1

I want to create a website where my users can register and login but not using any kind of database. I want to use public/private key. Let's take https://www.myetherwallet.com/. It says that It doesn't store keys for me. so where are they? when I want to login on that website and type private key, how does it make me login at all?

Main question is: How do I do the same principle by using php and website that myetherwallet.com has right now?

  • Can you explain what you mean by "login on that website"? Which functionality of the website are you specifically talking about? (As far as I know there's nowhere to log in on MEW... ) – Richard Horrocks Sep 11 '18 at 14:32
2

Neither MyEtherWallet or MyCrypto store your wallets, anywhere. You own your wallets. Every time you access your wallet via either services, it's being done locally, in your browser. You can even access your wallets offline, without having a connection to the internet!

Your private key, keystore file or hardware wallet derive your public key, which derives your address. MyEtherWallet or MyCrypto never touch your funds, the logic for accessing your wallet is all in the local interface. The only time either services come into play is when you want to retrieve the balance of the account, or send a signed (locally signed!) transaction. Both of these actions can be done without using MyEtherWallet or MyCrypto, by e.g. running your own node or using Etherscan.

0

Aloha : )

I am not entirely sure for php, but I did the same scenario in Node.js:

You should download web3 library ( https://www.npmjs.com/package/web3 ) [take a look]. When you successfully import it, you could start experimenting, and my warm recommendation is to start from and rely on documentation! :)

https://web3js.readthedocs.io/en/1.0/web3-eth-accounts.html#create

When you create the keys, they'll be returned to you ( in a form of callback ), so afterwards you should decide what to do with them.

Answer to your main question is - It's impossible without some kind of 'database' ( even if it is just a file on hard drive or something ), because you need to verify that given private key exists in order to let user in.

Last piece of recommendation: When you realize that it is impossible to go by w/o some kind of database, at least think of security concerns.

I hope I helped, at least a bit.

All the best! :)

  • Thanks for your ideas. So how does that myetherwallet.com do this kind of stuff? Then they have a wallet on their server. but if they do have the wallet, why do they say that they don't store my keys at all? – Giorgi Lagidze Sep 11 '18 at 13:01
0

I would answer you in a comment, but it's to long ( sorry in advance ).

Well, they communicate all the time with Ethereum node ( you could do the same via aforementioned 'web3' library. Firstly they create wallet for you ( they call ethereum node via web3, and wait for response ), after that they return private key and UCT file to you. Afterwards, if you decide to 'login' to their website, they just send information you provided to them to communicate with ethereum node, and get information about your account, that are afterwards presented to you ( it's excatly the same as you've logged in/authenticated, except they don't save that info into their database, just communicating with node back and forth)

  • I agree, but as we all know, the node must be on their server and that node must communicate to the wallet. so they have our wallets. myetherwallet.com can even grab it and steal my ethers. – Giorgi Lagidze Sep 11 '18 at 13:12
  • Oh, no, that's wrong. Everything that is presented to you ( after you 'login' ) could be done completely without communicating to a wallet. ( maybe you should check web3 library, in order to understand ). Plus, node doesn't have to be on their servers/infrastructure, it could be on '3rd' party server ( infura.io for example ). You are always adviced to protect your funds via hardware wallet, or spin up your own node/wallet if you are afraid. – polux Sep 11 '18 at 13:16
  • I know it doesn't need to be on their server and could communicate with some other servers. but as wallet is on someone's server, that's too bad. thats why people use the binary wallets. (.exe installation , because it will be saved locally) . and about myetherwallet, wallet is stored somewhere in someone's hands :) – Giorgi Lagidze Sep 11 '18 at 13:20
0

In the case of Etheruem Wallet, the private key is encrypted with a passphrase and stored locally in an extensionless keystore file (JSON format, but no extension) with some additional data.

The public key is generated from the private key, and then encrypted into a json (keystore) file with your passphrase and something called salt, which is a randomly generated value.

The public key can be derived from the private key but the reverse is not possible. One can not derive the private key from the public key. The passphrase is used to encrypt the private key. So with the help of the passphrase, one can derive private key and with the help of private key one can derive public key. Passphrase -> Private Key ->Public Key

This is an inherent feature of the asymmetric cryptographic algorithm.

According to an accepted answer of this question, ethereum uses Elliptic Curve Digital Signature Algorithm to generate the key pair. You will have to implement the same in PHP.

  • but where is the wallet saved? THat's my question. look at myetherwallet.com . They say that they don't store my private key/public keys. when I enter private key on their website, it logs me in. how if they don't store it? so it turns out they store it right? where? in the wallet. then they can steal my money. – Giorgi Lagidze Sep 11 '18 at 13:16
  • myetherwallet stores your private keys in your browser's data store. – Soham Lawar Sep 11 '18 at 13:20
  • so it doesn't use any kind of wallet at all? – Giorgi Lagidze Sep 11 '18 at 13:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.