📅 Original date posted:2013-09-25
📝 Original message:On 25 September 2013 13:15, Mike Hearn <mike at plan99.net> wrote:
> It won't fit. But I don't see the logic. A URI contains instructions for
> making a payment. If that instruction is "pay to this address" or "download
> this file and do what you find there", it's no different unless there's
> potential for a MITM attack. If the request URL is HTTPS or a secured
> Bluetooth connection then there's no such possibility.
>
It depends on the attacker. I think a large entity such as a govt or big
to medium size corporation *may* be able to MITM https, of course the
incentive to do so is probably not there ...
>
>
>
>
> On Wed, Sep 25, 2013 at 12:28 PM, Andreas Schildbach <
> andreas at schildbach.de> wrote:
>
>> While it's good to save space, I'm at the moment not convinced that
>> taking a de-route via an URL is a good idea to begin with.
>>
>> The main problem is trust. If you scan a QR code from a foreign phone,
>> you trust that that phone is owned by the one you want to send money to.
>> By adding the HTTP request that trust is voided.
>>
>> As soon as there is a BIP70 implementation, I will begin playing with
>> putting the payment request directly into the QR code.
>>
>>
>> On 09/25/2013 11:27 AM, Mike Hearn wrote:
>> > We could also say that if protocol part (https://) is missing, it's
>> > implied automatically. So just:
>> >
>> > bitcoin:1abc........?r=bob.com/r/aZgR <http://bob.com/r/aZgR>;
>> >
>> > I think that's about as small as possible without re-using the pubkey as
>> > a token in the url.
>> >
>> >
>> > On Wed, Sep 25, 2013 at 1:35 AM, Gavin Andresen <
>> gavinandresen at gmail.com
>> > <mailto:gavinandresen at gmail.com>> wrote:
>> >
>> > On Tue, Sep 24, 2013 at 11:52 PM, Mike Hearn <mike at plan99.net
>> > <mailto:mike at plan99.net>> wrote:
>> >
>> > BTW, on the "make qrcodes more scannable" front -- is it too
>> > late to change BIP 72 so the new param is just "r" instead of
>> > "request"? Every byte helps when it comes to qrcodes ...
>> >
>> >
>> > Not too late, assuming there are no objections. Smaller QR codes is
>> > a very good reason to change it.
>> >
>> > --
>> > --
>> > Gavin Andresen
>> >
>> >
>> >
>> >
>> >
>> ------------------------------------------------------------------------------
>> > October Webinars: Code for Performance
>> > Free Intel webinars can help you accelerate application performance.
>> > Explore tips for MPI, OpenMP, advanced profiling, and more. Get the
>> most from
>> > the latest Intel processors and coprocessors. See abstracts and
>> register >
>> >
>> http://pubads.g.doubleclick.net/gampad/clk?id=60133471&iu=/4140/ostg.clktrk
>> >
>> >
>> >
>> > _______________________________________________
>> > Bitcoin-development mailing list
>> > Bitcoin-development at lists.sourceforge.net
>> > https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>> >
>>
>>
>>
>>
>> ------------------------------------------------------------------------------
>> October Webinars: Code for Performance
>> Free Intel webinars can help you accelerate application performance.
>> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most
>> from
>> the latest Intel processors and coprocessors. See abstracts and register >
>>
>> http://pubads.g.doubleclick.net/gampad/clk?id=60133471&iu=/4140/ostg.clktrk
>> _______________________________________________
>> Bitcoin-development mailing list
>> Bitcoin-development at lists.sourceforge.net
>> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>>
>
>
>
> ------------------------------------------------------------------------------
> October Webinars: Code for Performance
> Free Intel webinars can help you accelerate application performance.
> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most
> from
> the latest Intel processors and coprocessors. See abstracts and register >
> http://pubads.g.doubleclick.net/gampad/clk?id=60133471&iu=/4140/ostg.clktrk
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20130925/55e2d8b1/attachment.html>;
Melvin Carvalho [ARCHIVE] /
npub1uv…saxrt
2023-06-07 15:07:00
in reply to nevent1q…7uwg
Author Public Key
npub1uvtfvcegcn9kds68r8he57emc480vqtx8t22kpsctxgjxae44gvsksaxrtPublished at
2023-06-07 15:07:00Event JSON
{
"id": "1e0927366d38faafde89619ecdce2e5b0d289e31ab1ce77ac24c2650bfcb6a77",
"pubkey": "e316966328c4cb66c34719ef9a7b3bc54ef601663ad4ab06185991237735aa19",
"created_at": 1686150420,
"kind": 1,
"tags": [
[
"e",
"a751be3c813f9be7c191d199bd218d957841ef330cc8bf258e75cbaf91bae46f",
"",
"root"
],
[
"e",
"56c0c68ef5b70f6f26d7a0b19c8bfd8c77dd2e860bef9acf1beb69c2eb095508",
"",
"reply"
],
[
"p",
"f2c95df3766562e3b96b79a0254881c59e8639f23987846961cf55412a77f6f2"
]
],
"content": "📅 Original date posted:2013-09-25\n📝 Original message:On 25 September 2013 13:15, Mike Hearn \u003cmike at plan99.net\u003e wrote:\n\n\u003e It won't fit. But I don't see the logic. A URI contains instructions for\n\u003e making a payment. If that instruction is \"pay to this address\" or \"download\n\u003e this file and do what you find there\", it's no different unless there's\n\u003e potential for a MITM attack. If the request URL is HTTPS or a secured\n\u003e Bluetooth connection then there's no such possibility.\n\u003e\n\nIt depends on the attacker. I think a large entity such as a govt or big\nto medium size corporation *may* be able to MITM https, of course the\nincentive to do so is probably not there ...\n\n\n\u003e\n\u003e\n\u003e\n\u003e\n\u003e On Wed, Sep 25, 2013 at 12:28 PM, Andreas Schildbach \u003c\n\u003e andreas at schildbach.de\u003e wrote:\n\u003e\n\u003e\u003e While it's good to save space, I'm at the moment not convinced that\n\u003e\u003e taking a de-route via an URL is a good idea to begin with.\n\u003e\u003e\n\u003e\u003e The main problem is trust. If you scan a QR code from a foreign phone,\n\u003e\u003e you trust that that phone is owned by the one you want to send money to.\n\u003e\u003e By adding the HTTP request that trust is voided.\n\u003e\u003e\n\u003e\u003e As soon as there is a BIP70 implementation, I will begin playing with\n\u003e\u003e putting the payment request directly into the QR code.\n\u003e\u003e\n\u003e\u003e\n\u003e\u003e On 09/25/2013 11:27 AM, Mike Hearn wrote:\n\u003e\u003e \u003e We could also say that if protocol part (https://) is missing, it's\n\u003e\u003e \u003e implied automatically. So just:\n\u003e\u003e \u003e\n\u003e\u003e \u003e bitcoin:1abc........?r=bob.com/r/aZgR \u003chttp://bob.com/r/aZgR\u003e\n\u003e\u003e \u003e\n\u003e\u003e \u003e I think that's about as small as possible without re-using the pubkey as\n\u003e\u003e \u003e a token in the url.\n\u003e\u003e \u003e\n\u003e\u003e \u003e\n\u003e\u003e \u003e On Wed, Sep 25, 2013 at 1:35 AM, Gavin Andresen \u003c\n\u003e\u003e gavinandresen at gmail.com\n\u003e\u003e \u003e \u003cmailto:gavinandresen at gmail.com\u003e\u003e wrote:\n\u003e\u003e \u003e\n\u003e\u003e \u003e On Tue, Sep 24, 2013 at 11:52 PM, Mike Hearn \u003cmike at plan99.net\n\u003e\u003e \u003e \u003cmailto:mike at plan99.net\u003e\u003e wrote:\n\u003e\u003e \u003e\n\u003e\u003e \u003e BTW, on the \"make qrcodes more scannable\" front -- is it too\n\u003e\u003e \u003e late to change BIP 72 so the new param is just \"r\" instead of\n\u003e\u003e \u003e \"request\"? Every byte helps when it comes to qrcodes ...