Sign in
A signature, not a password
The line you will sign
openattribute sign-in at …It names this site and the moment you pressed the button. It carries no permission, no amount and no recipient, because there is nothing here to permit, spend or send.
Signed with your posting key, and nothing else.
What happens, in order
- Keychain signs that one line, inside the extension.Your key is used where it already lives. It is not read by this page, not typed into anything, and not transmitted.
- Keychain answers with two facts.Which account signed, and which public key it used. The signature itself is not kept by this page, because nothing here would later have anything to check it against.
- This page asks a public node for that account’s posting authority.One ordinary read of
condenser_api.get_accountsagainstapi.hive.blog, the same call any Hive frontend makes. - The named key is compared against that list.Listed, and you are shown as verified. Not listed, or the node did not answer, and you are shown as signed, which says less and admits it.
Which key, and why that one
- postingPosts, votes, and the
custom_jsonoperations the register is made of. The least a Hive account can delegate, and everything this site ever needs. - activeTransfers, power ups, market orders. Never requested here. If any page on this site asks for it, something is wrong and you should refuse.
- ownerChanges the account’s other keys. Never requested here either, and it should not be sitting in a browser extension at all.
What this is not
Not a transaction
Nothing is broadcast. No block carries it, no witness sees it, it consumes no resource credits and costs nothing. Signing in leaves no trace on chain at all.
Not a password
There is no secret for this site to hold, so there is none to leak, reset, or be phished out of you later by something wearing its name.
Not an authority
It enables buttons. It permits nothing. Every write is signed again by Keychain at the moment it happens, and the chain checks that signature itself, so a forged session unlocks controls that fail at the only step that counts.
Not sent anywhere
There is no account system and no server of ours to log in to. Nothing about you leaves the browser, because there is nowhere for it to go.
What is remembered, and for how long
One string, in this tab’s sessionStorage, under the key oa_account: the account name, and nothing else. No signature, no key, no token, no expiry to renew. It is forgotten when you press Sign out and when the tab closes, and because it grants nothing, a copy of it is worth nothing to anybody who takes it.
Where it is thin, said plainly
The signature is not verified cryptographically by this page: Keychain is trusted to report honestly which key it used, and the chain is trusted for whether that key belongs to the account. The timestamp in the line is not checked for freshness either. Both are acceptable only because nothing is authorised by any of it. The moment something server-side trusts a sign-in, this needs a server-issued nonce, the signature actually transmitted and verified against the on-chain key, and an expiry. None of those exist yet, and pretending otherwise would be the kind of security theatre this page is written against.