Thank you @Cannikin , there are many helpful info there. I was thinking to authenticate user by sending a 0 transaction with special notes too, and asked this in another post, @fabrice reminded me the DApp case, not sure if this is helpful to you, but you can check it here:
Anyway, seems so far there is no good solution, I will consider other methods.