A few hours ago, I published a post proposing some solutions on implementing an auth system for the upload API. Among the 3 solutions, each of them breaks at least one method of authentication.
In summary:
- Solution 1 breaks SteemConnect auth as it does not support decrypting messages with posting key
- Solution 2 breaks private posting key auth as there's no way to generate an access token for it
- Solution 3 breaks SteemConnect auth also as it does not support signing a message with posting key. Assuming that signature verification is just not documented (but supported) in Steem-JS, it will not break the other two.
With a high chance of DTube depreciating SteemConnect auth on their official frontend, it's time to find out how our users authenticate on our uploader website to decide if we should make changes on the auth methods available.
A new branch has been created on the uploader GitHub repository to collect data regarding auth methods used when uploading files to our IPFS node. All data collected regarding auth methods are anonymous.
This investigation will last for a duration of 7 days.