5

imagine there's a dapp you're building and on your website users type the receiver address, the value and what you do is send from that user's address to the receiver's address the value ether.

My questions are:

a) do you make users type their private key in an input field so that you can sign the transaction?

b) if you let them type the private key in an input field, then it's no safe right? how is the user sure you're not gonna save his private key somewhere?

c) if you don't ask him the private key, how are you going to sign the transaction programatically?

d) if you're using the metamask, it's easy, but let's say we don't use metamask. what are the options?

3 Answers 3

1

You always need a private key to sign a transaction in ECC based cryptocurrencies. If you want to offer this services on your website without using third party tools like metamask (which I would recommend to use if you insist on using a website), you have to ask for the private key. You have to ensure that the private key does not get send over the internet (even if you use SSL, it's just malicious behavior). That means that you have to execute the signing of the transaction on the client side. I personally would never use a website which asks for my private key.

1
  • 1
    Then, It's a problem because I have 1000 strings. What i want is to sign those transactions by private key and I want all of them to have different kinds of signatures. If I choose metamask, it means that there'll be 1000 confirmation dialogs on metamask which is horrible.
    – Chemistry
    Sep 16, 2018 at 13:18
1

what you do is send from that user's address to the receiver's address the value ether.

You can't do that for the same reason I can't instruct my bank to take the payment from your account.

Your questions imply server-centric thinking. I'm not 100% sure what you really need to accomplish with Ethereum, but I'm reasonably confident there's an elegant solution, but first, you need to reconsider some assumptions about the process, flows and the roles of client, server and contract.

If I understand correctly, you want:

  1. Alice chooses "a Bob" and sends funds from Alice's own account.
  2. There are thousands of Alice's i.e. many users.

Fair enough. There is nothing for the server to do to help this transaction along.

  1. Alice must sign all transactions from Alice, which should be fine because Alice needs to choose Bob.
  2. The funds will flow from Alice's account to Bob's account via the blockchain. There is no role for a centralized server in this arrangement.

How does Alice piece the transaction together? A user interface can help with that. Perhaps Alice chooses Bob once and then this is a default for future transactions? Perhaps Alice has a contact list? Those are UI concerns and a server can provide the browser with a fully formed transaction ready for her signature.

Wait. What if the server needs to run everything in a batch process? Given that the server cannot spend Alice's money, the solution is for Alice to send her money to the server, or to a contract under the server's control.

For example, suppose Alice wants the server to handle weekly payments of something for the next three months. She'll have to transfer funds to an account the server can use for this purpose. The payments will always be from the server, signed by the server.

Commonly, one would want the blockchain to record that the payment was on behalf of Alice. That sort of thing is an "argument" in the context of a transaction signed by the server. A contract can immortalize exactly what arguments are needed, exactly who/what is allowed to disburse funds. exactly what records are to be kept and can even serve as the trusted escrow account where Alice deposits and withdraws her funds.

a) do you make users type their private key in an input field so that you can sign the transaction?

NEVER

b) if you let them type the private key in an input field, then it's no safe right? how is the user sure you're not gonna save his private key somewhere?

NEVER

c) if you don't ask him the private key, how are you going to sign the transaction programatically?

Either the browser sends a transaction signed by the user, or the server sends a transaction signed by the server.

d) if you're using the metamask, it's easy, but let's say we don't use metamask. what are the options?

The Web3 API works with nodeJS. APIs are available for other environments. Deep down, one can use jsonRPC but it's "close to the metal" so not recommended unless you're making a wallet or something and need to get in that close.

Truffle is a favorite tool for high-level abstraction at the smart contract level.

Hope it helps.

1
  • Thank you so much Rob for the nice explanation. Basic question is I don't need one user to send another some ether. it's just an example illustration.User on my website has 1000strings. what I want him to do is to sign those 1000 strings with his private key. let's say i am using metamask. For that purpose, to sign 1000 strings individually with his private key, metamask's confirmation will pop up 1000 times. What i need him to do is to sign those strings with his private key each by each. That's why if he types his private key in input, i'd for-each loop and i'd do it. what do i do?
    – Chemistry
    Sep 16, 2018 at 19:39
0

Check this out: Sign the transaction using backend server without metamask

I think it is better to solve the problem using a back-end server, which means back-end server is the one responsible for all the blockchain transactions confirmation. The link shows how to make transaction without pop-up window from metamask - using provider from Infura.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.