RE: [Tutorial] How to add Steemit login to your site with SteemConnect

[abit]

SteemConnect doesn't store your password

That's not true.

Good tutorial. But I think we need to highlight the risks of using a login-related service.

Comments

[krnel]

Security and flow
On Log In
You fill your password or posting wif on Steem Connect login form.
If you filled a password it’s converted to posting wif in browser side.
The posting wif is encrypted with csrf token on browser.
A request is sent to the server with the encrypted posting wif.
Server decrypt the posting wif then encrypt it with a server secret salt and create a cookie which is saved in user browser.

I thought that meant it's not saving the password directly? I will gladly correct the post. Please elaborate. Thank you.

[abit]

I was wrong. My bad.

[fabien]

Sorry but you mistaken, that's true. SteemConnect never store your posting WIF. It stay on your cookie encrypted. Here some information about our flow: https://steemit.com/steemconnect/@busy.org/steemconnect-beta-release-note

[abit]

I was wrong. My bad.