Hmmm, well TREZOR requires a web plugin. So if nobody inst= alls plugins then we have a problem :) But regardless, actually like I said= , you don't need a plugin. Browsers do it all already. With the <key= gen> tag they even create a private key and upload the public part to be= signed for you, it's seamless for the user. I wanted to give you a lin= k to a demo site, but I can't find it anymore :(

So there's not even a need for people to upgrade anythin= g! It's all there, already, for everyone.

If y= ou were to make some upgrades, then you'd want to focus on key manageme= nt, which indeed is something the Bitcoin world is trying hard to solve. = =C2=A0But that's a small subcomponent. =C2=A0Making a modified version = of Chrome or Firefox that can take their key from a BIP32 hierarchy or 12-w= ords scheme is certainly possible, but then you could still reuse all the r= est of it.

Something I'd really like to see is TREZO= R supporting a simple request/response protocol that a server can trigger, = via the USB plugin, that would allow a server to display some arbitrary tex= t and get a confirmation. Slush and I talked about it before. There are a L= OT of places that don't care about Bitcoin but do need some kind of saf= e second factor auth where users know what they are confirming (e.g. at Goo= gle!). If TREZOR could be used for these things too, that'd increase de= mand and help push down prices for Bitcoin users.

<= div class=3D"gmail_quote">On Fri, Apr 4, 2014 at 5:09 PM, Eric Larchev=C3= =AAque <elarch@gmail.com> wrote:

=
On Fri, Apr 4, 2014 at 4:56 PM, = slush <slush@centrum.cz> wrote:

I'm cracking my head for many months with the idea of = using TREZOR for web auth purposes. Unfortunately I'm far from any usab= le solution yet.

My main comments to your BIP: Don't= use bitcoin addresses directly and don't encourage services to use thi= s "login" for financial purposes. Mike is right, mixing authentic= ation and financial services is wrong. Use some function to generate other = private/public key from bitcoin's seed/private key to not leak bitcoin-= related data to website.

I'm probabl= y very naive, but the fact that the authentication key is your Bitcoin addr= ess was for me a great feature :)
What are the risks associated o= f id yourself with a bitcoin address you plan to use on the website for tra= nsaction ?

I mean, what is the difference between doing that, and = id with a login/pass and add your bitcoin address in a settings field ? (kn= owing you could always find a mechanism to transfer the account to another = bitcoin address if needed)

Eric