I'm building an Ethereum dapp for users to use with Metamask. We're going to have an account management system and I was trying to follow this post on how to achieve a "password-less" account system using Metamask: https://hackernoon.com/never-use-passwords-again-with-ethereum-and-metamask-b61c7e409f0d.

However, there is a problem with the suggested protocol as the signed data never changes, so an attacker could just intercept the signed message and could authenticate as that user.

I was trying to find a previously devised public-key algorithm on Wikipedia, but most protocol involve a trust authority -- I don't know if that's necessary here.

What's a simple, but secure or established protocol for authenticating a user in this way? I was considering a nonce system + signing with eth wallet private key.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.