The DFlow mobile app uses Dynamic behind-the-scenes to power its embedded wallets. Embedded wallets are regular noncustodial Solana wallets that are "embedded" into the application, offering users better UX on mobile, easier onboarding and better security.
Currently, your DFlow account is secured by your email or phone number. As long as you have your email or phone number, you can access your funds.
We will be adding support for passkey protection soon. The below is for users who created DFlow accounts prior to 7/17 during which we supported passkey signing.
DFlow supports passkey signing (e.g. TouchID, FaceID) and abstracts people away from seed phrases. Passkeys are basically better passwords and are adopted by companies like Apple, Google, Coinbase etc.
Check out Dynamic's docs for details on how the system works. Below is a high level overview.
Your passkeys are stored by iCloud Keychain, Google Password Manager, 1Password etc. Therefore, your passkeys are protected by Apple or Google's security.
Your private key is only decrypted in secure enclaves by a signture from your passkey. Unlike passwords, you don't need to remember information for passkeys.
How to Create An Account
Easy two-step process:
Enter your email or phone number (US and Canada only).
Enter verification code from email or text.
How to Sign
We offer both the passkey (recommended) and one-time code option.
Enter code from Turnkey* from email.
Set up TouchID, FaceID etc.
Now every time you place a trade, you will need to sign via (2).
*We have plans to remove this step in a future release.
Does DFlow have access to my private key?
No we do not store or have access to your private keys.
How do passkeys prevent SIM swap attacks?
Even if your SIM was swapped, the attacker would have to gain access to your iCloud or Google account to access your passkey.