Consider a MMORPG where users own virtual assets like magical swords or rings that can be used by the player. This system needs a safe method for transferring assets from Alice to Bob.
One requirement that increases the complexity is the fact that it should allow Alice to transfer an item to Bob before Bob registers himself. This is part of a marketing campaign to attract users into the game.
In one solution, Alice initiates the transfer by typing Bob's email or phone number. This is subject to human error. In order to prevent Alice from accidentally transferring the item to a stranger, we want Alice to validate the transfer by forcing Bob to send some information that only Alice knows.
The current protocol is as follows:
- Alice initiates the transfer by specifying Bob's contact (email or phone) and a question that Bob needs to answer. Alice does not tell the answer (i.e. the game cannot possibly leak this).
- The system uses Bob's contact to send a link. When Bob clicks on it, he is asked to login or register himself. This action is associated with the transfer.
- After Bob is properly logged in, he is presented with Alice's question.
- Bob types the answer and submits.
- When Alice logs in, she receives the answer, validates and the transfer is finished. Now Bob can use the item.
- In case Bob fails to finish this process in 7 days, Alice gets the item back.
The managers think this entire process is too complex for the average user.
One change is to allow Alice to specify the answer along with the question. At least Bob is be able to immediately use the item (i.e. without waiting for Alice first). However this also allows Alice to complain that we leaked the answer and someone else got the item.
What are the existing methods for transferring assets that can be considered? Again, the main requirement is to allow Alice to initiate the transfer before Bob is registered...