Wallets, wallets everywhere, and not a one can think — Photo by on
Here at Hut34, it’s a core piece of our mission to drive adoption of crypto. currencies whenever and wherever possible. In discussing the possibility of a data marketplace, and a ecosystem where bots and A.I. can connect, route, resolve and monetise their data, the very first hurdle you hit is the requirement for each participant to have a valid ethereum address.
This may seem trivial to some, but in practice it’s an unnecessarily high bar — the whole process is just harder than it should be.
We wanted to change that, and that’s the driving force behind our creation of a Google powered Etheruem wallet.
When we say ‘Google powered’ we’re referring to a synergy of key Google technologies which allow an end user to create addresses, and send ETH and tokens (and by extension sign any transactions) — all without having to install software, or understand keystores, private keys and other important, but complex, crypto first principles.
This post is a quick introduction to the four planks of Google tech. we’ve harnessed to deliver this product, and you can also check out the entire presentation in the video link below.
The concept of abstracting address private key management to third party systems such as Google is a big one, and we recognise that. Your feedback is strongly encouraged! — What do you think of this solution?, what are your estimates of the trade offs made between personal autonomy and security / accessibility? — We don’t claim to have all the answers on this, but really want to stimulate a conversation, join us at to learn more.
The Security Model
Usually the first question raised when we discuss our wallet relates to security — actually usually the first 28 questions relate to security! This is somewhat of a ‘worlds colliding’ moment, where the cultures and tech involved in powerful centralised technology such as the Google Cloud Platform are seen as entirely independent of the values and tech involved in ‘blockchain’ projects such as token economies on the Ethereum blockchain.
In the future, we’ll speak further about why we don’t believe these paradigms to be in tension with each other, and how important it is for good teams and good practices to build bridges between these worlds, but for now we’ll stick to the detail on how we’ve ensured the best possibly personal security within our wallet model;
Stage 1 of 4— OAuth
OAuth is a wonderful, powerful thing.
The first stage of our wallet process is to require users to follow Google’s OAuth flow to create their wallet. Essentially this is us tying the use of a Google identity to a spot on Google Cloud Platform where we are going to store some data. Only a valid OAuth token matching that identity will be able to access this data, which in plain English means only a successful Google login is going to get you started in the wallet creation process.
Stage 2 of 4— Hidden app data in Users’ Google Drive
Once a user has created their wallet using a successful Google OAuth login, they’re prompted to give narrow permissions to our application to “View and manage its own configuration data in your Google Drive” — this is important because we’re going to encrypt and store a keystore password in this area. This important data is only accessible within the user’s own Google Drive storage.
Stage 3 of 4— the Google Cloud Platform
Once a user has completed their OAuth flow, and given us the appropriate, narrow, permissions to create their wallets, we use the magnificant ethers.js library to create their Ethereum address in their own browser (similar ‘client side’ technology to MyCrypto for example). The keystore is created with a randomised password, about which more in a moment, then stored in Google Cloud Platform, where it can be accessed given a valid OAuth token. We can be highly confident this data will remain available to our application.
Google Cloud Platform is jolly clever, and generally as reliable as Google. That’s pretty reliable.Stage 4 of 4 — Google Key Management Services
We’ve learned that the keystore will be stored on Google Cloud Platform, and require a valid OAuth token, and we’ve learned that we’re going to use hidden application data within a users Google Drive to store an encrypted version of the password for the keystore. The final piece of the puzzle then is how to encrypt and decrypt the password for the keystore. Google’s KMS gives us the answer — we use Key Management Services to manage all aspects of the encrpytion and decryption. Rather nicely, this brings many advantages for management of individual keys, an audit trail etc. etc. — Enterprise has been aware of the benefits of such processes for some time, but they have yet to penetrate the crypto world (in general terms).
Risk Management / Disaster planning
In the development of the wallet, we took advice from Google Partner Engineers to understand the risks better around our selection of Google tech. — in fact the use of KMS was specifically recommended as part of this process. The headline takeout from these discussions is that the wallet security is really most strongly tied to the security of the users’ Google account. Fortunately there are good resources available to help users understand their Google account security and improve it where possible;
In terms of ‘black hat’ access to this user data, and therefore users’ ETH accounts, it would require the simultaneous compromise of three discrete and highly secure Google systems — the OAuth flow, the Cloud Platform, and the Key Management System.
It’s our opinion that such an attack is highly unlikely. It’s actually significantly less likely than the compromise of one Google product alone, such as the Chrome browser. Were Chrome to be compromised, all traffic within that browser to such tools as would potentially be at risk — this is not a material risk in our view.
In Conclusion
We humbly submit that bridges between the crypto. world, and enterprise tech in general are vital in driving adoption at scale, and we humbly offer this wallet product as an example of the ‘incremental decentralisation’ we believe will offer the best path to better tech and a better planet.
