No verification of website

[MaSven]

With this i don't know who the website is. So this is easy phishable as i can just forward the signature.

[62726164]

I plan to switch to signing a nonce rather than the current time. Only the website and the user would know the nonce. A fake nonce would not be recognized by the real website.

[intob]

An alternative would be appending the unix timestamp with the host domain. This limits the scope of the signature to the domain (or subdomain).

In a recent project, I switched from nonce to timestamp signing for two reasons:

• Eliminates a round-trip to request the nonce
• Server must not remember any nonce for the client (completely stateless)

You also don't need to store the whole public key (if you don't want/need), just a hash of it. The client can then send the pub key with the signature, and you can verify that it matches your stored hash.

My implementation of this approach: https://github.com/npchat/go-npchat/blob/main/auth.go#L53

Replay is still an obvious vulnerability. There is a simple way to address this. Only accept a given timestamp once. This only requires you to store timestamps within your chosen validity threshold (e.g 5 seconds ahead or behind).

[62726164]

Yes, adding the domain to the timestamp is another good idea to limit the scope.

Thanks for the comment and the link.