cypherpunk wannabe, engineer working on @frames /open-frames /opencast
https://stephancill.co.za create stories at https://stories.steer.fun

Developer 🤓 build, develop and operate Farcaster solutions @ dtech.vision also love tech, decentralization, fitness and oldschool rap 😎

I'm worried that Signers are not automatically expiring at some point.

This is a common practice in web2 (for API keys / tokens) and I believe Farcaster would greatly benefit form this as well (using a Farcaster epoch based timestamp).

any thoughts on this @stephancill  @samuellhuber.eth ?

Something that concerns me about the fc signer architecture is how it increases the attack surface area for your account the more apps you allow to sign on your behalf

This limits the propensity for users to try new apps especially if they have a large audience

Solutions: portable signers? Permissions? Sessions?

happy to see that this has been already discussed in some sort!
deactivating a signer sounds super interesting ( which was brought up by @vrypan.eth ). Generally speaking is this a topic that's currently discussed somewhere?

some discussion about this here

https://warpcast.com/stephancill/0xc6023bd1

I don't quite get why this would be an issue (besides of the gas-cost to renew/re-create a signer). the expiration should happen by-default through the timestamp.

a big difference vs web2 is that there is an explicit cost to creating a signer in the form of gas fees. this has way different UX implications to web2 API keys so it's not as simple as just expiring them unfortunately

i do agree that this is an important issue issue that needs to be addressed though