I visited the Ethereum All Core Devs call this morning to speak in favor of EIP-3074. Here's a little thread summarizing what I shared:

I visited the Ethereum All Core Devs call this morning to speak in favor of EIP-3074. Here's a little thread summarizing what I shared: https://eips.ethereum.org/EIPS/eip-3074

co founder of @metamask . Making computers behave for us.

EIP-3074 gives EOA holders to adopt smart contract patterns. This could eventually mean taking fully authorized 1 of 1 private keys off hot machines entirely, and ensuring far more people are using interaction patterns that we continue to refine for safety and usability.

3074 has has had criticism for involving a dangerous signature, but wallets have the ability to ensure this signature has the same saliency as exporting a secret recovery phrase.

Once an AUTH signature is signed, the wallet will have the opportunity to permanently adopt safer contract-based patterns, including ones where a user never needs to view or export a key, and a single signature can never transfer away all of that account's funds.

Contract accounts have many benefits, and 3074 can bring nearly all of them to EOAs:
- Batching
- Sponsored transactions,
- Approve & call
- Multisig
- Session keys
- Delegation ❤️

EIP-3074 *doesn’t* bring the ability to revoke its original key. It’s unclear whether that is possible, since an outstanding signature is often enforced by a third party contract that could be unknown to the signer, and so I’m glad that goal is beyond the scope of this EIP.

The current draft includes a mechanism that enables the revocation of the authorization, and so a hot signer could keep a revocation message available in case of emergencies found in a new contract account, even while not keeping the original signing key hot.

Contract accounts still have hard problems ahead for how to bring the most safety to their users, but at least with 3074 we can bring our existing hundred million accounts along for the ride. I'm excited for the protocol to be able to enable so much end-user safety.

EOAs have proven to provide an insufficiently flexible system for authorization for many people, and people are suffering millions of dollars in fund losses every day. This protocol change can give that ~100MM accounts new options for how to manage their authorization.

Known for the everywhere.computer (/ec), /unglish (unglish.co.uk), the /secure-design WG, WalletUncon, Causal Islands + drumming in all-genre power trios.

Is de-correlation possible? Definitely sounds like a different issue/goal to me.

👏 Yeah this one feels good the more I reflect on it.

The only unaddressed concern, for me, is correlating multiple accounts into a single "identity" and later orphaning them as "no longer part of this identity". 

That serves use cases beyond just account migration, though, so warrants a separate ERC/EIP.