A Browser Based Cryptocurrency Client [real devs only please]

bluemeanie1

sr. member

Activity: 280

Merit: 257

bluemeanie

Quote from: GCInc. on November 19, 2013, 01:43:06 PM

Quote from: Come-from-Beyond on November 19, 2013, 09:55:01 AM

I do have skills and a team, but I support only innovative projects. Bitcoin webwallet doesn't look innovative enough.

I'm not sure we're talking about the same thing, but I was thinking no webwallet, no external servers for anything else than blockchain storage. Local wallet integrated to the web browser. Maybe not innovative but what a step towards cryptocurrency mass adoption!

you certainly could improve the basic web wallet experience by:

1) keeping ECC keys in the HTML5 Web Store

2) forming and signing the TXs in the browser using Javascript.

-bm

GCInc.

hero member

Activity: 566

Merit: 500

Quote from: Come-from-Beyond on November 19, 2013, 09:55:01 AM

I do have skills and a team, but I support only innovative projects. Bitcoin webwallet doesn't look innovative enough.

I'm not sure we're talking about the same thing, but I was thinking no webwallet, no external servers for anything else than blockchain storage. Local wallet integrated to the web browser. Maybe not innovative but what a step towards cryptocurrency mass adoption!

Come-from-Beyond

legendary

Activity: 2142

Merit: 1010

Newbie

Quote from: Sukrim on November 19, 2013, 06:05:01 AM

It seems you want to connect clients to each other using WebRTC - why exactly?

To get rid of servers I suppose.

Come-from-Beyond

legendary

Activity: 2142

Merit: 1010

Newbie

Quote from: GCInc. on November 19, 2013, 05:49:43 AM

This is interesting, related to some client side js crypto on which I'm currently getting project work done. Are there plans for prototype development of a browser based wallet? Come-from-Beyond do you have the skills required or do you have a team?

I do have skills and a team, but I support only innovative projects. Bitcoin webwallet doesn't look innovative enough.

Sukrim

legendary

Activity: 2618

Merit: 1007

Ripple does this since about 1 year now - maybe have a look at their client too. The crypto used is similar, the server software is different from bitcoind. https://github.com/ripple/ripple-client, https://github.com/ripple/ripple-lib

Basically it is an SPV client in JavaScript that signs transactions locally and only communicates to its server via Websockets to get updates and to push (locally) signed transactions.

It seems you want to connect clients to each other using WebRTC - why exactly?

GCInc.

hero member

Activity: 566

Merit: 500

This is interesting, related to some client side js crypto on which I'm currently getting project work done. Are there plans for prototype development of a browser based wallet? Come-from-Beyond do you have the skills required or do you have a team?

Come-from-Beyond

legendary

Activity: 2142

Merit: 1010

Newbie

Quote from: bluemeanie1 on November 15, 2013, 03:45:44 PM

what you're suggesting?

(\__/)
(='.'=)
(")_(") secret phrase
------------------------------> [Browser] = FileSystem + WebRTC + some JS Crypto libraries

The browser signs transactions using the secret phrase and sends to some random peers. The list of peers is obtained via asking the user and sharing with other peers. A few peers not shielded by NAT is enough to build a network.

Protection:
- Virtual keyboard or mobile phone + microphone against key loggers
- Other computer or mobile phone for 2FA

bluemeanie1

sr. member

Activity: 280

Merit: 257

bluemeanie

Quote from: Come-from-Beyond on November 15, 2013, 03:25:36 PM

Quote from: bluemeanie1 on November 15, 2013, 03:21:18 PM

not hammering this down, I think it's a good idea. But to give it the proper security term, it's 2 factor auth.

1st factor: the 'Masterkey' numerical non-mnemonic artifact
2nd factor: hashed passphrase to produce subkeys

Adding 2FA u add a big hole in the security. Nothing should be stored, especially outside.

what you're suggesting?

Come-from-Beyond

legendary

Activity: 2142

Merit: 1010

Newbie

Quote from: bluemeanie1 on November 15, 2013, 03:21:18 PM

not hammering this down, I think it's a good idea. But to give it the proper security term, it's 2 factor auth.

