📅 Original date posted:2018-01-01
📝 Original message:Recently a large merchant payment processor has decided to drop
support for BIP21 payment URI's in favor of accepting exclusively
BIP70 payments which has brought to light a number of problems with
BIP70:
1. Many wallets do not support BIP70 and have no near term intention
of doing so.
2. BIP70 requires large complex PKI dependencies such as X.509 and TLS
support(usually via openssl) which have a large attack surface and
poor track record when it comes to vulnerabilities.
3. Signing transactions with keys resident in the same application as
that which handles TLS greatly increases the possibility of keys being
leaked due to vulnerabilities in TLS libraries such as
openssl(heartbleed etc).
4. Sending payments first to a BIP70 compatible wallet before sending
to the merchant increases fees and uses more block space than sending
directly since it is often not feasible for users to fully migrate
funds to a BIP70 compatible wallet.
5. Paying a BIP70 invoice with an incompatible wallet currently
requires manual non-user-friendly workarounds such as
https://github.com/achow101/payment-proto-interface
I propose that we move the BIP70 protocol implementation into a
browser extension that can communicate with wallets over a simple IPC
mechanism such as
https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Native_messaging
in addition to acting as a translation layer that can convert BIP70
URL's into standard BIP21 URI's for wallets that do not wish to
support BIP70 or other custom schemes.
This will provide a number of advantages over the current method of
implementing BIP70 directly within wallets:
1. It removes complex/risky dependencies from wallets and moves them
into the browser which already has to implement full PKI support.
2. It re-enables payment support for wallets that only support
BIP21/normal addresses.
3. It makes offline/custom signing schemes easier to use with BIP70.
James Hilliard [ARCHIVE] /
npub10r…kgk2d
2023-06-07 18:09:11
in reply to nevent1q…sdgu
Author Public Key
npub10r9d6edmnrljk59wsf06zqp494l3qtjpa3w245hy6t5euqxlzw2qdkgk2dPublished at
2023-06-07 18:09:11Event JSON
{
"id": "bd6453edf00db1c51d75b141eedb54bc50b90ae363a2f81f2a6907e5706a9b71",
"pubkey": "78cadd65bb98ff2b50ae825fa100352d7f102e41ec5caad2e4d2e99e00df1394",
"created_at": 1686161351,
"kind": 1,
"tags": [
[
"e",
"662531daf1604e88b3b1837ace53291dc7f6e8db933d10fca54ffd94364e49b5",
"",
"reply"
],
[
"p",
"a23dbf6c6cc83e14cc3df4e56cc71845f611908084cfe620e83e40c06ccdd3d0"
]
],
"content": "📅 Original date posted:2018-01-01\n📝 Original message:Recently a large merchant payment processor has decided to drop\nsupport for BIP21 payment URI's in favor of accepting exclusively\nBIP70 payments which has brought to light a number of problems with\nBIP70:\n\n1. Many wallets do not support BIP70 and have no near term intention\nof doing so.\n2. BIP70 requires large complex PKI dependencies such as X.509 and TLS\nsupport(usually via openssl) which have a large attack surface and\npoor track record when it comes to vulnerabilities.\n3. Signing transactions with keys resident in the same application as\nthat which handles TLS greatly increases the possibility of keys being\nleaked due to vulnerabilities in TLS libraries such as\nopenssl(heartbleed etc).\n4. Sending payments first to a BIP70 compatible wallet before sending\nto the merchant increases fees and uses more block space than sending\ndirectly since it is often not feasible for users to fully migrate\nfunds to a BIP70 compatible wallet.\n5. Paying a BIP70 invoice with an incompatible wallet currently\nrequires manual non-user-friendly workarounds such as\nhttps://github.com/achow101/payment-proto-interface\n\nI propose that we move the BIP70 protocol implementation into a\nbrowser extension that can communicate with wallets over a simple IPC\nmechanism such as\nhttps://developer.mozilla.org/en-US/Add-ons/WebExtensions/Native_messaging\nin addition to acting as a translation layer that can convert BIP70\nURL's into standard BIP21 URI's for wallets that do not wish to\nsupport BIP70 or other custom schemes.\n\nThis will provide a number of advantages over the current method of\nimplementing BIP70 directly within wallets:\n\n1. It removes complex/risky dependencies from wallets and moves them\ninto the browser which already has to implement full PKI support.\n2. It re-enables payment support for wallets that only support\nBIP21/normal addresses.\n3. It makes offline/custom signing schemes easier to use with BIP70.",
"sig": "8dd16086105a0ec797ff6c9311f39326d8013a8d79c61a365350b02a1fa303ed0d5876122533d2c0697bdd2bc24e98e589d3ee19011afdeeb9e63601efdeae5b"
}