Skip to content

Portal Specs: wallet handling

Jump to bottom
Jelle edited this page Apr 4, 2018 · 6 revisions

Wallet/keystore handling

"First visit"

This is the default modality on a first visit on a new device

  • User arrives on app with no keystore in localStorage (no items of the form localStorage.getItem('keystore-*') are found in localStorage)
  • A new account is generated for the user
  • The wallet is now unlocked and ready for signing transactions (accessible as paratii.eth.wallet)
  • The serialized wallet encrypted using a default empty password ('') and saved in localStorage (using the key keystore-anon)

"Anonymous Usage"

If the user takes no specific action, she will continue to use the wallet from keystore-anon

  • User arrives on app and finds a keystore under localStorage.getItem('keystore-anon')
  • App tries to unlock the account with default empty password
  • If the app succeeds, user continues as on first visit

"Securing and personalizing the account"

Before the user starts handling real money or data associated with his account, we ask him to create a new, secure account.

This happens as follows:

  • A new account is created on the basis of a mnemonic phrase.

  • The user is urged to save that phrase. We will not save it anywhere - there will be no way for the user to recover the phrase later (<-- we can change this, and save the mnemonic encrypted with the password chosen below)

  • Choose a pin, 1234.

  • The new wallet will now be saved, encrypted with the pin, in localstorage, under the key keystore-secure

  • Any funds from keystore-anon will be transfered to the new keystore

"Existing user on known device"

If an encrypted keystore is found on the device, the device must be of an identified user.

  • User logs in, app find an encrypted keystore in localStorage.getItem('keystore-secure')
  • App asks user for the PIN (we may save a cookie with the password to make this more transparent)
  • Keystore is unlocked and she can transact now

"Existing user on new device"

The user has created an account on device A, now visits paratii on device B.

  • User logs in on device B. An anonymous account will be created by default
  • User wants to use her existing account. She will (where?) be prompted to insert the mnemonic from device A.
  • She can now choose a password (which is local for device B, and can be different from that of device A)
  • Serialized wallet and mnemonic are saved as before

"Log out"

There is no real "log out" action, but we may add the possibility to lock the wallet. "Locking the wallet" means: removing the decrypted wallet from the state - we'd only have the serialized encrypted wallet in localstorage. Note that the application is basically unusable without having a wallet. The user can unlock the wallet by inserting the (local storage) password, or, alternatively, regenerate it with the 12-word seed.

"Multiple users on the same device"

If more than a single user want to use the same device, we must have a mechanism to save different wallets in localstore and access them.

this case considerably complicates matters, both UX as well as storage - I'd leave it in the backlog for now

  • User arrives on new device which already as a non-anonymous keystore
  • User is prompted for the password but also get the choice to create a new account; user chooses the latter
  • A new account is created (just as when in anonymous navigation)
Clone this wiki locally