1st factor: the 'Masterkey' numerical non-mnemonic artifact
2nd factor: hashed passphrase to produce subkeys

Adding 2FA u add a big hole in the security. Nothing should be stored, especially outside.

bluemeanie1

sr. member

Activity: 280

Merit: 257

bluemeanie

Quote from: Come-from-Beyond on November 15, 2013, 03:17:36 PM

Quote from: bluemeanie1 on November 15, 2013, 03:09:52 PM

again so if the Masterkey [1] is on the server(publicized) your point of weakness is the privacy of your password.

while password based security is more or less standard, it's not considered to be very strong and if that were the security model I don't think this system would offer much because, web wallets offer a similar security model (not as good though as what you are suggesting).

so in 'New Way' you cannot compromise the Bitcoin account without somehow gaining access to the wallet.dat that resides in the Browser(and no where else). You can easily add two factor auth by using the hash system you describe.

[1] don't like ideas that begin with 'Master' these days.

Masterkey is a secret key, no need to publicize it. U don't need wallet.dat at all if u generate addresses the way I proposed.

not hammering this down, I think it's a good idea. But to give it the proper security term, it's 2 factor auth.

1st factor: the 'Masterkey' numerical non-mnemonic artifact
2nd factor: hashed passphrase to produce subkeys

Come-from-Beyond

legendary

Activity: 2142

Merit: 1010

Newbie

Quote from: bluemeanie1 on November 15, 2013, 03:09:52 PM

again so if the Masterkey [1] is on the server(publicized) your point of weakness is the privacy of your password.

while password based security is more or less standard, it's not considered to be very strong and if that were the security model I don't think this system would offer much because, web wallets offer a similar security model (not as good though as what you are suggesting).

so in 'New Way' you cannot compromise the Bitcoin account without somehow gaining access to the wallet.dat that resides in the Browser(and no where else). You can easily add two factor auth by using the hash system you describe.

[1] don't like ideas that begin with 'Master' these days.

Masterkey is a secret key, no need to publicize it. U don't need wallet.dat at all if u generate addresses the way I proposed.

bluemeanie1

sr. member

Activity: 280

Merit: 257

bluemeanie

Quote from: jago25_98 on November 15, 2013, 03:03:00 PM

I'm sure blockchain.info's wallet unique selling point was to host as much as possible client side as a response to the MyWallet debacle.
Worth a look?
https://github.com/zootreeves/blockchain.info/blob/master/wallet.js

not fully versed in how their architecture works. I did see that browser based vanity generator which was perhaps the most advanced use of client-side crypto I've seen in the Bitcoin world. Whoever did that does know a thing or two about Crypto. Feel free to credit him/her in this thread if you know.

Quote from: jago25_98 on November 15, 2013, 03:03:00 PM

I've sent piuk a PM to let him know.

-j

btw, love the decentralised exchange ideas

thank you sir. If you want to be involved and you're not technical I can put you in touch with our community leader. This isn't a bluemeanie thing really, it's a community thing.

bluemeanie1

sr. member

Activity: 280

Merit: 257

bluemeanie

Quote from: Come-from-Beyond on November 15, 2013, 03:04:23 PM

Quote from: bluemeanie1 on November 15, 2013, 02:59:28 PM

I see so it's 2 factor auth.

so for your idea: the master key is in the browser store? is it unique to a user? to a set of accounts?

I don't see the 2nd factor there. It's like good ole password auth (before username began to be used).

Nothing is stored in the browser. User has to remember the phrase.

again so if the Masterkey [1] is on the server(publicized) your point of weakness is the privacy of your password.

while password based security is more or less standard, it's not considered to be very strong and if that were the security model I don't think this system would offer much because, web wallets offer a similar security model (not as good though as what you are suggesting).

so in 'New Way' you cannot compromise the Bitcoin account without somehow gaining access to the wallet.dat that resides in the Browser(and no where else). You can easily add two factor auth by using the hash system you describe.

[1] don't like ideas that begin with 'Master' these days.

Come-from-Beyond

legendary

Activity: 2142

Merit: 1010

Newbie

Quote from: bluemeanie1 on November 15, 2013, 02:59:28 PM

I see so it's 2 factor auth.

so for your idea: the master key is in the browser store? is it unique to a user? to a set of accounts?

