Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Use browser's payment key

See original GitHub issue

Currently, blockstack-browser uses the payment key from Blockstack core’s wallet.json file.

There’s a few ways we could try to remedy this, but the most direct approach is to have browser call PUT /v1/wallet/keys/{keyname} to set the payment key after the keychain initialization. This can be passed the persistent: True option so that the payment key is restored when the core node restarts.

Unfortunately, core remains in the user’s trust domain, so it needs to still be protected by a password. This is fine in Linux and macOS, where we already have ways of dealing with the password, but in the Windows distribution, we don’t have a password management story yet (but it could just be the same as Linux, i.e., manage your own core password.)

The only way around this is to actually move core out of the trust domain. That means transactions would be signed in the browser (at first, probably still broadcasted by core) and a handful of other things (app session authentication). I think that’s a big-ish project (mostly due to testing, because it could change the registration process somewhat dramatically), and we likely want a short-term fix for this issue with payment keys before trying to get all transactions signed by the browser.