(Part 2/2) NEAR accounts & keys: two-factor authentication and the multisig contract

Captions as YouTube publishes them, usually machine-generated, so product and people names can be misheard.

1. 0:05

   this video was a follow-up to a previous one where we discussed near accounts and access keys uh in there we created a new testnet account on wallet.testnet.near.org shown here upper right hand corner we see that we have videos.testnet this is the one in creation of this we chose the seed phrase as a recovery option and then used near cli and what we're seeing here near wallet to take a look at the

2. 0:35

   different keys on the account we did not enable two-factor authentication 2fa as that would be a bit too complicated to explain in the initial explanation of how keys work but 2fa is the preferred choice especially for folks who don't have a hardware wallet we currently by the way do have ledger support on near cli and near wallet so in this video we're going to pick up where we left off enable 2fa and go through the workflow

3. 1:06

   of sending some near tokens and going through that like confirmation process then we're going to hear from matt lockier on how this is all working on chain uh explore the different steps involved and look at the multi-state contract and a bunch more so we could for this video just create a new account like videos2.testnet if it were available and then choose to enable 2fa but i think it'll be interesting to have kind of a roundabout approach this is going to be a rather

4. 1:39

   atypical workflow but it gives us an excuse to use some some tooling and learn some stuff so let's do it where we left off was we have one full access key on this account you can actually see it here in wallet another thing we did in the last video was we used near cli and you can use this command near keys videos.testnet and it will show all the keys as a reminder on near we have two types of keys full access keys and function call

5. 2:09

   access keys sometimes function call access keys are also referred to as limited access keys so here we have all of the keys for this account and we have just one full access key here here is the public key 5 dj 5 dj down here so those are two different ways of looking at it so by default when you're creating an account like this and before you enable 2fa you're going to have two full access keys

6. 2:45

   one of them will live in browser local storage it will look like this if you right click and do inspect choose the application tab local storage here we go and now i've filtered it for this particular account and this was the private key that was created upon creation in the last video however we demonstrated rotating keys out we showed the private keys plain as day in that video and so in order to

7. 3:15

   clean that up we use this private key on my computer that's a full access key and we deleted all the rest of the keys so we're in the clear so now we're in kind of a funny state where we have basically removed the full access ability of this browser local storage key so this guy can't do anything except just show that there's this account called videos.testnet on here it doesn't have any ability you if you try to send tokens with this

8. 3:48

   it's not going to work so let's use a very atypical workflow that i was talking about and let's just restore this a couple of near cli commands that sometimes confuse folks this is a great opportunity to go over that once again you just type near and you'll see a few different commands here and the two that i'm talking about are near generate key and near add key so generate key is basically going to be

9. 4:26

   the action that you do when you want your computer to use randomness to create an ed25519 private key and it'll also store the public key so just typing near generate key will not actually change anything on your account so let's actually do that near generate key and here we're going to do something kind of silly this is atypical let's just say atypical workflow so what does it say here key pair with ed25519 that's the elliptic curve

10. 5:04

    public key is been created for this weird account it goes without saying that if i already refresh this nothing has changed all it did was just create this particular file so we can actually see this by looking at same directory credentials default videos aha here is that file on our computer so it created it and it spat out this public key right here the second part if you want to add a key using near cli is to say near add key videos.testnet and then you can just

11. 5:42

    give it the public key if you don't give any more flags on this command it will create a full access game adding full access okay okay and as usual let's go to our explorer explorer takes a look at the blocks sees what the transaction fee was etc so now we have created a second full access key now there are two showing up here so now i am going to hide this part in the video but we are showing the private key in this json file it also has the public key has the account id

12. 6:29

    so i'm going to copy this go back and with some hackery going to update this value inside of the browser okay now that we have done that this logged in session essentially has that full access key so we can try sending some near to my.testnet confirm and send and it was done and you can see that in the upper right hand corner the near amount went down okay great so this is actually now we are at the

