Do we need an AuthServer? #35
Description
I've been looking at the readme file, and the problem which this project aims to solve is very important. Even I've been working on this, but not getting much time to work on this/ would like to contribute.
From the Readme, I see that purpose of AuthServer is to verify signatures. Here, phone and computer are peers and they have to depend on the AuthServer as a middleman for functioning. I think a server is not required to verify signatures since it's pure Elliptic Curve Cryptography which means the phone and computer can do themselves. A computer browser can generate a random number, this number should be relayed to the phone using something like WebRTC for it so sign it using the private key and can relay the number with the signature back to the computer browser UI and a continuous WebRTC connection can be established between the browser and the phone. Further, signature requests for every action from the dApp can be sent to the phone for signing as long as the connection is active.
Currently, there is a service called WalletConnect. My concerns are that the connection is through a centralized server. It means if their server shuts down for a few minutes, users won't be able to use their phone to sign transactions on a dApp running on their computer.
It'd be really great if we can establish a local connection using something like WebRTC, in case the user's computer and phone are on the same WiFi network and only use a centralized server if both devices are not on the same network. P2P communication between the computer and phone can remove the dependency of an authentication server.