Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature idea - Temporarily remember login signatures & auto-sign #545

Open
2 tasks
naps62 opened this issue Dec 1, 2023 · 0 comments
Open
2 tasks

Feature idea - Temporarily remember login signatures & auto-sign #545

naps62 opened this issue Dec 1, 2023 · 0 comments
Labels

Comments

@naps62
Copy link
Member

naps62 commented Dec 1, 2023

This would probably be an experimental feature at first, due to security considerations.

See this thread (props to @wmitsuda, idea came from him)

The general idea would be for the wallet to remember certain eth signatures (perhaps the ones explicitly requested by the user, with a "remember this signature" prompt on every signature popup)

Then, if a connection of the same domain name requests a signature we already have in-memory, the wallet can automatically reply without user interaction.

The main goal here would be to improve UX of websites that, for better or worse, constantly ask you to sign the same thing as a login mechanism (mirror.xyz and gitcoin come to mind, I personally had this pain a few times)

Security considerations:

  • We need a safer mechanism for proving the domain a connection belongs to. The current approach is very naive, and would be easy to spoof here (it was never meant for verification, just informational)
  • Can we somehow distinguish signatures that are plaintext messages versus ones that would that could be used by other parties for malicious purposes (e.g.: perhaps we don't want to remember ERC-2612 signatures and other similar ones)
@naps62 naps62 added the feature label Dec 1, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant