A Browser Based Cryptocurrency Client [real devs only please]

[bluemeanie1]

that's 'brand X', the web wallet.  Im proposing the scenario on the right.

A secret phrase is enough to reconstruct thousands of ECC keys.

and if someone cracks or steals the secret phrase?  youre basically back to password authentication.

much less of a security problem if the phrase never leaves your own pc for sure, and might offer the right security characteristics for this architecture.

[Come-from-Beyond]

and if someone cracks or steals the secret phrase?  youre basically back to password authentication.

much less of a security problem if the phrase never leaves your own pc for sure, and might offer the right security characteristics for this architecture.

That's what I offer:

1. Ask for the secret phrase
2. Hash it with SHA-256 to get a master key
3. Generate Nth ECC private key as SHA256(master_key, N)

The secret phrase, the master key and the private keys don't need to be transfered nor saved. All that u need is to sign transactions using JavaScript.

[bluemeanie1]

and if someone cracks or steals the secret phrase?  youre basically back to password authentication.

much less of a security problem if the phrase never leaves your own pc for sure, and might offer the right security characteristics for this architecture.

That's what I offer:

1. Ask for the secret phrase
2. Hash it with SHA-256 to get a master key
3. Generate Nth ECC private key as SHA256(master_key, N)

The secret phrase, the master key and the private keys don't need to be transfered nor saved. All that u need is to sign transactions using JavaScript.

I see so it's 2 factor auth.

so for your idea:  the master key is in the browser store?  is it unique to a user?  to a set of accounts?

[jago25_98]

I'm sure blockchain.info's wallet unique selling point was to host as much as possible client side as a response to the MyWallet debacle.
Worth a look?
https://github.com/zootreeves/blockchain.info/blob/master/wallet.js

I've sent piuk a PM to let him know.

 -j

btw, love the decentralised exchange ideas

Stating the obvious here,
 but Mandrik from the client side blockchain.info might have a comment or 2 regarding browser security. Might be worth a PM once you have some more concrete ideas

thanks, but I think blockchain.info is a traditional web app?  Haven't used it much really.  He may have valuable advice, but the architecture I'm suggesting has few counterparts, here is one:  https://chrome.google.com/webstore/detail/mymail-crypt-for-gmail/jcaobjhdnlpmopmjhijplpjhlplfkhba

Im somewhat versed in web app security.

thanks, bm

[Come-from-Beyond]

I see so it's 2 factor auth.

so for your idea:  the master key is in the browser store?  is it unique to a user?  to a set of accounts?

I don't see the 2nd factor there. It's like good ole password auth (before username began to be used).

Nothing is stored in the browser. User has to remember the phrase.

[bluemeanie1]

I see so it's 2 factor auth.

so for your idea:  the master key is in the browser store?  is it unique to a user?  to a set of accounts?

I don't see the 2nd factor there. It's like good ole password auth (before username began to be used).

Nothing is stored in the browser. User has to remember the phrase.

again so if the Masterkey [1] is on the server(publicized) your point of weakness is the privacy of your password.

while password based security is more or less standard, it's not considered to be very strong and if that were the security model I don't think this system would offer much because, web wallets offer a similar security model (not as good though as what you are suggesting).

so in 'New Way' you cannot compromise the Bitcoin account without somehow gaining access to the wallet.dat that resides in the Browser(and no where else).  You can easily add two factor auth by using the hash system you describe.



[1] don't like ideas that begin with 'Master' these days.

[bluemeanie1]

I'm sure blockchain.info's wallet unique selling point was to host as much as possible client side as a response to the MyWallet debacle.
Worth a look?
https://github.com/zootreeves/blockchain.info/blob/master/wallet.js

not fully versed in how their architecture works.  I did see that browser based vanity generator which was perhaps the most advanced use of client-side crypto I've seen in the Bitcoin world.  Whoever did that does know a thing or two about Crypto.  Feel free to credit him/her in this thread if you know.

I've sent piuk a PM to let him know.

 -j

btw, love the decentralised exchange ideas

thank you sir.  If you want to be involved and you're not technical I can put you in touch with our community leader.  This isn't a bluemeanie thing really, it's a community thing. 

