Disallow operations on the network with server side stored private key about blockchain-carbon-accounting HOT 14 CLOSED

Restricting all token creations operation to auditors makes sense. Even if it is to just initialize a request. See comment in issue637 for handling new carbon tracker requests from an oil & gas operator.

from blockchain-carbon-accounting.

Not sure we need to limit transactions to accounts that have opted to store their keys on the server side when signing up.

It is better practice for accounts to hold keys directly, in line with the principles of web3.0 transaction. But an auditor may prefer to use a key management service.

Server side key management was introduced to the user sign-up function to help with onboarding of consumers that don't have the experience operating a server side wallet.

Should NET provide its own internal cloud key management for signing transactions? It already does in the referenced video, but with limited security.

from blockchain-carbon-accounting.

What do you think of signing the transaction on the server, instead of transferring the private key to the client and signing it there?

from blockchain-carbon-accounting.

@sichen1234 I was just writing this up...

Here are some ideas for improving security.

Private keys never leave the server side to sign transactions, only when exporting keys and permanently deleting it from the server. This is structurally different from what was shown in the referenced video. Transaction messages could be sent encrypted to the server (using the public key) where the message is decrypted and signed. However, this requires creating a secure communication line between the client and server for a given signing session ....

from blockchain-carbon-accounting.

Use the window.Crypto object (a secure way to use javascript to access the DOM) to store privateKeys in the client browser when receiving them from the server during sign in.

from blockchain-carbon-accounting.

The Wallet interface with private key is loaded around here from the server on the sign in page

from blockchain-carbon-accounting.

As discussed at the end of this older post a variety of modern browser features can be used to securely store the keys with the client -- this is basically what browser extensions like Metamask achieve

from blockchain-carbon-accounting.

from blockchain-carbon-accounting.

both require similar security development.

Keeping keys on the server limits attack vectors to server breaches. The benefit of moving the signing to the client is probably the legal context in how the server uses the private keys.

If the server is setup to sign transactions on behalf of the client, but used in a malicious transaction, the company operating the server could be held accountable.

The user agrees to the terms associated with the key management service provided by the client interface. Assuming the server provider makes all precautions to deliver the key securely, the clients are accountable for signing transactions.

from blockchain-carbon-accounting.

A secure and legally sound client application should have baked in client key gen and storage (e.g., electron or mobile app).
Both of the above are patchy solutions at best.

from blockchain-carbon-accounting.

from blockchain-carbon-accounting.

Agree.

As long as the signed in user is only received retired tokens, no need to access the privateKey.

Minimize key management to the bare minimum, and rely on third party wallet party providers and custom built client applications.

Suggest putting private keys into a separate write only schema, with read access limited to key export and deletion.

Once transferable tokens are issued to the user (e.g., offset credits or carbon trackers), the keys must be exported to access the tokens.

Another more secure option is to instruct the server to use the keys once to transfer the tokens to a new public address generated by the users external wallet. This eliminates security risk from potential breach of the original private keys - but would come with additional transaction costs.

from blockchain-carbon-accounting.

Question, if a client has connected their external wallet to NET, is there a form they can use to register information about their public address with the Postgres server - e.g. organization, name, email... ?

I have started a separate discussion on handling user information using Distributed identity management tools. A topic of discussion for future development.

from blockchain-carbon-accounting.

from blockchain-carbon-accounting.