Thank you for this post. He sheds light on the structure of the project.

That is a great insight into the technical aspects of how authentication works on Hive blockchain. Usually, we treat it lightly but is the most important component that puts our mind at ease at night...

Posted Using [LeoFinance <sup>Beta</sup>](https://leofinance.io/@behiver/re-arcange-6t3nkw)

Thank you for providing such a level of technical detail on HAS! I am convinced of its security, but what do you think about voting for or against it? Is there any reason not to support this proposal?

Just WOW - great job and a !BEER from me 

Will get my vote

!PIZZA
!BEER

<center><sup><h2>Hello @arcange… I have chosen your post about “-Hive Authentication Services - Protocol description-” for my daily initiative to re-blog - vote and comment…
![26.jpg](https://images.hive.blog/DQmRJBCofivGHH4P3PrxWUjRJp95BzHVnsjmQywGd1wFr9n/26.jpg)
Let's keep working and supporting each other to grow at Hive!...</h2></sup></center>

Keep up the good work @arcange am really enjoying to see this happening in this platform. It's really awesome

Following this closely for two reasons,  it's an awesome feature for hive, but also for the education.  These posts are really well explained and accessible.  A lot is way over my head but i am getting some good stuff.

Super nice diagrams (they help a lot understanding this). I can see already the Hard work behind the scenes... so well done for this.

Some questions from me for each of the steps:

### 1. Looks all good here. 😎
One request though, even if the QR code is a great way to simplify the validation of who is requesting, it would be nice to have a way to see the IP of who is requesting, to allow users to have a second way to troubleshoot things when they are not making sense.

I am thinking about phishing situations when eventually users get emailed with QR codes in the name of the apps asking for authentications (of course no one should do this).

This IP (or session) validation could be done either at the PKSA side (and visually validated by the user) or using a phishing code as 3rd-step of an MFA (in case you activate it) provided by the library the "apps" would need to use. Effectively stamping that "confirmed" session in the blockchain. Comments...

### 2. and 3.
How is the user able to understand if the transaction request is from the browser/app/host he/she is requesting/interacting with?

For example, if I use the phone to accept and broadcast a transaction that is initiated on my PC. Is there a mechanism that only allows this after the authentication happens (which I would say, that can either have protection towards the active session, or something like, identify the session with a name or IP)?

I am looking at the same perspective of what I described on the authentication, and I understand that at the same time we want to make this simple for the user. So, maybe either provide a way to identify sessions (if multiple are allowed) or only allow one to persist, forcing the user to first authenticate before going through sign/broadcast transactions.

The scenarios above are probably important for public places where wireless devices can be trying to listen and be also man's in the middle. But I agree for most situations it will not be a problem.


# Thanks
Cheers for all this work and the courage to deep dive into resolving this "complexity" problem for the community. Feel free to always tag me on these. My pleasure to support/review/discuss stuff like this. Hopefully, the proposal will go ahead.

Congratulations @arcange! Your post has been a top performer on the Hive blockchain and you have been rewarded with the following badge:

<table><tr><td><img src="https://images.hive.blog/60x60/http://hivebuzz.me/badges/toppayoutday.png"></td><td>Post with the highest payout of the day.</td></tr>
</table>

<sub>_You can view your badges on [your board](https://hivebuzz.me/@arcange) and compare yourself to others in the [Ranking](https://hivebuzz.me/ranking)_</sub>
<sub>_If you no longer want to receive notifications, reply to this comment with the word_ `STOP`</sub>

Would love to see your idea work. All the technical data above are confusing to me but it looks like it's for seamless and easier transactions. You have my vote :)

Ok NOW i love it <3 

I'm going to need to learn how to speak Blockchain 🙊 @oneup #oneup #hiveblogshare @doomz 

Pretty and Smart, we should marry this idea.

Hats off, great idea. Hive has to seemlessly fit in the web. 

Voting for the proposal. 

Nice job! It looks like the security of the protocol depends on how good communication channels are protected   ( I suppose You assumes protection by HTTPS or any other server authentication and channel encryption), otherwise, malicious actors may listen and/or spoof the protocol messages. My question is do You plan to use the Hive chain to hold information about the valid HAS servers and their public keys/certificates, or the system will depend on external certification entities ? I mean the App may ask the Hive Blockchain for a list of valid HAS servers and all the information required to establish a secure connection with them.

<center>![pixresteemer_incognito_angel_mini.png](https://files.peakd.com/file/peakd-hive/pixresteemer/8h7BBw1w-pixresteemer_incognito_angel_mini.png)</center><center>Bang, I did it again... I just rehived your post!</center><center>!PIZZA</center><center><sub>8</sub></center>

<center>PIZZA! PIZZA! 
PIZZA Holders sent <strong>$PIZZA</strong> tips in this post's comments:
pixresteemer tipped arcange (x1)
@eii<sub>(10/10)</sub> tipped @arcange (x1)
<sub>Learn more at https://hive.pizza.</sub></center>

@tipu curate