Sign in with Stacks (SIWS)

[pradel]

This is a proposal to integrate Sign in with Stacks (SIWS) in Leather. The goal of this proposal is to have a standardised way for apps to ask users to log in easily and increase the security of users when they use this login method (by verifying the domain in the message).
It's a port of SIWE (in the evm ecosystem) for Stacks and is commonly supported by various wallets.
There is a SIP proposal that describes the message format, as well as an npm package that can be used for integration.
I am creating this issue to start the discussion and see if there is interest for Leather to integrate this.

References:

• siwe: https://siwe.xyz/
• how metamask is handling this: https://docs.metamask.io/wallet/how-to/sign-data/siwe
• Stacks SIP: Sign-in with stacks stacksgov/sips#70
• Stacks npm package to handle messages: https://github.com/pradel/sign-in-with-stacks

[linear]

LEA-3298

[pete-watters]

Thanks @pradel . We will discuss this as a team and get back to you soon

[kyranjamie]

Thanks @pradel, we're supportive of the initiative. Great that you published a package, this made it pretty easy to vibe code a demo, see #1835. Is this what you had in mind?

We can't make any immediate promise to merge this, but hopefully it can help push the SIP forward. We would need to run through design process and testing alongside other priorities to get this finished. We'd also love to see an implementation of your package in stacks.js/connect cc/ @janniks. It'd be great to see a SIP-30 style method described in the SIP too.

UX wise, many apps will likely need both addresses and a signature to authenticate. Should it be considered how these steps could be merged into a single flow?

[pradel]

@kyranjamie thanks for giving it a try! Yes, this is the idea. Some notes:

• I don't think we need a separate RPC call for this, we can use the normal sign RPC message call. The wallet should then check if the message is a SIWS message and display the custom screen accordingly
• Some important part missing is verifying the request origin and warn users if the origin doesn't match the current domain to prevent phishing attacks

UX wise, many apps will likely need both addresses and a signature to authenticate. Should it be considered how these steps could be merged into a single flow?

When you say this, are you talking about the BTC address?

[pradel]

Not stale

[camerow]

Yeah removed tag.

[camerow]

@kyranjamie @pradel

Opened a PR to prevent this from going stale - we want to support this initiative and want to keep this issue open while we plan to do so.