From what I have researched, it seems that all of the methods for allowing a user to signup and login for an Ethereum dapp are very cumbersome for the user to use. What are the best practices to allow signup and login that match the following criteria:

  1. The method for signup and login should not be cumbersome; ie: simple as normal methods of username/password or facebook and google oauth.

  2. The method for signup should not charge the user any ethereum (gas) - taking someone's money just to signup would put off most people.

  3. The method of signup and login should not make the user jump through hoops such as,
    a) entering email
    b) downloading a mobile app
    c) entering a wallet address
    d) waiting for authentication confirmation
    e)entering a code back on the signup screen, etc.

  4. Extra software like MetaMask or Mist should not be required. (Maybe this is not possible?)

The goal here is to remove as many hurdles as possible to get users to the dapp.

up vote 5 down vote accepted

AFAIK it's always easy and good to use the PGP key mechanism for user authentication in DAPPs built using Ethereum. It's possible to use the account address as the username and to let the user sign some data with his private key to verify. This article might help you in the process.

To make it easy for users, you can let users to store their private key on client's side (eg: embed it with app they use once registered etc. - make sure to notify user to keep the private key stored, if in any case app is uninstalled)

UPDATE : As discussed in the comments below, If you want to go for a traditional user account system use a traditional user table with usernames associated with an account address and to connect to the ethereum network use web3.js (refer this question) - However this is again going for a trusted third party mechanism.

  • 1
    Maybe Ethereum is too immature for what I'm after. Having to ask your average normal person, non-developer types, to install chrome extensions just will not fly. To me that is the biggest problem facing Ethereum and other block-chain technologies - converting the person who is used to the normal internet over to the decentralized block-chain internet where their profile is no longer a username/password, but a hash string token address. – Jason Cochran Aug 22 '17 at 2:15
  • Yes, Ethereum is really cool for us developer-types. Otherwise all this tech seems way too impractical for your normal average facebook user. – Jason Cochran Aug 22 '17 at 2:17
  • 1
    why not use a normal account type username mapping to account addresses and a password to verify the private key like thing. You might need to do the mapping at server side. But the issue is this might look like having trusted third party which is not the blockchain concept is designed for. – Achala Dissanayake Aug 22 '17 at 2:26
  • 1
    You could rely on existing auth mechanisms and generate keys in the cloud for the user. Then sign offline transactions. I've created a small library that is able to sign transactions with Azure Key Vault. Users can be authenticated using any OAuth supported and their keys are managed in the cloud. Just an idea. npmjs.com/package/ethereumjs-tx-keyvault – Tomislav Markovski Feb 13 at 17:36
  • 1
    @TomislavMarkovski great stuff. will be very useful :) – Achala Dissanayake Feb 13 at 17:39

Addressing #4, it's definitely possible, but you will have to make a decision between completely centralized vs decentralized approach.

MetaMask is decentralized (end users hold the private keys), but the the Chrome extension will require users to go through more hurdles to get started.

There are a bit more centralized solutions like Fortmatic which allows end users to directly interact with dapps on any browser without requiring downloading a Chrome extension.

There aren't a lot of traction current for dapps in general - I would rather opt-in for providing a better user experience and get traction for your app before considering adding decentralized approach as an option.

New contributor
Evan H. is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

You can use an Ethereum address as a unique identifier for a user account. You can then require the holder of the private key that maps to that address to sign a message which you can then check.

It is possible to verify that a message was signed with a particular private key without knowing the private key.

I wrote a blog post about signing a message a while back.

The problem with this approach is simplicity and community acceptance. I previously built a login protocol which worked as described above. The problem is that it either requires signing a message independent of your dapp (complex, barrier to entry) or the user providing their private key in some form (raw, key file, mnemonic etc) to your service such that you can provide the message signing.

When I did this the 'community' got angry because it was a security risk (were I a scammer).

TL;DR; It can be done but everyone will moan about security/decentralisation.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.