“SSO-style” Login into app with web3.eth.accounts[0]

Question

On top of the data exchanged through the Ethereum network, my app stores some extra user data in a classic DB (E.g. thumbnails, display preferences, newsletter management etc.).

Doing that has led me to use a double account system: an Ethereum account—I get it from web3.eth.accounts[0]—and a classic login/PW account. While you can make all sort of links between the two, it still requires to type 2 different PW and manage two accounts.

So I wonder if it is possible to login into the app using just the Ethereum PW (in Mist, MetaMask etc.):

• Is safe to login into a classic account with just the web3.eth.accounts[0] and no PW?
• Is it possible to ask for the user permission (like the "accept" prompt with Metamask) but without mining a transaction (too long for a login)?
• Is there another way to enable single-click login?

The use case is a Meteor app used with MetaMask, but I guess it's a more general question.

Answer 1

The knowledge of a public key (such as Ethereum addresses) should never be used as method of authentication.

Public keys are meant to be shared, for instance to receive a payment in a cryptocurrency. If a client can just provide that address to autenticate, then everybody who knows the public address could impersonate the client.

The following JavaScript code should be enough to impersonate an account in this case:

web3 = {eth : { accounts : ["<anExistingPublicAddressInHex>"]}}

after that instruction, the web3.eth.accounts[0] instruction will return the address "<anExistingPublicAddressInHex>" without the knowledge of the private key.

The use of the private key is required to identify the owner of a known public key, for instance by requesting the signature of a string of random data.

Answer 2

I'm building a similar system. Some data stored on the blockchain, some stored in a traditional DB, and my personal approach may interest you.

Is safe to login into a classic account with just the web3.eth.accounts[0] and no PW?

The question that you are really asking is "Can you trick web3 into believing you control the private key of an address when you really don't?".

From my understanding and my own attempts at trying to trick web3 the answer is no. This would mean that using the existence of web3.eth.accounts[0] would be proof that the user has the private key of the address.

Yes it is possible to trick web3 into believing you own a public key you do not have the private key for. See atfornes' answer https://ethereum.stackexchange.com/a/16970/2673

So Is safe to login into a classic account with just the web3.eth.accounts[0] and no PW? , I would say yes, but you will need to prove that the user controls the associated private key via a method of signing. See How can I sign a piece of data with the private key of an Ethereum address?

Is it possible to ask for the user permission (like the "accept" prompt with Metamask) but without mining a transaction (too long for a login)?

If you want the user to confirm that they would like to be validated as a user with their web3.eth.accounts[0], you can simply store this data in your traditional DB. I don't see any advantage storing this in a contract. But you will need the user to prove they own the public address by signing some data with the related private key.

Is there another way to enable single-click login?

One of the beauties of using a platform like Ethereum is that you can build a ZERO click login.

If we establish that the user's web3.eth.accounts[0] is proof that the user controls the private key of that account's address, then you will always know that the user is valid.

But you will need some kind of client side script to collect proof that the user has the private key for the public address representing their account.

Answer 3

Recently came across a project in alpha: https://fortmatic.com

Docs seems pretty good, was able to get things working pretty fast. It triggers a modal in an iframe for user auth (similar to Stripe or Plaid) - imo this feels like a better ux as the end users never have to leave the main dapp experience

Answer 4

Had you seen this Auth0 module? https://github.com/auth0/ethereum-authentication-server