Cast by ramitphi
Show the cast this replies toi am trying to figure out like managing signer keys in secure way, is it something warpstack will also include as i find it very crucial from security aspect
1 reply
yes that's handled. all signer keys are generated and stored on mobile hardware. Secure Enclave on iOS right now before I add Android support. i have thoughts on improving the UX for the average user here because I dont think adding your phrase to every client is the best UX, nor is it secure. The more we learn to just freely paste our phrases everywhere the more likely someone is to get rekt.
hard agreed on this part: dont think adding your phrase to every client is the best UX, nor is it secure i was coming from that space when they authenticate from farcaster client and sign the permission for a key which act as signer when they post; so how to securely manage those keys as someone building my own client, because I remember a instance where rish's key was misused by some attack on certain client's backend
all signer keys are generated and stored on mobile hardware so as a client I do not have to manage those keys? am i right or missing something ?
correct users store their own signer keys on their own hardware. your server never touches keys. heck even client javascript on their phone doesn't see it. this is pretty opinionated towards self custody.
