Post APIxqU8xhHQjdFEDvU by hugot@mstdn.social
(DIR) More posts by hugot@mstdn.social
(DIR) Post #APIlr89RkZ8QGQzq40 by silverpill@mitra.social
2022-11-05T18:25:52.518261Z
2 likes, 2 repeats
Signing messages with Ethereum browser wallet is easy. But browser wallets are not private, they reveal your wallet address to a 3rd party (API provider), and often collect usage statistics and other data.I've been trying to implement signing with PGP keys but it seems that PGP is not an appropriate tool. I need to translate PGP public keys to did:key identifiers (to avoid extra lookups) but PGP data format is difficult to work with. You need to have access to low-level primitives to extract the raw public key, and though I'm using sequoia-openpgp (which is a great library, by the way), I still haven't figured out how to make it interoperate with other crypto libraries.I'm not giving up yet, but I'm considering signify or minisign as alternatives. Any other suggestions?
(DIR) Post #APIxqU8xhHQjdFEDvU by hugot@mstdn.social
2022-11-05T19:25:11Z
0 likes, 0 repeats
@silverpill Not a suggestion, sorry, just curious. Do mobile wallets using WalletConnect have the same problem?
(DIR) Post #APIxqUVeKvZulbqLI0 by silverpill@mitra.social
2022-11-05T20:40:04.482313Z
0 likes, 0 repeats
@hugot The lack of privacy? Yes, unless you connect your wallet directly to your own Ethereum node, there's some API provider involved. I haven't used WalletConnect but I think it relies on some centralized service for making connections between mobile wallet and a website.
(DIR) Post #APTheJ7VotGyQ7tn7I by silverpill@mitra.social
2022-11-11T01:00:38.146964Z
1 likes, 0 repeats
minisign is quite good and I'm going to use it. Its signature format is way simpler and the public key can be converted into did:key identifier.PGP would require a custom DID method so it's better to avoid it, at least for now