3

I am using web3 for users to sign some random string from web application. I give user string, he/she signs it after Metamask dialog's "Sign" button. but there is a problem when i want user to sign about 1000 random strings separately. there are unhandled amount of confirmation dialogs. what is the solution?

5

Signing a message is a privileged action, and MetaMask is correct to prompt the user every time they perform this action.

A signed message can be anything from a valid transaction to a "undeniable" message from the user. Any user signing messages which are being generated by a program should be fully aware of what exactly they are signing.

In your situation, it may make sense to not use MetaMask, but to use the private key of the Ethereum account you want to sign messages with to programmatically create these signed messages without any user input.

However, this would require that your users trust your application with their private key, and that would probably not be the best idea either... It might be best then to concatenate the messages in question and have the user sign a single longer message if possible.

  • so unlocking account isn't solution? – O. Shekriladze Sep 16 '18 at 10:58
1

The only way to deal with this situation is to use unlockAccount first, so that you unlock the account and you already have a signing mechanism and no need to use metamask sign. Just unlock it first and then deal with it.

1

Have you taken a look at Fortmatic yet? It seems to be a pretty good alternative to MetaMask and may resolve the problem you are having.

They seem to provide both "personal_sign" and "eth_signTypedData" functionalities.

  • fyi for others, Fortmatic is custodial (hold your private keys) while MetaMask is not – Miguel Mota Jun 12 at 0:17
0

Why do you need to sign 1000 string separately?

One possibility is to build a merkle tree from the strings and only sign the merkle root hash.

To validate an string you send the signature, the string and the merkle tree proof.

  • because.. imagine situation, where owner sells this randomly generated strings. this strings are publicly known. when I buy this string, I will get signature of owner so I can prove that I have definitely got this strings from owner. if each string will have similar signatures, you know, there will be a problem(If I buy one string, I will have proof of all rest strings). – O. Shekriladze Sep 16 '18 at 14:18
  • If the owner wants to generate and sell 1000 string then likely it will be done programaticaly, so similarly to sign them it is better to do it with a program. You can export your private key from metamask and use ethereumjs-tx to create a batch of signatures. – Ismael Sep 16 '18 at 14:28
  • but I can't export private key from Metamask programmatically, can I? – O. Shekriladze Sep 16 '18 at 14:32
  • 1
    It is hard to recommend a solution when we only know a very little part of your problem. How are the strings generated? Are they stored in a contract? Do you really need Metamask? Perhaps you can create a separate private key on behalf of your user and upload to a contract the generated address, now you can sign with the separate key without Metamask intervention. To verify call ecrecovery on the signature and the address stored in the contract. – Ismael Sep 16 '18 at 14:58
  • so where do I save this separate private key? so that user don't have to type this key every time he/she wants to sign some content – O. Shekriladze Sep 17 '18 at 8:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.