[beem] one-time private key / wallet compatibility

Repository

https://github.com/holgern/beem/
(https://github.com/steemit/steem-python While this is the official Steem Python library, it is not maintained well, so beem (thanks to holger80) is de facto standard. But the suggestion applies to both, and I made PRs for both libraries.)

Components

I've actually made an implementation for the first idea and will do the second if the PO wants.

• one-time private key use without storing it in the wallet
  • Issue
    • (beem) https://github.com/holgern/beem/issues/162
    • (official) https://github.com/steemit/steem-python/issues/280
  • PR
    • (beem) https://github.com/holgern/beem/pull/163
    • (official) https://github.com/steemit/steem-python/pull/281
• wallet compatibility with the official Steem Python library
  • Issue: https://github.com/holgern/beem/issues/164
  • If the PO (holger80) wants to accept the idea, I'd like to implement this.

Proposal Description

1. one-time private key use without storing it in the wallet

Currently, if a private key can't be found in the wallet, there is no way to enter it manually. This isn't good if a user wants to use the key just one time, not storing it in the wallet.

Instead of raising MissingKeyError immediately, it's much better to give users a chance to enter the private key manually.

This isn't not just for convenience, but also for extra security for certain cases.

• Users may feel safe to store keys on the server for unimportant accounts, but not very important accounts.
• Users may want to store the posting key only in the wallet but use the active key manually only when it's needed (e.g., transfer). (While I don't have much STEEM/SBD/SP, as a practice, I don't store my private active key on my remote server. But when I'm on the terminal, I feel safe to enter my private key manually, of course when it's not echoing)

Mockups / Examples

Before

$ beempy transfer -a ned blockchainstudio 5000 SBD 'small gift'
Wallet Unlocked!
Traceback (most recent call last):
  File "/usr/local/bin/beempy", line 11, in <module>
    sys.exit(cli())
  File "/usr/local/lib/python3.6/dist-packages/click/core.py", line 764, in __call__
    return self.main(*args, **kwargs)
  File "/usr/local/lib/python3.6/dist-packages/click/core.py", line 717, in main
    rv = self.invoke(ctx)
  File "/usr/local/lib/python3.6/dist-packages/click/core.py", line 1163, in invoke
    rv.append(sub_ctx.command.invoke(sub_ctx))
  File "/usr/local/lib/python3.6/dist-packages/click/core.py", line 956, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "/usr/local/lib/python3.6/dist-packages/click/core.py", line 555, in invoke
    return callback(*args, **kwargs)
  File "/usr/local/lib/python3.6/dist-packages/beem/cli.py", line 813, in transfer
    tx = acc.transfer(to, amount, asset, memo)
  File "/usr/local/lib/python3.6/dist-packages/beem/account.py", line 2394, in transfer
    return self.steem.finalizeOp(op, account, "active", **kwargs)
  File "/usr/local/lib/python3.6/dist-packages/beem/steem.py", line 950, in finalizeOp
    self.txbuffer.sign()
  File "/usr/local/lib/python3.6/dist-packages/beem/transactionbuilder.py", line 306, in sign
    raise MissingKeyError
beem.exceptions.MissingKeyError

beempy transfer -a ned blockchainstudio 5000 SBD 'small gift' means, ned wants to transfer 5000 SBD to blockchainstudio with a memo 'small gift.' Obviously, I don't have ned's private active key.

Currently, if the private key of the user (ned in this example) who needs to sign the transaction doesn't exist in the wallet, it produces MissingKeyError Exception and the program exits.

After

$ beempy transfer -a ned blockchainstudio 5000 SBD 'small gift'
Password to unlock wallet:
Wallet Unlocked!
The required private key can't be found in the wallet.
Private key to sign:

Note that this is an actual output of my PR: https://github.com/holgern/beem/pull/163

If the required private key can't be found in the wallet, now it gives users a chance to enter it manually for a one-time use.

2. wallet compatibility with the official Steem Python library

While now beem library is even more standard than not so actively maintained the official Python library, some people still hope to use the official library at least together with beem.

While the wallet of beem is actually compatible with steem-python (beem shares most base codes with steem-python), there is no feature such that users can use one shared wallet. Or at least wallet import function should be provided (just in case the steem wallet is deleted).

Mockups / Examples

One workaround is to create a symbolic link as follows.

ln -s [steempy wallet file] [beempy wallet file]

which actually works.

Whether creating the symbolic link or import (copy) the wallet, it's better to ask users if they want as follows:

The steempy wallet is detected. 

(N): Created a new wallet for beempy.
(I): Import (copy) the steempy wallet (Safe even if the steempy wallet is deleted)
(S): Make a symbolic link to steempy wallet (The wallet will be lost if the steempy wallet is deleted.)

Choose the option [N/I/S]: 

Benefits

• Extra private key security for a one-time use
  Not all people use python library frequently. In that case they may feel uncomfortable to create the wallet from the beginning. Thus, providing the option of a one-time use of private key can be important to them.
• Saving the posting key only and entering the active key only when it's needed
  This also enhance the security of the active key use.
• Mistake prevention (e.g., transfer)
  If you only store the posting key, then even if the wallet in unlocked, you're asked to enter your active key, which can prevent transfer mistakes, for instance.
• Convenient testing
  Likewise, for a one-time testing purpose, storing keys in the wallet might be too much. Also, suppose you use a trusted computer but not your own. To make some transaction you need to store the key which both of you and the owner of the computer may not want.
• Compatibility
  Even though it is much less frequently maintained, the official library is still working for most purposes, and many people are still using it. So the wallet compatibility provides convenience for users who want to use both libraries or switch from steem-python to beem.

GitHub Account

https://github.com/economicstudio