7

Context: I'm fairly new to web3, and as we all know it's developing quite regularly. I'm working towards a "sign in with Metamask"-type functionality using web3@1.0.0-beta.46.

Most of the docs/discussions online I've seen recommend using web3.eth.personal.sign over the other signing methods (at least for the purpose of signing a message to prove ownership of an address), but all examples I've seen online seem to ignore the third argument, password, which is described in the docs as "The password of the account to sign data with."

Up until 1.0.0-beta.38, the password argument could be left undefined, but with 38 now throws Invalid Arguments length: expected: 3, given: 2.

Looking at the docs, they provide an example: https://web3js.readthedocs.io/en/1.0/web3-eth-personal.html#sign

web3.eth.personal.sign("Hello world", "0x11f4d0A3c12e86B4b5F39B213F7E19D048276DAe", "test password!")
.then(console.log);

It seems silly to simply pass in a static string. There's gotta be something here I'm not getting.

Can someone clarify what the point of the password argument is? Is it to be used like a challenge or a salt? Should I pass in my nonce, instead of adding it to the message string? Am I way off?

I'll keep digging, but could use some guidance. Thanks.

edit: changing the password value doesn't change the signature.

Cody Django
  • 271
  • 1
  • 12
  • For anyone else with the same issue, the accepted answer in this post answers this: https://ethereum.stackexchange.com/questions/84763/sign-function-of-web3-js-for-authenticating-users-via-metamask – Windbox Feb 11 '22 at 17:29

1 Answers1

1

it is the password that you pass when calling function to create new account

https://web3js.readthedocs.io/en/1.0/web3-eth-personal.html#newaccount

Tony Dang
  • 2,151
  • 2
  • 9
  • 16
  • I've never created a new account. As a user, have a default account, and I might have imported accounts. But the application has never created a new account using web3. And it seems like I can sign a message for a user using their default account when passing any random string along to the "password" argument, which is why I'm confused... – Cody Django Feb 27 '19 at 21:08