đź“… Original date posted:2015-02-02
đź“ť Original message:Where would you verify that?
On 2/3/2015 10:03 AM, Brian Erdelyi wrote:
> Joel,
>
> The mobile device should show you the details of the transaction (i.e.
> amount and bitcoin address). Once you verify this is the intended
> recipient and amount you approve it on the mobile device. If the
> address was replaced, you should see this on the mobile device as it
> won’t match where you were intending to send it. You can then not
> provide the second signature.
>
> Brian Erdelyi
>
>> On Feb 2, 2015, at 4:57 PM, Joel Joonatan Kaartinen
>> <joel.kaartinen at gmail.com <mailto:joel.kaartinen at gmail.com>> wrote:
>>
>> If the attacker has your desktop computer but not the mobile that's
>> acting as an independent second factor, how are you then supposed to
>> be able to tell you're not signing the correct transaction on the
>> mobile? If the address was replaced with the attacker's address,
>> it'll look like everything is ok.
>>
>> - Joel
>>
>> On Mon, Feb 2, 2015 at 9:58 PM, Brian Erdelyi
>> <brian.erdelyi at gmail.com <mailto:brian.erdelyi at gmail.com>> wrote:
>>
>>
>> > Confusing or not, the reliance on multiple signatures as
>> offering greater security than single relies on the independence
>> of multiple secrets. If the secrets cannot be shown to retain
>> independence in the envisioned threat scenario (e.g. a user's
>> compromised operating system) then the benefit reduces to making
>> the exploit more difficult to write, which, once written, reduces
>> to no benefit. Yet the user still suffers the reduced utility
>> arising from greater complexity, while being led to believe in a
>> false promise.
>>
>> Just trying to make sure I understand what you’re saying. Are
>> you eluding to that if two of the three private keys get
>> compromised there is no gain in security? Although the
>> likelihood of this occurring is lower, it is possible.
>>
>> As more malware targets bitcoins I think the utility is evident.
>> Given how final Bitcoin transactions are, I think it’s worth
>> trying to find methods to help verify those transactions (if a
>> user deems it to be high-risk enough) before the transaction is
>> completed. The balance is trying to devise something that users
>> do not find too burdensome.
>>
>> Brian Erdelyi
>> ------------------------------------------------------------------------------
>> Dive into the World of Parallel Programming. The Go Parallel Website,
>> sponsored by Intel and developed in partnership with Slashdot
>> Media, is your
>> hub for all things parallel software development, from weekly thought
>> leadership blogs to news, videos, case studies, tutorials and
>> more. Take a
>> look and join the conversation now.
>> http://goparallel.sourceforge.net/
>> _______________________________________________
>> Bitcoin-development mailing list
>> Bitcoin-development at lists.sourceforge.net
>> <mailto:Bitcoin-development at lists.sourceforge.net>
>> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>>
>>
>
>
>
> ------------------------------------------------------------------------------
> Dive into the World of Parallel Programming. The Go Parallel Website,
> sponsored by Intel and developed in partnership with Slashdot Media, is your
> hub for all things parallel software development, from weekly thought
> leadership blogs to news, videos, case studies, tutorials and more. Take a
> look and join the conversation now. http://goparallel.sourceforge.net/
>
>
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20150203/3878832d/attachment.html>;
Pedro Worcel [ARCHIVE] /
npub10u…z72j8
2023-06-07 15:29:18
in reply to nevent1q…u3ke
Author Public Key
npub10u058zpa2pmy5ljudd4vkmuh6tdy70y5weqhhzqq7ltefua38qhq2z72j8Published at
2023-06-07 15:29:18Event JSON
{
"id": "3be06e3cb4255d7e8bde0ee4556c50f9d96ff1f45d258570d554990add85b16b",
"pubkey": "7f1f43883d50764a7e5c6b6acb6f97d2da4f3c9476417b8800f7d794f3b1382e",
"created_at": 1686151758,
"kind": 1,
"tags": [
[
"e",
"541657d412739d9d2a5bc263564b0f2ef650e16ac828484a06cbef551e18c76c",
"",
"root"
],
[
"e",
"9c0fe23eb1e0399962d1774715bccfeb68722e06f444b040d4d17c9669828c7d",
"",
"reply"
],
[
"p",
"5f57805600aff24704ce401a57e78ba1631be95f18e62e28fb3168e3be1ea5c5"
]
],
