HelloZeroNet / HelloZeroNet/ZeroNet

Support for hardware wallets

Đang mở
#2,083 3 bình luận 0 reaction 0 người được giao Xem trên GitHub
Ngôn ngữ chính
JavaScript
Star
18.8k
Fork
2.3k
Chỉ số merge pull request
Không có pull request nào được merge trong 30 ngày

Mô tả

**Is your feature request related to a problem? Please describe.**

ZeroNet currently uses a local JSON file for storing private keys and accounts. And when using Multiuser plugin, the private key should be written directly to the displayed prompt.

While this is good for local instances, there are security concerns when using public proxies. If a proxy is malicious or compromised and you write your private key, they can steal your account and IDs. There can also be a problem with a local instance in case if the computer is compromised.

**Describe the solution you'd like**

There should be support for hardware wallets. Users should be able to log in with their hardware wallets from both local instance and public proxy. This means that all communication needs to be done with JavaScript.

Most hardware wallets communicate via WebAuthn/U2F which is supported in all browsers so this should not be a problem. Some other hardware wallets require browser extension or local bridge but this is also not a problem.

And if Ethereum cryptography is supported with #2053, there could also be support for MetaMask, WalletConnect and WalletLink.

The most important thing here is that users should be safe even if they use an account on possible compromised proxy or computer. And classic accounts with private keys should remain because not everyone has hardware wallets and private keys are still safe for local instances (except if your computer is compromised).

You can see [MyEtherWallet](https://www.myetherwallet.com/access-my-wallet) and [MyCrypto](https://mycrypto.com/account) for some popular hardware wallets that should probably be supported.

Hướng dẫn đóng góp

Chưa lập chỉ mục được hướng dẫn đóng góp cho kho mã nguồn này

Hướng nghiên cứu

Start by reviewing the existing account and private-key flow, then compare the requested browser-based approaches: WebAuthn/U2F, browser extensions or local bridges, MetaMask, WalletConnect, and WalletLink. Done would mean users can authenticate from local instances and public proxies without exposing private keys while retaining classic accounts, but the issue does not identify files or tests.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Đánh giá

Công nghệ
javascript
Lĩnh vực
authentication, security
Loại issue
Tính năng
Độ khó
5/5
Thời gian dự kiến
Hơn một tuần
Mức độ hoạt động
Đình trệ
Độ rõ ràng
Cần làm rõ
Mức phù hợp với người mới
25/100

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.