\n\u003e\u003e \u003e\n\u003e\u003e \u003e\n\u003e\u003e \u003e Not too late, assuming there are no objections. Smaller QR codes is\n\u003e\u003e \u003e a very good reason to change it.\n\u003e\u003e \u003e\n\u003e\u003e \u003e --\n\u003e\u003e \u003e --\n\u003e\u003e \u003e Gavin Andresen\n\u003e\u003e \u003e\n\u003e\u003e \u003e\n\u003e\u003e \u003e\n\u003e\u003e \u003e\n\u003e\u003e \u003e\n\u003e\u003e ------------------------------------------------------------------------------\n\u003e\u003e \u003e October Webinars: Code for Performance\n\u003e\u003e \u003e Free Intel webinars can help you accelerate application performance.\n\u003e\u003e \u003e Explore tips for MPI, OpenMP, advanced profiling, and more. Get the\n\u003e\u003e most from\n\u003e\u003e \u003e the latest Intel processors and coprocessors. See abstracts and\n\u003e\u003e register \u003e\n\u003e\u003e \u003e\n\u003e\u003e http://pubads.g.doubleclick.net/gampad/clk?id=60133471\u0026iu=/4140/ostg.clktrk\n\u003e\u003e \u003e\n\u003e\u003e \u003e\n\u003e\u003e \u003e\n\u003e\u003e \u003e _______________________________________________\n\u003e\u003e \u003e Bitcoin-development mailing list\n\u003e\u003e \u003e Bitcoin-development at lists.sourceforge.net\n\u003e\u003e \u003e https://lists.sourceforge.net/lists/listinfo/bitcoin-development\n\u003e\u003e \u003e\n\u003e\u003e\n\u003e\u003e\n\u003e\u003e\n\u003e\u003e\n\u003e\u003e ------------------------------------------------------------------------------\n\u003e\u003e October Webinars: Code for Performance\n\u003e\u003e Free Intel webinars can help you accelerate application performance.\n\u003e\u003e Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most\n\u003e\u003e from\n\u003e\u003e the latest Intel processors and coprocessors. See abstracts and register \u003e\n\u003e\u003e\n\u003e\u003e http://pubads.g.doubleclick.net/gampad/clk?id=60133471\u0026iu=/4140/ostg.clktrk\n\u003e\u003e _______________________________________________\n\u003e\u003e Bitcoin-development mailing list\n\u003e\u003e Bitcoin-development at lists.sourceforge.net\n\u003e\u003e https://lists.sourceforge.net/lists/listinfo/bitcoin-development\n\u003e\u003e\n\u003e\n\u003e\n\u003e\n\u003e ------------------------------------------------------------------------------\n\u003e October Webinars: Code for Performance\n\u003e Free Intel webinars can help you accelerate application performance.\n\u003e Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most\n\u003e from\n\u003e the latest Intel processors and coprocessors. See abstracts and register \u003e\n\u003e http://pubads.g.doubleclick.net/gampad/clk?id=60133471\u0026iu=/4140/ostg.clktrk\n\u003e _______________________________________________\n\u003e Bitcoin-development mailing list\n\u003e Bitcoin-development at lists.sourceforge.net\n\u003e https://lists.sourceforge.net/lists/listinfo/bitcoin-development\n\u003e\n\u003e\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20130925/55e2d8b1/attachment.html\u003e",
"sig": "5d97e151010c2654829ac0e90ab1010e14c20f55791c0b4718f350d99c92cff2beeb87131f19e840e5c9c993e5de7ce515c658654558283479e82c36e1b0fa61"
}