"content": "📅 Original date posted:2015-02-02\n📝 Original message:Where would you verify that?\n\nOn 2/3/2015 10:03 AM, Brian Erdelyi wrote:\n\u003e Joel,\n\u003e\n\u003e The mobile device should show you the details of the transaction (i.e. \n\u003e amount and bitcoin address). Once you verify this is the intended \n\u003e recipient and amount you approve it on the mobile device. If the \n\u003e address was replaced, you should see this on the mobile device as it \n\u003e won’t match where you were intending to send it. You can then not \n\u003e provide the second signature.\n\u003e\n\u003e Brian Erdelyi\n\u003e\n\u003e\u003e On Feb 2, 2015, at 4:57 PM, Joel Joonatan Kaartinen \n\u003e\u003e \u003cjoel.kaartinen at gmail.com \u003cmailto:joel.kaartinen at gmail.com\u003e\u003e wrote:\n\u003e\u003e\n\u003e\u003e If the attacker has your desktop computer but not the mobile that's \n\u003e\u003e acting as an independent second factor, how are you then supposed to \n\u003e\u003e be able to tell you're not signing the correct transaction on the \n\u003e\u003e mobile? If the address was replaced with the attacker's address, \n\u003e\u003e it'll look like everything is ok.\n\u003e\u003e\n\u003e\u003e - Joel\n\u003e\u003e\n\u003e\u003e On Mon, Feb 2, 2015 at 9:58 PM, Brian Erdelyi \n\u003e\u003e \u003cbrian.erdelyi at gmail.com \u003cmailto:brian.erdelyi at gmail.com\u003e\u003e wrote:\n\u003e\u003e\n\u003e\u003e\n\u003e\u003e \u003e Confusing or not, the reliance on multiple signatures as\n\u003e\u003e offering greater security than single relies on the independence\n\u003e\u003e of multiple secrets. If the secrets cannot be shown to retain\n\u003e\u003e independence in the envisioned threat scenario (e.g. a user's\n\u003e\u003e compromised operating system) then the benefit reduces to making\n\u003e\u003e the exploit more difficult to write, which, once written, reduces\n\u003e\u003e to no benefit. Yet the user still suffers the reduced utility\n\u003e\u003e arising from greater complexity, while being led to believe in a\n\u003e\u003e false promise.\n\u003e\u003e\n\u003e\u003e Just trying to make sure I understand what you’re saying. Are\n\u003e\u003e you eluding to that if two of the three private keys get\n\u003e\u003e compromised there is no gain in security? Although the\n\u003e\u003e likelihood of this occurring is lower, it is possible.\n\u003e\u003e\n\u003e\u003e As more malware targets bitcoins I think the utility is evident. \n\u003e\u003e Given how final Bitcoin transactions are, I think it’s worth\n\u003e\u003e trying to find methods to help verify those transactions (if a\n\u003e\u003e user deems it to be high-risk enough) before the transaction is\n\u003e\u003e completed. The balance is trying to devise something that users\n\u003e\u003e do not find too burdensome.\n\u003e\u003e\n\u003e\u003e Brian Erdelyi\n\u003e\u003e ------------------------------------------------------------------------------\n\u003e\u003e Dive into the World of Parallel Programming. The Go Parallel Website,\n\u003e\u003e sponsored by Intel and developed in partnership with Slashdot\n\u003e\u003e Media, is your\n\u003e\u003e hub for all things parallel software development, from weekly thought\n\u003e\u003e leadership blogs to news, videos, case studies, tutorials and\n\u003e\u003e more. Take a\n\u003e\u003e look and join the conversation now.\n\u003e\u003e http://goparallel.sourceforge.net/\n\u003e\u003e _______________________________________________\n\u003e\u003e Bitcoin-development mailing list\n\u003e\u003e Bitcoin-development at lists.sourceforge.net\n\u003e\u003e \u003cmailto:Bitcoin-development at lists.sourceforge.net\u003e\n\u003e\u003e https://lists.sourceforge.net/lists/listinfo/bitcoin-development\n\u003e\u003e\n\u003e\u003e\n\u003e\n\u003e\n\u003e\n\u003e ------------------------------------------------------------------------------\n\u003e Dive into the World of Parallel Programming. The Go Parallel Website,\n\u003e sponsored by Intel and developed in partnership with Slashdot Media, is your\n\u003e hub for all things parallel software development, from weekly thought\n\u003e leadership blogs to news, videos, case studies, tutorials and more. Take a\n\u003e look and join the conversation now. http://goparallel.sourceforge.net/\n\u003e\n\u003e\n\u003e _______________________________________________\n\u003e Bitcoin-development mailing list\n\u003e Bitcoin-development at lists.sourceforge.net\n\u003e https://lists.sourceforge.net/lists/listinfo/bitcoin-development\n\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20150203/3878832d/attachment.html\u003e",
"sig": "72df85f4fd9413baf8b4fec25e6ecf56611b5944d15dd0e7e028c129be9fe1a7fceace8b63394424a62a44bd1d17a05e688455c2ea5b6a7da09d41107dbf6d16"
}