[Come-from-Beyond]

again so if the Masterkey [1] is on the server(publicized) your point of weakness is the privacy of your password.

while password based security is more or less standard, it's not considered to be very strong and if that were the security model I don't think this system would offer much because, web wallets offer a similar security model (not as good though as what you are suggesting).

so in 'New Way' you cannot compromise the Bitcoin account without somehow gaining access to the wallet.dat that resides in the Browser(and no where else).  You can easily add two factor auth by using the hash system you describe.



[1] don't like ideas that begin with 'Master' these days.

Masterkey is a secret key, no need to publicize it. U don't need wallet.dat at all if u generate addresses the way I proposed.

[bluemeanie1]

again so if the Masterkey [1] is on the server(publicized) your point of weakness is the privacy of your password.

while password based security is more or less standard, it's not considered to be very strong and if that were the security model I don't think this system would offer much because, web wallets offer a similar security model (not as good though as what you are suggesting).

so in 'New Way' you cannot compromise the Bitcoin account without somehow gaining access to the wallet.dat that resides in the Browser(and no where else).  You can easily add two factor auth by using the hash system you describe.



[1] don't like ideas that begin with 'Master' these days.

Masterkey is a secret key, no need to publicize it. U don't need wallet.dat at all if u generate addresses the way I proposed.

not hammering this down, I think it's a good idea.  But to give it the proper security term, it's 2 factor auth.

1st factor: the 'Masterkey' numerical non-mnemonic artifact
2nd factor: hashed passphrase to produce subkeys

[Come-from-Beyond]

not hammering this down, I think it's a good idea.  But to give it the proper security term, it's 2 factor auth.

1st factor: the 'Masterkey' numerical non-mnemonic artifact
2nd factor: hashed passphrase to produce subkeys

Adding 2FA u add a big hole in the security. Nothing should be stored, especially outside.

[bluemeanie1]

not hammering this down, I think it's a good idea.  But to give it the proper security term, it's 2 factor auth.

1st factor: the 'Masterkey' numerical non-mnemonic artifact
2nd factor: hashed passphrase to produce subkeys

Adding 2FA u add a big hole in the security. Nothing should be stored, especially outside.

what you're suggesting?

[Come-from-Beyond]

what you're suggesting?

(\__/)
(='.'=)
(")_(")    secret phrase
------------------------------>  [Browser] = FileSystem + WebRTC + some JS Crypto libraries

The browser signs transactions using the secret phrase and sends to some random peers. The list of peers is obtained via asking the user and sharing with other peers. A few peers not shielded by NAT is enough to build a network.

Protection:
- Virtual keyboard or mobile phone + microphone against key loggers
- Other computer or mobile phone for 2FA

[GCInc.]

This is interesting, related to some client side js crypto on which I'm currently getting project work done. Are there plans for prototype development of a browser based wallet? Come-from-Beyond do you have the skills required or do you have a team?

[Sukrim]

Ripple does this since about 1 year now - maybe have a look at their client too. The crypto used is similar, the server software is different from bitcoind. https://github.com/ripple/ripple-client, https://github.com/ripple/ripple-lib

Basically it is an SPV client in JavaScript that signs transactions locally and only communicates to its server via Websockets to get updates and to push (locally) signed transactions.

It seems you want to connect clients to each other using WebRTC - why exactly?

[Come-from-Beyond]

This is interesting, related to some client side js crypto on which I'm currently getting project work done. Are there plans for prototype development of a browser based wallet? Come-from-Beyond do you have the skills required or do you have a team?

I do have skills and a team, but I support only innovative projects. Bitcoin webwallet doesn't look innovative enough.

[Come-from-Beyond]

It seems you want to connect clients to each other using WebRTC - why exactly?

To get rid of servers I suppose.

[GCInc.]

I do have skills and a team, but I support only innovative projects. Bitcoin webwallet doesn't look innovative enough.

I'm not sure we're talking about the same thing, but I was thinking no webwallet, no external servers for anything else than blockchain storage. Local wallet integrated to the web browser. Maybe not innovative but what a step towards cryptocurrency mass adoption!

[bluemeanie1]

I do have skills and a team, but I support only innovative projects. Bitcoin webwallet doesn't look innovative enough.

I'm not sure we're talking about the same thing, but I was thinking no webwallet, no external servers for anything else than blockchain storage. Local wallet integrated to the web browser. Maybe not innovative but what a step towards cryptocurrency mass adoption!

you certainly could improve the basic web wallet experience by:

 1) keeping ECC keys in the HTML5 Web Store

 2) forming and signing the TXs in the browser using Javascript.

-bm