13. 7:21

    state that we would have been if we created a brand new account and didn't go through the last video i will mention that if you get confused by various near cli commands i highly recommend using this search up here in our docs which is docs.near.org pretty easy to remember and the search feature is actually a really good way uh if you're having a hard time navigating around it's a great way to see how to use this here's add key as for instance you can go down here

14. 7:54

    there's some examples it's pretty great now let's go and actually enable 2fa so on the upper right hand corner i'm going to click on my profile go to the profile landing so we are going to add a recovery method of email email recovery it's going to ask for my verification code there it is okay now we're going to make sure two-factor authentication is enabled um success okay so let's just

15. 8:47

    look at what's going on with the keys again okay i'm going to scroll to the top so it looks like we have a few different function call access keys now including one that only has one method for confirm others that have multiple methods interesting so we now have no full access keys on this account let's try sending some near and see what happens confirm and send enter two factor verification code so i'll be checking my

16. 9:44

    email here looking on the upper right hand corner we have 278 near now we're we're down so that is the confirmation process that just happened so this makes it so that you don't have a full access key like in your browser local storage and it uses a really interesting way of having smart contracts and multi-sig and this is where our friend matt locker can take over and tell us what the heck

17. 10:16

    is going on hello everybody i'm going to talk a little bit today about the multi-sig accounts contract and the two-factor authentication in the near wallet so we're going to start by talking about the near wallet two-factor authentication or 2fa and how that works and then we're going to talk about the multi-sig contract and the requests and confirmations that sort of make that happen

18. 10:42

    and then we're going to talk a little bit about some key management details so jumping right in normally when you use the near wallet in sort of an without two-factor authentication you would just sign a transaction on your side the client side because it's a it's a non-custodial wallet so you know we don't keep the keys you have the keys you would sign a transaction and then you would send it through rpc to get to the blockchain and then it would be included in a block

19. 11:15

    this signed transaction and then it would be validated executed state would change and then you would get a response back on the client side so nothing too complicated right now but in the near wallet uh two factor uh authentication sort of mode uh things get a little bit different uh because there's an added layer of security there so from the client side step one is basically for you to add and confirm a multi-sig request we'll take a look at what those are in

20. 11:46

    just a moment but that's basically just like signing any old transaction and then in the multisig contract that request is going to be created and then there's going to be one confirmation the first confirmation on that request and then we're going to move to the near wallet helper which will send out an email or a text message depending on how you have your second factor set up

21. 12:12

    and once you've received the email or the text message there's a code inside that and that code is so that you can prove to the near wallet helper that you have control over that device at that moment in time so you're going to go ahead and submit the code in the near wallet and that's going to send the code to the near wallet helper and the near wallet helper will then add the second confirmation to the multisig request

22. 12:41

    that was created uh back in step one and after that uh we're gonna include that in the blockchain so awesome so uh let's take a look at what multi-sig requests are and sort of how they work so mike mentioned in a previous video that we have these sort of primitive actions in in the near blockchain so we have like all these things you can do you can transfer you can create account deploy contract add key delete key these are sort of the primitive actions

23. 13:14

    of the near blockchain and multi-signature requests are kind of like nothing more than just sort of wrappers around these these primitive actions so if we look at the example where you want to send 1000 yakto we're going to send it to videos.testnet a multi-signature request it just looks like some json where you have a receiver id of videos.testnet and then you have a list of actions and in this case we only have one action the type is a transfer action which is a

24. 13:47

    lot like you know a regular near action and the amount is 1000 and that would be 1 000 yakto so when it comes to confirming these requests typically you deploy this multi-signature contract and you call a new constructor uh with an argument of two uh and and that's usually just sort of like a rule of thumb you want two or more confirmations so you want two factors um now you might want three or four or five if you have like a

