At times it might be important for users to verify the ownership of an account (tz1/KT1/etc) in order for applications to trust. However, this should not involve divulging of secret keys or any confidential information to third parties. Does anyone know the best way to efficiently verify such account ownership?
If it's a tz1 account (or the manager key of a KT1 account), the simplest is to sign a message and provide the public key. This can be done in command line in the following way:
./tezos-client hash data '"This key belongs to Caleb"' of type string
This will give you a serialization of the data
you can then run
./tezos-client sign 0x05010000001954686973206b65792062656c6f6e677320746f2043616c6562 for caleb
Note that this prove ownership of a private key. Proving "control" of a KT1 (which could be a multisig, a DAO, etc) is not as well defined a notion but, in general, you could require an account to send 1 µꜩ to a set address as a means of demonstrating control.
