Hacker News Reader

Comment by florincm | Hacker News Reader

I think your idea is brilliant but needs a bit o polishing off.

Because every website is different everyone has different requirements, and a solution would be to just use the public key as the identifier instead of the email.

And for backup purposes as master password, I would suggest making it very similar to Trezor and generate for the user with a good RNG a 24-word mnemonic. I know is a hard task to write down for some but you don't do it every day, and you know you're safe if you lose your device or make use of it on a different device. I wouldn't want to rely on the user to memorise it or generate it, especially when users do not generate a good entropy.

I would personally recommend using Trezor as guidance. This is my demo: https://cl.ly/1P0N0W1t1a3B

I would be happy to implement it in my systems if it follows the principals above.

View on HN

>to just use the public key as the identifier instead of the email.

it's exactly how it is now. Email has no "weight", it's just a label.

What are your systems? What about 24-word mnemonic as a second option? I personally hate those, and don't want to enforce it.

I understand is a label, but some bad devs might use it as a way of matching the user, and end users might get confused especially when you can write any email as there is no verification for it in place. Let them choose it, or you make the first one to speed up the process and let them edit it if they don't like "Account 1".

In terms of master password, what do you think is easier to write down as a backup?

This: ?A[ZSOO{PBs&Y]5.6iwm=_t}]t<DOk

Or this: remove maple runway unable empty little swing zebra lava interest secret admit

To create this you can even use the bitcoin libraries, so you don't have to write your own, and you will only need to work on the clients.

If you do it similar to what Trezor did but on a desktop app, you're protocol is built for the web pretty fast. If is good for money is definitely good for Facebook/Twitter/whatever.

If you don't have a lot of experience with bitcoin, you can try to use https://copay.io/ is cross-platform, open source and very secure. Exactly what you're after from my understanding.

You can even change this remove all the bitcoin wallet stuff and make it as an authentication app. It generates the words for you and forces you to back them up to avoid any pain later on. This follows all the principles mentioned.

P.S. This version is visually better imo https://github.com/bitpay/copay/releases/tag/v2.7.0

Why not just use the fingerprint scanner that's on every mobile phone these days to authenticate.

Bacause you cant use that on your computer, i think the idea here is to be cross-platform.

Reply on news.ycombinator.com