The wallet is live now — please do take it for a spin here;
You can also review the entire codebase here;
If you can’t get enough of the whole idea, you can also see our initial presentation below, and watch a short demo of the wallet in action;
was originally published in on Medium, where people are continuing the conversation by highlighting and responding to this story.
CTO of Oulian Technology Dr. Song Chenggen was invitedto participate in InForSec’s “Blockchain Security and Privacy” seminar and share “Cryptographic Tools and Security in Blockchain” on April 8, 2018 at Tsinghua University.
Do you know everyone what is POINTIUM ?
Pointium is the blockchain who are based point management platform addressing for these problems.And then users of Pointium can easily integrate and manage Pointium tokens and their points for each company around the world in the Pointium Wallet. I think is very awesome right ?
Yeah of course, now what is the Pointium Wallet ?
Is system or user interface that allows you to manage, exchange, and integrate all partners’ points for PNT. PNT is Pointium (PNT), an ERC-20 token based on the Ethereum platform. PNT of course can be used as the unified tokens for points in the Pointium platform.
Did you know everyone , to provide the users of Pointium with the reasonable exchange rate, Pointium operates two economic models.
1.Pointium Exchange Model
Partnerships of Pointium can determine their own exchange rates for buy/sell and can also set the minimum points for exchange,an then lets the market decide the exchange rate, gives the partnerships the full control to reduce their point debts. And this model have limitation : can enable the Pointium users to experience the exchange loss.
2.Promotion Incentive Model
Provide a more reasonable exchange rate for the users by operate, it is the way to provide the users with more promotions of the partnerships who actively participate in the exchange.The partnerships can try to establish the more reasonable exchange rate to promote more loyalty program
And also everyone the Pointium targets are from the airline, hotel, and travel agency, which are the largest company in the point market, to online shopping malls around the world.
Everyone, being overwhelmed by the company’s too many loyalty programs using points, Pointium could not make good use of them. This resulted in direct asset damage to the users, and a poorly performed loyalty programs & an increase in the liabilities to the businesses.
Do you know everyone that the Pointium can solves current problems with a block-chain technology. With the lowest transaction fee and the safest way, Pointium integrates the points into Pointium tokens (PNT), and delivers the loyalty programs to the users.
Pointium is Higher Accessibility everyone, they lets you manage all yours points at once and exchange for PNT through Pointium wallet, very nice
Pointium have a goal for succesfully project is “ to corner the global point market by exchanging the points of companies all over the world for PNT, integrating into PNT, and using various promotions for PNT through Pointium Wallet ”.
Website :
ANN Thread :
Whitepaper :
Twitter official :
Profile Bitcointalk link :
Young and talented or successful and secured? ISOTIS puts an equal sign.
Is it possible for a young person to find a prestigious job?
This issue concerns millions of young people around the world. Even being talented, active and purposeful it is not always possible to be realized, for various reasons: lack of resources, connections or interfere with territorial restrictions.
As a result, we are engaged in various work which does not inspire us at all. We are motivated by stories about Harrison Ford, who worked as a carpenter and was able to realize himself as an actor after 30 years or Charles Bukowski, who wrote his first novel in 50 years. But should the search for a job and his vocation be so long and difficult? Youth — the time when we are full of energy, the desire to do something, follow the dream, besides we have a lot of strength and imagination. It is at this time that you have to do what you love, and what will benefit and success, because it is an important component of the modern world.
Progress does not stand still — and the development of technology makes prestigious and highly paid work more accessible to today’s youth. A good example is the implementation of the ISOTIS project. This project is built as an international virtual Corporation, where the core of developers and managers (responsible for communication of clients, employees and partners of the project) unites employees around the world. The project proposes work in the most different categories of specialists, and the development of their number will grow. Currently, ISOTIS employs marketers, web designers, java and C# programmers, as well as sales managers.
Throughout the year, this list will be supplemented by technical engineers, designers and editors. In addition, ISOTIS sees science as the basis of its activities, already using unique algorithms for the implementation of blockchain in client companies, the leadership of ISOTIS is ready to consider new technological innovations to connect them with blockchain as part of improving the quality of work with valuable and commercially relevant information.
Not only the technology of the distributed registry, but also neural networks, samebecause system and biological identification systems are included in the
spectrum of the interests of ISOTIS developers. If you are active, young and want to write your name in the history of technology-welcome!
Waiting for ISOTIS employees worldwide, and the first members of the Corporation ISOTIS in the case of particularly successful work — will get the chance to be cofounders of the project through the system of holding the internal currency ISOTIS KITcoins.
Work with us, grow with us, live with us!
Write on isotisjob@gmail.com for more information.