25. 14:19

    dow or something crazy like that but in this case like basically with the near wallet it's just two two factors so we just have two confirmations and then there's a few other methods on the contract so there's add request ad request and confirm delete request and confirm so these methods can do a bunch of different things in the contract i'll show you a couple of sort of cases where we would confirm requests so in scenario one we would add a request and we would

26. 14:49

    send in that request data from before and then we would confirm with key a and confirm with key b the same request id so the qr each request kind of has a nonce so it's basically just a single like a number used only once right and so it's just basically this this request id and then it needs to be confirmed by separate keys so it always needs to be a different key that confirms and in scenario two actually it's more like how it works on the near wallet we

27. 15:20

    deploy the the multisig contract with an argument of two for two confirmations and then we call add request and confirm which means that we create the request in the multisig contract and we add that first confirmation for the first key right away and then we just call confirm with a second key from the near wallet helper so let's look at that confirmation flow one more time just in detail here so on your device you're going to add and confirm a multisig request

28. 15:51

    so then that's going to be included in the in the multi-sig contract so it's it's there and there's one confirmation and then the near wallet helper sends you this code you verify the code we trust that you have control of that second factored device and then we actually sign we have a key that can only confirm requests but we confirm that that second request for you so we add the second confirmation

29. 16:15

    and then the request is executed and eventually you know the transaction get the actions get executed and it's included in the blockchain so let's look at that key management one more time because this is sort of an issue around sort of how the security is laid out so on the near wallet side which is stuff in your custody you have function call keys you might have many of them and

30. 16:39

    they're scoped to adding requests adding a confirming request deleting requests so sometimes you might want to delete a request because you don't actually want to confirm it and then confirming requests as well so um that's all the keys that are in your custody and that's all all the methods that you can call with those keys then on the near wallet helper side we have the function call key that's scoped only to the confirm method so it can only call confirm on

31. 17:11

    the contract and this is important because you wouldn't want the near wallet helper to arbitrarily be creating requests uh on your behalf you know and and doing a bunch of stuff so it can only confirm requests that you've previously created with your keys the other way that we sort of watch out for your security is we have these services completely logically separated on like different hosting providers and there's no there's no single person inside the near foundation that has access to both of these services on

32. 17:41

    mainnet so that's that's great for security so bringing up mike's slide about keys one more time which i think is a really good one you have the full access key that can do all of the near primitive actions on your account and then you have these function call access keys that are limited to only calling specific functions so without the full access key you can't just arbitrarily perform all of these

33. 18:06

    actions with the function call access key your scope to specific methods of contracts that are deployed to your account and if we go back and look at these function call keys that you're in your custody and the function call key from the near wallet helper you can see how after a contract is deployed the multisig contract to your account and it requires two confirmations for a request

34. 18:31

    and there are no more full access keys this is the only way to interact with the contract so you have to interact with the contract first from your side by creating a request and confirming it with your key and then a key from the near wallet helper has to confirm that request adding two confirmations which means the request will get executed so this is now after that contract's deployed and after

35. 18:55

    these keys are set up that's really all you can do with this account and that's the only way to actually transfer fonts so this is sort of the last thing that kind of protects you is that there should be no easy way to access a full access key on this account you may still have a full access key as a recovery method though you might have a seed phrase for example so that's it that's how multisig works and that's how two-factor authentication

36. 19:26

    works in the near wallet i highly encourage you to reach out and to visit nir.help to check us out you can jump into telegram you can chat with us in discord we're very active you can also suggest topics on stack overflow we have a lot of questions and answers going on there and a big community going so get started and help us help us build some of the future businesses whether it's defy dows nfts art we're into all of this stuff

37. 19:58

    and uh and we're fun and we don't bite so come check us out and we'll answer all your questions i hope this video helped to show you a little bit about the multisig contract and also a little bit about how two-factor authentication works uh with the blockchain and if you have any questions you can find me on the discord and the telegram and i hope you can now potentially use the multisig contract in your project thanks