BSIP: 0040 Title: Custom active permissions Authors: Alex M Fabian Schuh Stefan Schießl Status: Draft Type: Protocol Created: 2018-07-25 Discussion: https://github.com/bitshares/bitshares-core/issues/1061 Worker: # Abstract Strengthening user security is one of the main factors to elevate BitShares. Inlight of recent hacking and phishing attempts this becomes even more important. The need for a more sophisticated account security preceeded the idea for a finer-grained control of account permissions. We propose to add an additional authority to the account, called Custom Active (Permission). The permission contains a list of operationid-to-authority mappings that each grant access to the respective operation as if it were the active permission of the account. Additionally, the arguments of said operation can be restricted. # Motivation and Rational Any successfull hacking or phishing attempt on any of the web wallets that are powered by the BitShares Blockchain is bad publicity. The user needs to be educated in account security, and this BSIP aims to ensure all technical possibilities are met while being flexible to allow many use-cases. Examples: - Witness Key: Only allows update signing key and publish price feed - Trading Key: Only allows limit orders (arguments restricted to desired markets), update margin position and transfers (arguments restricted to certain accounts) - Proposal Update Key: Approve proposals (2FA comes to mind) The above list of named keys is nothing that is known to the backend as the backend should have an abstract implementation. The UI should provide a button "Create Trading Key" that properly configures the respective custom active permission entry. # Specifications # Discussion To be found in the forum - see link above. # Summary for Shareholders # Copyright This document is placed in the public domain. # See Also * https://github.com/bitshares/bitshares-core/issues/1061