I plan on maintaining a stellar account for each customer. My newbie questions:

  1. Are you supposed to store the public key of each user in the DB along with their friendly_ids? (doesn't this present a security problem?)
  2. If No, what is a better solution?
  3. Can I use one Federation Server between two or more anchors?
  1. Storing the public key is no problem at all. It's public so there's no security concern. If you meant secret keys then you might want to rethink whether you really need it -- I doubt you do just for federation.

  2. N/A

  3. Federation just lets others look up your address using your friendly id (or a source account + a memo). There's no reason why multiple anchors couldn't use the same federation server. But if you can clarify a bit more about your intentions I could maybe give a more in depth explanation.

  • I was thinking along the lines of Spam and other forms of malicious activities that can be executed against a large honey pot of addresses. Swapping PKs could result in payment being sent to the wrong ID's? I'm exploring the possibility of using Stellar as part of an Identity network with some type of decentralized federation. – Det Aug 9 at 8:53
  • Activated public keys can already be enumerated just by looking at the stellar database. Leaking information about which public key belongs to which person is a different concern that you may want to address -- but federation by its very nature is designed to allow this sort of information association. – Paul Aug 9 at 15:47

Your concerns about security are valid. The DBs which stores the federation records are potential targets for the hackers as they can replace the public keys in there redirecting all the payments made to those federation addresses.

We were submitting our solution for this problem to the 6th build challenge and got to the final with it. In short, our solution is to sign the federation records and validate the signatures on the client/wallet side. You can read more details about the issues with the current federation protocol and our solution (DKIF) on the following links:

  • Interesting solution. DNS Text records being put to good use. The compliance server encourages the storage of private keys for auth, wonder if this same solution can be used. Also would like to know what solution FI's are using? – Det Aug 15 at 12:37

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.