what could be the best practices to allow user signup and login for a application using IOTA as a base?

Question

• Method for signup and login should not be cumbersome; ie: simple as normal methods of username/password or facebook and google oauth.
• Should not be cumbersome to request user to input seed to login :P

user 1 (credentials)-> seed unique (ABS9...) -> address (SSDBS9...) -> Do the transaction

user 2(credentials) -> seed unique (RBS9...) -> address (TREBS9...) -> Do the transaction

Answer 1

Your server or somebody else should never ever have access to the unencrypted seed, if not needed. You could connect your app with a centralized server and store a securely encrypted seed-file there.

1. User visits your website / app
2. User sees "Connect with Dropbox / Google Drive"
3. User Login with OAuth @ Dropbox / Google Drive
4. User sets a secure password at your application
5. Generate a new seed (cryptographically secure)
6. Encrypt the seed with the password (see key derivation functions / AES)
7. Encrypted seed is stored at Dropbox / Google Drive

When you want to store the securely encrypted seed on your own server, you could use Secure Remote Password protocol (SRP) for the authentication. This way you could use the same password for authentication and encryption.