[BAB] Lesson 3: How to handle wallets
Wallets are critical for decentralization. If your users don't control (i.e. take custody of) their private keys, then you are a centralized point of failure for their account. But requiring a potential user to stop using your app and go set up a wallet is at odds with accessibility. Imagine your app is for non-technical users, but the only way to access the app is to "sign in with GitHub." There are three main ways to handle wallets for your app.
Centralized accounts
This is the default approach of web2: your typical email/password. Centralized exchanges like Coinbase and Binance do this for their users. You make the public key of the account known, but hold the private key yourself. This opens you up to hacking and puts a lot of responsibility on you as the developer. Not to mention it defeats the purpose of decentralization. I don't recommend this approach.
Non-custodial accounts
This is the default approach of web3: wallet hardware/software for users to manage their own private keys. If you're only targeting users who are already using blockchain, just do this. It's decentralized, but it puts the burden on the end user. If your users don't properly manage their private keys, they could lose access to their account and have no way to recover it. If you want to offer an experience that's ready for mass adoption, you need an improved user experience over the default. At the very least, help your users set up a wallet without leaving your app and warn them of the responsibility.
Support both
This isn't a unique method for wallet management. It's a workaround to provide the UX your users want. Technical users who care about decentralization can use their wallets. Non-technical users who just want to use the app can create a centralized account on your platform. On blockchains with high gas fees, this is probably the best option. The downside is it requires you to implement authorization both ways and still take on the responsibility of managing accounts for your users.
Smart contract wallets
What users really need is a safe way to use dApps and manage their account. Holding tokens inside a smart contract allows you to map ownership to private keys as well as a typical email login without a centralized dependency. You can provide account recovery features and a lot of other security precautions as well. This option isn't popular on Ethereum because it would cost more ETH than the default non-custodial wallet. Fee-less blockchains like Koinos allow you to use smart contract wallets without spending money. This is my preferred option for setting up new accounts for non-technical users because it's decentralized and safer. You'll be able to support "normal" wallets as well with little or no effort.
-Luke
P.S. You probably don't want to build your own smart contract wallet for your dApp (but you could). The Kondor wallet is currently being developed for Koinos and should support the capabilities I describe here.