I'm building an Ethereum dapp for users to use with Metamask. We're going to have an account management system and I was trying to follow this post on how to achieve a "password-less" account system using Metamask: https://hackernoon.com/never-use-passwords-again-with-ethereum-and-metamask-b61c7e409f0d.
However, there is a problem with the suggested protocol as the signed data never changes, so an attacker could just intercept the signed message and could authenticate as that user.
I was trying to find a previously devised public-key algorithm on Wikipedia, but most protocol involve a trust authority -- I don't know if that's necessary here.
What's a simple, but secure or established protocol for authenticating a user in this way? I was considering a nonce system + signing with eth wallet private key.