresses are not derived from keys so that’s not an issue.

For backup purposes a second key could be added, either from a hardware device or not.

The PK being tied to a website address is a security feature, to stop phishing. It’s an advantage if you look it from the angle where a user does not have one Flow account but many. Each dapp can have accounts for their users, no need to centralise all blockchain accounts in wallets. No need to redirect all user traffic to a wallet before a user can interact with the dapp.

[bluesign]

"It’s an advantage if you look it from the angle where a user does not have one Flow account but many. Each dapp can have accounts for their users, no need to centralise all blockchain accounts in wallets."

Then why do they need flow network at all? If each dapp will have accounts for their users meaning each user will have account for each dapp, no point to use blockchain at all. Actually what you are suggesting is each dapp to be a wallet service basically. ( like you cannot use your TopShot account as normal flow account )

Currently state of dapps on flow is already dramatic, I think we should promote more interoperability and openness instead of walled gardens.

[cybercent]

Each dapp could create Flow accounts for their users in a non-custodial way, the user has the key. Also there are no emails, passwords, and 2FA codes involved, so login/signup is mostly one click away.

This does not mean the dapp is a wallet, as the dapp could only care about the content it creates. If the user wants to transfer his content from account A to account B, he could do that assuming the typed path on account B.

I don't think the state of dapps is dramatic on Flow, Flow is new, so most of the tooling 5-year-old blockchains have it's not here yet.

[bluesign]

yeah but when you have per dapp PK, you don't own anything. If dapp goes down, how you will reach your stuff? Or account A is on dapp A, you need that dapp to allow you to send your stuff basically.

Also when I said dramatic, I said about on interoperability side.

• TS: you cannot move your stuff
• MotoGP: Last time I checked they didn't even have a contract on the mainnet
• Viv3: creating your flow account
• Warner stuff: I didn't check, but it is also the same I guess

Only Versus currently is doing something interoperable I guess currently. The problem is when you give the option to dapps to manage an account and create an account for each user, then it will kill the Wallet ecosystem before it is started.

Also currently there is nothing stoping dapps to use webauth (except they cannot create account currently AFAIK) But when this limitation is gone, they can create account for users (but I still think it is a bad idea)\

Also there is an option to implement webauth as a wallet, so users will use their own keys.