Pending Authorisations about unilogin HOT 1 OPEN

Actually storing the authorisation requests on chain - in conjunction with gas relayers - exposes the identity contract to griefing attacks (gas will be refunded to any and all authorisation requests). However storing the authorisation requests in the gas relayers still feels wrong - gas relayers should only relay signed transactions, as soon as their functionality is extended beyond this other attacks open up (such as substituting the key as per issue #159).
Interested in exploring good solutions that maintains a good user experience - e.g. user could request identity contract to issue a one-time authorisation code (to prevent griefing attack) combined with a visual key check (as per #159) to prevent malicious hijacking of the one-time code (by miner or gas relayer).

from unilogin.