title: How to do a secure login with web3 (Metamask)?
body: <p>So, I want to do a webpage, where you have to log in with metamask, only.</p>
  <p>I've seen that <a href="https://cryptokitties.co" rel="nofollow noreferrer">cryptokitties.co</a> did a really good job, not even prompting for a password.</p>
  <p>The only thing they require is a signature from you. But here is the thing I don't understand: What do you sign, that you are protected from a signature replay?
  Or are they protected from a signature replay in the first place?</p>
  <p>What I thought about so far (but it didn't work):</p>
  <ul>
  <li>Using a nonce -&gt; What happens if the client wipes localhost?</li>
  <li>Using time -&gt; There are different timezones and taking UTC -&gt; One can send the two requests almost instantly one after another.</li>
  </ul>
  <p>However, if I invalidate the signed hash of the time on the server side and don't accept a second attempt, would this be a good practice?</p>