Google and Apple have an absolute stranglehold on what apps developers can make because 99% of downloads are from their app stores.
Both Google and Apple won’t allow apps that use crypto for IAPs - if we want dApps on mobiles we will need a decentralised app store. Is anyone working on this?
IOHK is working on a dApp platform embedded right into Daedalus already. It will allow users to list, download, and run dApps right in the Daedalus. So I reckon the same could work in the mobile version of the Daedalus.
UPD: and I mean they are writing it as we speak. Some first basic features already passed the first level testing.
Sirin labs is also working on something similar for their prototype blockchain-based smartphone called finley.
What language should I pick up to write dApps on Daedalus?
Solidity, or Plutus, or IELE, or any other K-supported language, to write smart-contracts for the Cardano itself, and prolly JS/TypeScript to create a GUI that can be embedded into Daedalus and use its API to interact with it.
But it’s a speculation at this point, no official info on languages yet, afaik. The main point of the embedded app-platform, tho, is so that devs can create lots of applications without asking user to enter his private key in each of them. So any dApp can try to interact with existing user wallets thru API, but they would have to ask for permissions, and Daedalus would ask user for confirmation. Private keys would stay safe in the Daedalus itself.
Wouldn’t that be centralised?
if IOHK don’t like your app it doesn’t get listed.
Three sentences in the white paper. Also, hope you didn’t give them your money.
I doubt it would be. They are building a decentralised open-source blockchain client - would be weird to include a centralised app-store in there. I reckon they would make it as decentralised as possible at this point, with dApps’ meta-data being registered on-chain.
Official info on all of this is yet to be released, of course.
I believe this is part of the update this August. He mentioned it this morning to his surprised AMA, regarding mobile update. So I guess it has something to do with this.
I’m very careful to whom i give my money. But, as this is the first blockchain based smartphone afaik, it’s an interesting project. I didn’t participate in the ico and i have not pre-ordered a finney.
Granted that they give little to no information in the whitepaper. I get the feeling that they don’t want to put out to much information regarding the dApp store as a security measure, that’s what one of the admins on their telegram group have told me. (Kind of dubious, i agree. But it would take some more time for blackhats to reverse engineer what they are building, i think the measure might backfire as flaws would not be detected as fast as in an open source setting. But we’ll have to wait and see)
Overall i will be following the release to see if they can deliver on the project, because imo, it is an amazing bridge to adoption for the space. It should be released in oktober this year and cardano might be able to integrate by then (Charles mentioned that daedalus 1.4 would probably be a good starting point looking towards integration with the finney, IOHK is hoping they can reuse a lot of the work they are doing for the ledger integration, which will be included on 1.4 around oktober)
Exiting times ahead, i love the merit of the project and once i can confirm everything works as it should i might actually buy one (it all depends on the quality and level of execution ofcourse).
How would they ensure that dApps are legit on a decentralized platform? Could a malicious actor wrote a code to steal your hot pk when you install an extention on Daedalus?
Some quality control would be needed…
No, because Daedalus app-platform implies a very restrictive API and permission system. A dApp may only do what API allows it to do, and it does not include a function to steal keys 
API is planned to allow dApps to perform actions with wallets, like sending transactions, but a user would need to explicitly give a permission for each app to perform an operation like this.
It would look something like:
OK, or click Cancel”Well we gotta chose one of those really You either want a system to be permissionless OR you want for someone else to be able to block illegitimate apps. There’s no middle way.
@ZCryt0Knight, on a decentralised platform users would have to take their own action in order to maintain the list of apps. Rate dApps as good or bad, leave comments, flag suspicious content, etc. In a permissionless platform you always rely only either on your own expertise, or on expertise of your fellow users - there’s no overlord to make these decisions for you. I reckon that’s the whole point of the enterprise
UPD: theoretically it would be possible in the future to hire with the treasury a trusted company or multiple companies who’s job would be to go over AAAAL the dApps, check them out, verify their safety and legitimacy, and then put something like an approval mark on it, or ask developers to fix something.
But most probably it will look something like a normal app-store where there’s actually also a ton of fairly shitty apps that no-one ever downloads
Restricting access through API seems like a good first step, also I like the idea of technical people reading the code and making sure that it has no bugs or malicious content (I would hate to send 200ADA to buy crypto doggies but find out it went to the hackers Bermuda vacation fund).
