📅 Original date posted:2014-03-27
📝 Original message:Companies can have a Cert with their name via CAcert. It requires some work though to get assured as an organisation.
Did you already think about what CA is to be trusted or do users need to do that. The least good decision in my POV would be to accept OS/browser built in CAs only.
Am 27.03.2014 um 11:08 schrieb Mike Hearn <mike at plan99.net>:
>> But these cases are the norm, rather than the exception.
>
> Well, you're lucky, you live in Berlin. Most of the payments I make with Bitcoin are online, to websites. So this will differ between people.
>
> I wonder how critical it is. Let's say you are paying for a meal. In your head the place you're at is just "the little Indian restaurant on the corner". In the companies register and therefore certificate it's something like "Singh Food GmbH". That's probably good enough to prevent shenanigans. Even if there's a virus on your phone, it can't really replace the cert with a random stolen one, otherwise your meal could show up like "IronCore Steel Inc" or something that's obviously bogus. It'd have to be an incredibly smart virus that knew how to substitute one name for a different one, from a large library of stolen identities, such that the swap seemed plausible. That sounds very hard, certainly too hard to bother with for stealing restaurant fees.
>
> And if a waiter at the restaurant is corrupt and they replace the cert with one that's for their own 1-man business "BP-Gupta" or something, OK, you might pay the wrong person by mistake. But eventually the corrupt waiter will be discovered and then someone will have proof of what they did. It's FAR more likely they'd just strip the signature entirely and try to convince you the restaurant doesn't use BIP70 at all.
>
> Still, if we want to fix this, one approach I was thinking about is to have a super-cheesy CA just for us that issues certs with addresses in them, for any name you ask for. That is, if you say you want a cert for "Shamrock Irish Pub, Wollishofen, Zurich, CH" then it either sends a postcard to that address with a code to check ownership of the address, or it checks ownership of the place on Google Maps (which does the same postcard trick but for free!).
>
> That doesn't work for vending machines, but perhaps we just don't care about those. If a MITM steals your lunch money, boo hoo.
>
> ------------------------------------------------------------------------------
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20140327/5d27c649/attachment.html>;
vv01f [ARCHIVE] /
npub16w…ws45h
2023-06-07 15:14:26
in reply to nevent1q…cqh7
Author Public Key
npub16wxlvxa5c25gcawkfcf7v6w8ray5scwm8t8y0qkxpfr3h5c5j0aqhws45hPublished at
2023-06-07 15:14:26Event JSON
{
"id": "bfbe8e29d44b028ff359cce88f482b67c120a51f2a9cc241f0fe0b967b51ac69",
"pubkey": "d38df61bb4c2a88c75d64e13e669c71f494861db3ace4782c60a471bd31493fa",
"created_at": 1686150866,
"kind": 1,
"tags": [
[
"e",
"d70d8d12a406cb1c9a067111bb9c717b35fd85b951e12f89e562fccc2fad4277",
"",
"root"
],
[
"e",
"9f94ca70ac491cd2badd381a1758b0d3ee95488ffc70a036eeeb9a29b404d507",
"",
"reply"
],
[
"p",
"f2c95df3766562e3b96b79a0254881c59e8639f23987846961cf55412a77f6f2"
]
],
"content": "📅 Original date posted:2014-03-27\n📝 Original message:Companies can have a Cert with their name via CAcert. It requires some work though to get assured as an organisation.\nDid you already think about what CA is to be trusted or do users need to do that. The least good decision in my POV would be to accept OS/browser built in CAs only.\n\nAm 27.03.2014 um 11:08 schrieb Mike Hearn \u003cmike at plan99.net\u003e:\n\n\u003e\u003e But these cases are the norm, rather than the exception.\n\u003e \n\u003e Well, you're lucky, you live in Berlin. Most of the payments I make with Bitcoin are online, to websites. So this will differ between people.\n\u003e \n\u003e I wonder how critical it is. Let's say you are paying for a meal. In your head the place you're at is just \"the little Indian restaurant on the corner\". In the companies register and therefore certificate it's something like \"Singh Food GmbH\". That's probably good enough to prevent shenanigans. Even if there's a virus on your phone, it can't really replace the cert with a random stolen one, otherwise your meal could show up like \"IronCore Steel Inc\" or something that's obviously bogus. It'd have to be an incredibly smart virus that knew how to substitute one name for a different one, from a large library of stolen identities, such that the swap seemed plausible. That sounds very hard, certainly too hard to bother with for stealing restaurant fees.\n\u003e \n\u003e And if a waiter at the restaurant is corrupt and they replace the cert with one that's for their own 1-man business \"BP-Gupta\" or something, OK, you might pay the wrong person by mistake. But eventually the corrupt waiter will be discovered and then someone will have proof of what they did. It's FAR more likely they'd just strip the signature entirely and try to convince you the restaurant doesn't use BIP70 at all.\n\u003e \n\u003e Still, if we want to fix this, one approach I was thinking about is to have a super-cheesy CA just for us that issues certs with addresses in them, for any name you ask for. That is, if you say you want a cert for \"Shamrock Irish Pub, Wollishofen, Zurich, CH\" then it either sends a postcard to that address with a code to check ownership of the address, or it checks ownership of the place on Google Maps (which does the same postcard trick but for free!).\n\u003e \n\u003e That doesn't work for vending machines, but perhaps we just don't care about those. If a MITM steals your lunch money, boo hoo.\n\u003e \n\u003e ------------------------------------------------------------------------------\n\u003e _______________________________________________\n\u003e Bitcoin-development mailing list\n\u003e Bitcoin-development at lists.sourceforge.net\n\u003e https://lists.sourceforge.net/lists/listinfo/bitcoin-development\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20140327/5d27c649/attachment.html\u003e",
"sig": "a0c1d595508fa2bf4b16abcd030b001d2f1cea4778240e3b8be161d1920699e5af8a6a086ad246a9ff9625ca71911ce1e83a778d7f8f5d89a5dc6a0cdb7b0945"
}