Rant about EOS low-security launch process

EOS lack of standard key generation tool and offline registration instructions this close to launch is an embarassment and a disgrace. Less than a month from the freeze, the only way to generate keys offline relies either on third party tools like this one from @nadejde that require trusting the author or involves goofing around with official nodejs libraries (a big thank you to @eosnewyork for providing this guide). So far the only known ways to register offline involves importing manually the EOS ABI in Mist or using the online MEW contract calls with a dummy private key, and signing the generated blob offline. Above trickery is far beyond the abilities of the general public and I'd be surprised if even 1% of the EOS holders generated their keys using trusted code, and registered them offline.

Key generation is the absolute base of any crypto system and underpins the entire future security model. With the current confusion around EOS registration and its near entire reliance on third party tools and instructions, for all we know many EOS registered wallets could already be compromised due to third party tools eavesdropping on keys, generating them with too little entropy or using a pseudo-random, reproductible key generation process.

As discussed in this very apropos comment in the @eosnewyork thread I linked above, we are heading toward a possible repeat of the IOTA key generation fsck up.

As a very early supporter of Dan's work, I'm deeply disappointed by the careless approach taken by EOS.