Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hedgehog Ethereum wallet: Build DApps like apps, without centralized keys

hedgehog.audius.co

Post reply on HN
Print view View original

51–57 of 57 posts

Re: Hedgehog Ethereum wallet: Build DApps like apps, without centralized keys

#51

Post by vinliao »

solotronics wrote: post #45
vinliao wrote: post #44

Earlier quoted context omitted.

Hey Roneil, I'm really new to crypto development and I'm having a hard time finding crypto communities for developers (the one who builds stuff). I've checked out eth's forum but it's not really developer focused, it's too general. Where do you usually hang out? I would like to learn more about building crypto stuff and would like to participate in a community. Can you point me in the right direction? Thank you! PS:…

For lightning protocol devs there is a public slack they hang out in. You might want to look around for one for Eth.

I haven't tried finding crypto communities on slack, maybe I can find some good ones there.

Thanks for the suggestion!

Re: Hedgehog Ethereum wallet: Build DApps like apps, without centralized keys

#52

Post by roneil »

vinliao wrote: post #50
roneil wrote: post #49

Earlier quoted context omitted.

Hi there! Unfortunately I haven't found any high-quality online communities of crypto builders - most of my connections to other folks building are offline / irl. Would encourage you to attend local developer groups to get to know others in the space! There are tons of helpful resources online though, as lots of folks write tutorials and other things. Googling most problems you face will yield good results.

Oh wow that's really unfortunate. I met some crypto people locally but almost all of them are trading focused. I also attended some "blockchain events" but most of them are just people shilling their coins/how to become a better trader. Maybe I haven't tried hard enough finding the builders. Thank you Roneil, and good luck on your endeavors!

Sorry to hear that - I've had good experiences in the past at Hackathons and other developer-focused events rather than general "crypto" or "blockchain" events.

Good luck!

Re: Hedgehog Ethereum wallet: Build DApps like apps, without centralized keys

#53

Post by tuesdayrain »

vinliao wrote: post #44
roneil wrote: post #5

Hey all - I'm Roneil, one of the cofounders of Audius. We built Hedgehog to solve a specific pain point we faced - how can we get non crypto-native / non-technical users to sign up for a decentralized app? Current onboarding flows using Metamask and other alternatives were too cumbersome, time-consuming, and restrictive for our needs. We needed a way to generate a wallet on behalf of a user without them even knowing…

Hey Roneil, I'm really new to crypto development and I'm having a hard time finding crypto communities for developers (the one who builds stuff). I've checked out eth's forum but it's not really developer focused, it's too general. Where do you usually hang out? I would like to learn more about building crypto stuff and would like to participate in a community. Can you point me in the right direction? Thank you! PS:…

r/ethdev is a good one. Much more developer focused than r/ethereum.

Re: Hedgehog Ethereum wallet: Build DApps like apps, without centralized keys

#54

Post by trentonv »

ErikAugust wrote: post #15

Certainly a much needed application in the Ethereum space. As a blockchain game developer, I have talked ad nauseum ( https://steemit.com/marketing/@steem.marketing/cache-the-gam... ) about reasons why we switched away from Ethereum for most transactions (but not all). The UX of the wallet being one difficulty for adoption. There are other even bigger reasons (in my opinion) - variable mining fees per transaction bei…

lol I made an account just to add this reply. Are you familiar with EIP 1559? There are solid efforts currently ramping up research to change the fee market from an auction to a flat fee:

https://ethereum-magicians.org/t/eip-1559-fee-market-change-...

Re: Hedgehog Ethereum wallet: Build DApps like apps, without centralized keys

#55

Post by roneil »

xrd wrote: post #48
miguelmota wrote: post #47

The hedgehog library is completely unsafe considering that any third party library or browser extension loaded in the website using the SDK can loop through localStorage to read the entropy value therefore recreating the hd wallet and stealing the user's account.

This. This is why FinneyFor uses an iFrame to keep the private key safe in localStorage only accessible from JS running on the same domain. FinneyFor uses postMessage to communicate between the parent frame when payment is processed, so you get the benefits of creating transactions in any kind of browser, but none of the risks as the parent rightfully points out. https://finneyfor.com/

We documented this here: https://audiusproject.github.io/hedgehog-docs/#security-cons...

This is why we recommend that you audit all 3rd-party Javascript in your app for accesses to localstorage, and avoid sourcing 3rd-party javascript from uncontrolled origins (the code could be switched out from under you if it is not baked into your application)

The post message model is an interesting one - we looked into designing Hedgehog in that way, but decided it ultimately did not help solve this issue and created unnecessary complexity. If you include Javascript from libraries or other origins on your page, eg. Google Analytics, that Javascript could still post-message into your iframe.

Perhaps we are wrong here though! Is FinneyFor open-source? Would love to see how this is implemented.

Re: Hedgehog Ethereum wallet: Build DApps like apps, without centralized keys

#56

Post by xrd »

roneil wrote: post #55
xrd wrote: post #48

Earlier quoted context omitted.

This. This is why FinneyFor uses an iFrame to keep the private key safe in localStorage only accessible from JS running on the same domain. FinneyFor uses postMessage to communicate between the parent frame when payment is processed, so you get the benefits of creating transactions in any kind of browser, but none of the risks as the parent rightfully points out. https://finneyfor.com/

We documented this here: https://audiusproject.github.io/hedgehog-docs/#security-cons... This is why we recommend that you audit all 3rd-party Javascript in your app for accesses to localstorage, and avoid sourcing 3rd-party javascript from uncontrolled origins (the code could be switched out from under you if it is not baked into your application) The post message model is an interesting one - we looked into designi…

We don't have any other js libraries on FinneyFor so there would never be that problem.

Auditing the source code of all libraries is a tall order. And, even if you don't find a bug, there still might be some that someone else could exploit with bugs in your code and the js libraries.

Finney For is not open source.

Re: Hedgehog Ethereum wallet: Build DApps like apps, without centralized keys

#57

Post by danfinlay »

alexgpark wrote: post #6

Looks compelling, been waiting for something like this to come along. Built a couple dapps with Metamask and the popups and mnemonic phrases and browser extension installation were a serious UX issue that had no real workaround and seemingly no timeline for improvement. AFAIK, development seems to have slowed or stopped entirely on Metamask? Will try working with this and share any feedback. Nice work guys, thanks fo…

MetaMask is actually working hard on these problems, and building faster than ever, but they're big problems that aren't trivially fixed in a point release. You can expect some big announcements this summer.
Post reply on HN