Please describe your proposed solution.
Your browser extension web wallet is great, it comes handy when you need to pay online and use the Cardano DeFi, but I could do more for you. Most of your online needs are about managing each of your accounts with service providers. You must authenticate to access their service using username and password. Your service provider stores that data, and when they get hacked, your account passwords end up floating on the internet. To reduce that risk you use password managers, to use a different password on every service & keep track of them. On the provider side they give you two factor authentication. That is a terrible User experience, too many tools to use to solve a simple authentication problem.
Because of Blockchains we are spreading the use of cryptography as an infrastructure and we should make more use of it. Wouldn't it be awesome if your wallet would take care of authenticating you? It can, it is simpler and safer than any other alternative.
Your wallet is a secure system, it guards your keys safe. Instead of usernames, you give your public key, which reveals no information about your or your keys, yet unequivocally identifies you. To login into a service, you sign a login message and the service provider validates it. The signature will change, by its properties on each domain, time, and message you sign, it becomes a second factor authentication by construction(something you know: your wallet unlock password, something you have: your secret key), and it runs on your computer. Once the service provider validates your signature you are authenticated. Because the service provider does not store your password anymore, when they get hacked and suffer a data leak, no body can impersonate you as they don't have your private key. This is so much safer, because with this method we push the power and control back to the users.
This system is ready for the Cardano ecosystem. The wallet dapp connector CIP-30 gives you on your wallet the ability to sign messages, and the CIP-8 teaches developers how to sign arbitrary messages. What is missing is the backend infrastructure to help developers with this authentication form, and the education to users how to use this and why to prefer it. A big part of this project revolves around educating user and developers.
How does your proposed solution address the challenge and what benefits will this bring to the Cardano ecosystem?
As the Cardano ecosystem develops easier this solution becomes. Yet most of its current challenges are educational. This project mostly goes on the challenge direction of "Knowledge base & documentation". It is about teaching developers how to implement the authentication backend on their services, it is about teaching users how much safer this method is.
As you just read it, it is a two sided market place problem. Users need to want to login with their wallets, developers need to offer services people can login using their wallets. Yet which is the alternative?
Today, developers don't have enough security experience to implement secure password authentication protocols and secure password storage solutions. Regardless of how bad password authentication as a concept is. The safest solution today is to rely on OAuth, and that is secure and supported by today's tech monopolies. But that is part of the problem too, we must rely on those tech monopolies, we consolidate power and data with them. Although better financed than any individual developer, they are still prone to suffer hacks and experience data leaks. They are actually honey pots because all the data they have, putting them on a vulnerable position. And the power they have? Well they have not been role models of good behavior, why should we keep giving them more power?
This solution bring decentralization back into play. The cryptographic libraries are safe, the cryptography is safe. I'm not implementing my own cryptography, I build upon our safe system and so should all developers. If the user can authenticate with his wallet, there is no need for passwords at the service provider, there is no need to store them. You can't leak data you don't store. The cryptography is safe, there can't be identity forgery on this scheme. And because of the wallet nature of holding user funds, people take better care of their secrets. On top of that, people only need to take care of their wallet seed and unlock password, not of password, not a different one for every site, the dynamic nature of the signature takes care of that.
This project brings the Cardano ecosystem forward by educating developers and users how to better embrace cryptography, decentralization and become self-sovereign.
How do you intend to measure the success of your project?
A market has supply and demand, this project would have availability and usage. The more each project offers authentication over this method the more successful will I consider it. This is an easy feature to monitor, in the same way projects offer to connect to your web wallet, which by the way does not provide authentication it provides an anchor to the user wallet for payment transactions. Yet services can offer through authentication offer users access to restricted parts or services of their project.
As an example, since micro transactions are not intended for the L1. The users can authenticate to a service and pay a larger fee. Then through future authentication to the same service they can keep using the service without spending an new transactions each time.
The fact that you now have authentication also allows to personalize information to each user, personalize services, and create new offerings.
The measure of success is how much the ecosystem embraces this feature and that can be measured by counting projects that include next to their wallet connection an authentication option.
The developer productivity will grow, as this becomes an established practice. Because developers will know where to search and learn for this service.
Please describe your plans to share the outputs and results of your project?
This project is educational modules, and the corresponding code templates for developers to incorporate this authentication protocol in their services.
Building is not enough of course, communication is extremely important, and I will hold many more YouTube tutorials to teach developers and users how to embrace the features.
All software will be BSD-3 clause, which is the most liberal open source license, allowing everybody to incorporate the software without any legal worries as much as to read the code and modify it. That is important for adoption as some application developers will not release their software source code yet they need to use this open sourced library.
The documentation will be creative commons licensed.
From previous Catalyst funded projects, I know things take longer than expected. I do plan to offer enough software libraries in the first 3 months while continually releasing YouTube tutorials. The last 2 months of this project timeline are to dedicated evangelize the developer and user base to embrace this authentication standard.