I don't see the 2nd factor there. It's like good ole password auth (before username began to be used).

Nothing is stored in the browser. User has to remember the phrase.

jago25_98

hero member

Activity: 900

Merit: 1000

Crypto Geek

I'm sure blockchain.info's wallet unique selling point was to host as much as possible client side as a response to the MyWallet debacle.
Worth a look?
https://github.com/zootreeves/blockchain.info/blob/master/wallet.js

I've sent piuk a PM to let him know.

-j

btw, love the decentralised exchange ideas

Quote from: bluemeanie1 on November 15, 2013, 02:17:30 PM

Quote from: jago25_98 on November 15, 2013, 08:00:54 AM

Stating the obvious here,
but Mandrik from the client side blockchain.info might have a comment or 2 regarding browser security. Might be worth a PM once you have some more concrete ideas

thanks, but I think blockchain.info is a traditional web app? Haven't used it much really. He may have valuable advice, but the architecture I'm suggesting has few counterparts, here is one: https://chrome.google.com/webstore/detail/mymail-crypt-for-gmail/jcaobjhdnlpmopmjhijplpjhlplfkhba

Im somewhat versed in web app security.

thanks, bm

bluemeanie1

sr. member

Activity: 280

Merit: 257

bluemeanie

Quote from: Come-from-Beyond on November 15, 2013, 02:53:40 PM

Quote from: bluemeanie1 on November 15, 2013, 02:49:05 PM

and if someone cracks or steals the secret phrase? youre basically back to password authentication.

much less of a security problem if the phrase never leaves your own pc for sure, and might offer the right security characteristics for this architecture.

That's what I offer:

1. Ask for the secret phrase
2. Hash it with SHA-256 to get a master key
3. Generate Nth ECC private key as SHA256(master_key, N)

The secret phrase, the master key and the private keys don't need to be transfered nor saved. All that u need is to sign transactions using JavaScript.

I see so it's 2 factor auth.

so for your idea: the master key is in the browser store? is it unique to a user? to a set of accounts?

Come-from-Beyond

legendary

Activity: 2142

Merit: 1010

Newbie

Quote from: bluemeanie1 on November 15, 2013, 02:49:05 PM

and if someone cracks or steals the secret phrase? youre basically back to password authentication.

much less of a security problem if the phrase never leaves your own pc for sure, and might offer the right security characteristics for this architecture.

That's what I offer:

1. Ask for the secret phrase
2. Hash it with SHA-256 to get a master key
3. Generate Nth ECC private key as SHA256(master_key, N)

The secret phrase, the master key and the private keys don't need to be transfered nor saved. All that u need is to sign transactions using JavaScript.

bluemeanie1

sr. member

Activity: 280

Merit: 257

bluemeanie

Quote from: Come-from-Beyond on November 15, 2013, 02:45:09 PM

Quote from: bluemeanie1 on November 15, 2013, 02:39:50 PM

that's 'brand X', the web wallet. Im proposing the scenario on the right.

A secret phrase is enough to reconstruct thousands of ECC keys.

and if someone cracks or steals the secret phrase? youre basically back to password authentication.

much less of a security problem if the phrase never leaves your own pc for sure, and might offer the right security characteristics for this architecture.

Come-from-Beyond

legendary

Activity: 2142

Merit: 1010

Newbie

Quote from: bluemeanie1 on November 15, 2013, 02:39:50 PM

that's 'brand X', the web wallet. Im proposing the scenario on the right.

A secret phrase is enough to reconstruct thousands of ECC keys.

bluemeanie1

sr. member

Activity: 280

Merit: 257

bluemeanie

Quote from: Come-from-Beyond on November 15, 2013, 02:36:43 PM

Why do u need to store ECC keys? Use a secret phrase asked upon login to get a master key. Other keys can be derived from the master.

PS: What that server in the picture for?

that's 'brand X', the web wallet. Im proposing the scenario on the right.

Topic: A Browser Based Cryptocurrency Client [real devs only please] (Read 2636 times)