If everything happens on chain or if we have the source code to verify the legitimacy of a dApp, it would help.
Otherwise the platform will be swarmed by the bad guys trying to dupe you into sending your money into their accounts.
A dApp could provide some token services but could send you a malicious link to “verify” your account. By clicking that link you could potentially compromise your private keys. That’s another attack vector I am thinking about.
In short if no sensible security guarantees are baked into Daedalus (decentralized or otherwise) it might hinder adoption.
In short - Daedalus does not give any technical possibility for a dApp to automatically steal any of your personal info or funds, without you being aware of it. And this is all that matters really.
There’s always a vector of attack based on the weak point between the monitor and the chair 
But neither Daedalus nor IOHK or Cardano in general are responsible for funds stolen from a user by him giving his keys to a fishy-looking app. As I said, if a user wants to be a part of the decentralised world - he gotta toughen the heck up and adopt the responsibility, there’s no other way, in my view. For anyone else - there always will be a corporation ready to happily and generously sell them the right to be careless
Main rule of any decentralised technology - you gotta know and trust your community. My rules of using a dApp-store would be:
Fairly easy set of rules to get by, imo
Most probably it will, in the same way as twitter is swarmed by fake-accounts giving away free ETH, or in the same way as app-stores are swarmed with fake mobile-wallets - and being centralised does not really help them. It’s a direct consequence of free-market, in my view, and it will exist as long as naive people keep giving their own money away.
Not sure what kind of a link you are talking here about, btw. ONLY way for a user of Daedalus to get his keys compromised - is to be actively careless about them and\or give them away by entering them in some fishy app or website.
Again - Daedalus does not give an app any API that would allow it to access keys in any form. Stealing those would require user actively giving them away )
A malicious actor/dApp creator could:
Require some form of registration by email. A simple form with name, email, etc.
Send an email “confirmation” link asking to verify account from a separate server.
The link would be malicious. It would give the attacker access to your computer, specifically to the Daedalus folder where your pk is stored. It could bypass Daedalus as a fail-safe mechanism by gaining root access.
Once the attacker has the pk. She would clean the account.
I understand, this assumes that the person is fairly naive with his actions, but in the age of centralized platforms, consumers are comditioned to trust, which isn’t always a good idea in crypto.
You and I know this, but a lot of people won’t and could get hurt.
What you describe as steps for reducing risk are very sensible. Maybe the whole space needs to adopt these as the first step to managing risk. But in the long run we need something seamless… your treasury-funded verification process sounds like a cool, decentralized idea. I am sure dApp developers would pay for it to differentiate their services.
Knowing IOHK, i am sure they will come up with some really neat, decentralized way of reducing risks.
What I don’t want to see though is “you are on your own, dude!” kind of attitude as it could hurt Cardano’s mainstream adoption.
Yes, this is a possible attack vector, but:
Getting access to the Daedalus directory does not automatically gives you access to user keys, if he has spending password.
This attack vector in no way unique or specific to the embedded Daedalus dApp-platform. that’s what got me confused - you mentioned it in this topic like only this solution would make this attack vector possible. In reality - any way to make user install some weird shit on his computer would give the same result. So even if there would be no app-store - someone would create a website for their dapp and then ask user to download some program “to verify his account”. Actually NOT having an app-store would make this attack-vector times more possible because every dapp-creator would then have to create some form of GUI-client for his smart-contract (like in ethereum the standard practice is to create a web3-website that calls ethereum blockchain to interact with the contract) - and that would make any program that you need to download and install look somewhat more plausible. But when there IS a dapp-store right in the Daedalus - then any user should ask a logical question: “why would you want me to download and install your weird program, if you could create a nice dApp to be used right from the Daedalus?”
There’s no technical solution to this problem, at least I can’t imagine one. It may only be solved by people getting less naive, and that’s a job for the community, not for the platform itself. My proposed “rules of thumb” would solve this It says - don’t use a program until it is reviewed, unless you are ready to take risk. And first (reputable) review to this program would say: “asks you to download some bullshit, don’t use it” =)
Absolutely, and I agree to that with the main elaboration - that, as I said above, I want it to be the job for the community, and not for the platform itself, because I would not want our ecosystem to miss on great technological tooling just because it might hurt people if they use it stupidly. We don’t need to child-proof the grown-up world - we need to help people grow
That’s why I think that community will manage to more or less sort it out, create platforms to rate or vet dapps, build a reputation system, educate and help people. As a community 
Yes. This can be done but the pk would be provided by the user.
