User authentication (with backend verification) about apiary HOT 2 CLOSED

Another approach:

• Users are stored in the database with their public address and a random nonce
• Upon authentication users fetch their nonce
  • New users are created and a nonce is returned
  • Existing users just fetch their nonce
• The nonce is signed and sent back to the server in exchange for a session token
• The nonce is set to a new random number for next time

Pros:

• Easier to manage than TOTPs
• Simple design, technically and for the end-user

Cons:

• Theoretically possible that a user's nonce is set to the same number as a spent nonce at some point (can be mitigated)

from apiary.

Sort of already implemented and we can extend it if needed.

from apiary.