Building a seedtool that runs in a web browser

[Sjlver]

Hello everybody out there using seedtool!

Since I've discovered Blockchain Commons and its projects like ByteWords, seedtool, UR, and SSKR, I've been fascinated by the clarity and simplicity of the ideas. These are tools that I've long wanted to have. Seedtool in particular would be fantastic to safely generate secret key shares, if only I could be confident about running it securely.

What I want is a seedtool that anyone can easily run on an airgapped device. That is why I am proposing to build a seedtool that runs in a standalone HTML/JavaScript page in a web browser. This means that any cheap old smartphone or laptop can be used to run it, without any prerequisites and without having to compile anything. I am looking for motivated contributors who want to help me in this endeavor.

The principles of this project

• Build a single-page app that can be run in any browser.
• It works completely offline. It can be run in an incognito window, with all traces deleted once the window is closed.
• Core features:
  • Generate seeds
  • Generate seed shares and show them as ByteWords, URs, or QR codes
  • Show seed as BIP-39 so it can be imported in a wallet
  • Reconstruct a seed from shares (This is a bit secondary, but I would like users to only need one single tool for handling their seeds)
• Security is paramount:
  • Code should be very readable, easy to inspect, with few dependencies
  • The page can warn the user if the device is not in airplane mode (by trying a network request) or not in incognito mode (by looking for old previously-stored cookies)
  • The page can include clear and simple instructions for users, e.g., what to do with their shares.

Besides the Blockchain Commons projects, another source of inspiration for this is https://github.com/iancoleman/bip39 -- That tool handles the mnemonic -> address conversion, whereas my proposed seedtool would handle seed -> mnemonic and seed <-> shares.

Status and where to go from here

I've created a git repository at ➡️ https://github.com/Sjlver/seedpage where the tool will be developed.

If you'd like to contribute, simply open an issue or discussion topic on that repository. All sorts of contributions are welcome, even just ideas or suggestions.

[ChristopherA]

This is great 👍

We have an upcoming internship program this summer and I was going to suggest something similar as a suggestion for them. The minor difference was to leverage web assembly like @wolfmcnally did for the static https://LifeHash.info webpage (or even start with a fork the repo at https://github.com/BlockchainCommons/lifehash.info )

[shannona]

If that sounds OK to you, @Sjlver, I'll get it going.

[Sjlver]

@shannona cool for me. I've emailed you to coordinate.

[Sjlver]

We should probably also parallel the Lifehash repo approach of where he puts the live web assembly LifeHash.info in a subfolder (I think).
That way we can offer signed releases of the web page as well (which is particularly important with this project.)

This is how seedpage currently works, in fact. I copy it to the /docs folder, which then gets published through GitHub pages at https://blog.purpureus.net/seedpage/.

[shannona]

@Sjlver Great! I've created a "seedtool.info" repo and sent you an invite for maintain perms.

So, please feel free to populate it. A few notes:

1. As @ChristopherA suggests, we'd probably do well to parallel the lifehash repo organization (https://github.com/BlockchainCommons/lifehash.info) for ease of use.
2. We grabbed the seedtool.info domain, so it'd be great if we could set up a live version of the demo as well. @wolfmcnally can offer advice on how he did it with lifetool.info if needed.
3. Definitely integrate your README.md material with your standard README.md text. I can fill in the rest of the template if you'd like when you're done with your first pass, just let me know.
4. We need a signed CLA. That's at https://github.com/BlockchainCommons/seedtool.info/blob/master/CLA.md and should be put in the Signed-CLA directory.

If you have any questions or if anything isn't right, just let me know.

[Sjlver]

Quick update: I've pushed a new version to https://blog.purpureus.net/seedpage/ -- now with QR codes.

[ChristopherA]

This is great 👍

I read you blog post — I presume you are aware of KeyTool-cli? https://github.com/BlockchainCommons/keytool-cli

Combination of both in Web Assembly could be really useful.

Also let us know if you’d be interested in contributing this work as an official Blockchain Commons project with you as lead. Advantages are reviews of PRs, long-term support and integration as we update libraries, and we hope to be investing soon in third-party security reviews.

[Sjlver]

Thanks :) I'm glad that you like the project.

Yes, I am aware of keytool-cli. It might indeed be nice to integrate. I would just like to carefully think about the user experience and the security.

• Simplicity is important to me, and I'm not yet 100% sure that having one integrated (but more complex) tool is better than two separate ones. To me, the essential use case of seedpage is securely generating Shamir shares of an identity. For all the other parts I'd probably use separate tools, particularly hardware wallets.
• There are already a few browser-based wallets or keytool-like systems, e.g., https://github.com/iancoleman/bip39. These already support the "keytool in a browser" use case to some extent.

Also let us know if you’d be interested in contributing this work as an official Blockchain Commons project with you as lead.

Absolutely. The caveat being that this is a hobby project for me. I'm doing it completely in my free time and won't be able to invest more than a handful of hours per week. As it says in the license, this software is provided by the copyright holders and contributors "as is" and any express or implied warranties, including, ... the implied warranty of it being maintained for a long period of time, is disclaimed ;-) But if this condition is OK for you, then I'd be happy to make this an official part of Blockchain Commons.

[wolfmcnally]

Simplicity is super important, as is security. In my opinion, on the web accessing the general command line tool isn't as important as an interface targeted toward specific user stories, the example you gave being using SSKR to shard or recover a seed used as an identity.