What the DigiByte Foundation says its Digi-ID protocol does, how wallet-based sign-in generally works, and the questions to ask before trusting any passwordless system.
The general pattern of challenge-response sign-in
Where the risk sits
What the flyer says
The source for this page is a one-page introduction to Digi-ID published by the DigiByte Foundation. It describes the Digi-ID Open Auth Protocol as passwordless authentication that uses DigiByte mobile wallets and blockchain cryptography. The goals it names are removing the username and password and cutting the friction of signing up for new services.
The flyer also makes several practical claims. It says the protocol can run side by side with ordinary passwords, so that existing users can upgrade by linking a Digi-ID to their account. It says plugins exist for common website platforms, that Digi-ID is free for users and integrators, and that its development is sponsored by the DigiByte Foundation. Finally, it argues that data-leak risk falls because there are no credentials to steal. Further information is directed to digi-id.io.
Because this is promotional material from the project’s own sponsor, we treat each of those statements as a claim, not an audit result.
The general idea: prove you hold a key, do not hand over a secret
A password is a shared secret: you tell the site, and the site keeps a copy (ideally a protected one) to compare against. If the site is breached, or you reuse the password elsewhere, the secret can be stolen and replayed. Wallet-based sign-in tries to replace that with a challenge. The site gives your wallet a one-time message; the wallet signs it with a private key that never leaves your device; the site checks the signature against the matching public key.
The diagram below shows that general pattern. It is an illustration of how challenge-response sign-in works in principle, not a description of Digi-ID’s exact message format, which you should read in the project’s documentation.
Where this helps
There is nothing to remember and nothing to type, which removes weak and reused passwords and makes phishing for a password pointless. A site that stores only public identifiers has far less of value to lose in a breach. For a business, it can also shorten sign-up, because the account starts with a scan instead of a form.
The “upgrade an existing account” path described in the flyer is a sensible design choice. Forcing everyone onto a new method at once rarely works; letting people link a wallet to an account they already have lowers the risk of locking users out.
Where the risk moves
Removing the password does not remove the need to protect something. The private key now carries the weight, so a stolen, infected or unlocked phone matters more. Key loss matters too: if a wallet is lost without a backup, the account tied to it may be hard to recover, and a recovery route that is too easy becomes the new weak spot for attackers.
Phishing also does not disappear. A malicious site or a fake QR code could try to trick someone into approving a sign-in they did not intend, so users still need to check what they are approving. And a blockchain wallet is a more demanding thing to ask of ordinary users than a password manager, which is a real adoption question.
Questions to ask before trusting any passwordless system
Where is the private key stored, and what protects it? How are lost devices handled, and can an attacker use that process? What does the site learn about me, and can different sites link my activity together? What happens if the service behind the protocol changes or stops? Is the code open to review, and has anyone independent examined it? Does the site still keep a password fallback that attackers can aim at instead?
These are the same kinds of checks we apply to the national and travel identity schemes in our Known Traveller Digital Identity explainer, and the same idea of stronger authentication and access control appears in the WEF cybersecurity leadership principles. Our digital identity topic page collects the wider concepts.
Sources
- Digi-ID Open Auth Protocol: introduction (one-page flyer). DigiByte Foundation, undated.
This article is our own summary and commentary. The reports remain the property of their authors and publishers; read the originals for full detail. Spotted an error? Tell us. See our editorial policy.