Example. A seemingly cool and legit dapp is crated. Code contains auto update opt in. User selects auto update. Auto update could even be automatic for that matter. Code breaks Daedalus and contains a wallet that appears to be Daedalus, looking exactly like it. Wallet requests user to enter seed to stop an unauthorized transaction. User falls for it because it looks and behaves like Daedalus. In fear of losing funds, user enters seed, seed is sent out to bad actor who restores wallet, bad actor extracts funds, user cannot stop because Daedalus file was corrupted in initial process and cannot connect to network, they need to restore, bad actor has jump on him, therefore first to complete restore. Money is lost forever.
Apple App Store works great because someone is getting the code. In dapp world, it can be the wild Wild West. Android apps are a prime example. Reputation issue can be addressed by a good bot. A centralized App Store would be nice as there are many phishing type examples that could make it in.
Solution, have 2 wallets, one with a small amount and one with large holdings. Hot wallet for small amounts, cold wallet for large amounts. Never use cold wallet or large hot wallet for dapps. Large wallet in for saving, trading, moving funds. Not a good solution but feasible for a temporary purpose.
Or a different type of hierarchical deterministic wallet I proposed in the past somewhere, in which, the depth of the graph (tree, to be more precise) represent the access level of the account/wallet and the max amount that can be stored on that level.
For example the root (a theoritical a wallet contains more than one million dollars) of the tree is the most secured account (or whatever we called it) which could contain any amount of ADA wo/ any restriction and should be secured by different secure methods e.g. root could be a multisig like paper wallet and each part of the multisig can be vaulted in different Banks/places @ different geolocation (for ex. a 2/3 type multi sig vaulted in three different places). The second level could contain wallets/accounts that can only contain, for example, max. 100k the 3rd level only 10k, 4rd 1k 5th only 100 or similar.
The deepest level (5th in this example) could be used for micropayments (NFC, tap-adn-go card etc), and could be automatically charged from its parent level when it’s getting empty.
The 4th level could be used for bigger transaction (e.g.) whihc would require for example some biometric verification, (fingerprint, face Id or similar). Level 3 could reuire the LVL 4th and some PIN or similar and so on. Means, higher level, harder verification. I have not really thought this above idea through.
Hello,
Could you point me in the right direction on how to better understand the K framework?
From my understanding, one of the advantages of Cardano will be that developers can code in any language with the help of the K framework.
As a beginner, I am taking a Python course that demonstrates the fundamentals of blockchain. I thought about taking solidity but why would do that if I have a commitment to this project.
Any guidance will be appreciated.
Thank you!
I’d say a keylogger could take care of that problem…but I agree, it would probably make it harder for an average bad guy.
I did not say it was unique to Daedalus and I agree that if you downloaded some sketchy software, you are probably screwed in more than one way. The reason I mentioned dApps was to illustrate how someone could target ADA holders.
Sure, the dApp would require some effort to put together. It would reduce the hacker’s attack surface, but increase the payoffs as he would increase his chances of landing a computer with actual money. Compared to some deadbeat who watches free porn (which is how you normally catch these nasty stuff on your pc), an average ADA holder is much more likely to have a sizeable amount in his pocket.
Community reviews could be useful, but we run a risk of fake people taking over the process and pumping up the ratings. Amazon suffers from this… There would have to be a better process.
I don’t believe this is an ‘either/or’ issue. We could have both. To be clear, I am not advocating for some central vetting for dApps, but a way to guarantee quality on a platform level.
And yes we could and should strive to create something better, meaning the crappy Google Play store is too low of a standard for Cardano.
I am sure Cardano/IOHK will come up with some solution to meet these simple security requirements. Security features are crucial to get right the first time as it impacts Cardano’s reputation in the space and might determine its widespread adoption rate (i.e. its fate).
Unlike a small subset of general population, who actually understands Cardano/crypto, the mainstream doesn’t want to get into the details of how things work. They want safe, reliable and useful tools that solve their everyday problems. The steps you outlined require people to have an above-average understanding of computers.
Judging by how people struggle with everyday use of PCs (examples are abundant in this forum too), these commandments would probably go right above their heads… which is why we need something simple and intuitive to safeguard the users against bad actors.
I agree this is a community-wide responsibility and must be carefully studied and addressed before we move on to the mass adoption stage.