Paul Puey [ARCHIVE] / is on Nostr

⚠️ This account is not associated with a real person. It's an archival account for mailing list messages.
🗓️ Active from 2015-02-05 to 2015-02-06
💬 Posted a total of 10 messages
📚 Participated in the following categories: Bitcoin-development
🔇 Please do not DM this user as it's used for archive purposes only.

Last Notes

2023-06-07 15:29:52

- reply

📅 Original date posted:2015-02-05
📝 Original message:The broadcast is ONLY done when the wallet is in Receive mode. Same as when
the QR code is visible. The use of the *Name* section is specifically so
that a recipient can broadcast their name/handle. Not so the recipient
would broadcast the name of the Sender.
[image: logo]
*Paul Puey* CEO / Co-Founder, Airbitz Inc
+1-619-850-8624 | http://airbitz.co | San Diego
<http://facebook.com/airbitz> <http://twitter.com/airbitz>
<https://plus.google.com/118173667510609425617>
<https://go.airbitz.co/comments/feed/> <http://linkedin.com/in/paulpuey>
<https://angel.co/paul-puey>
*DOWNLOAD THE AIRBITZ WALLET:*
<https://play.google.com/store/apps/details?id=com.airbitz>
<https://itunes.apple.com/us/app/airbitz/id843536046>
On Thu, Feb 5, 2015 at 12:50 PM, Mike Hearn <mike at plan99.net> wrote:
> I'm imagining myself walking around broadcasting my photo and MAC
>> address while hucksters push payment requests to me for approval
>
>
> I hate to break it to you, but you broadcast a photo of your face every
> time you walk outside ;)
>
> Bluetooth MAC addresses are random, they aren't useful identifiers. If
> someone can see you, a face is a far more uniquely identifying thing than a
> MAC.
>
> "Payment spam" might be a problem. I can imagine a wallet requiring that
> such requests are signed and then spammers can be blacklisted in the usual
> fashion so they can't push things to your phone anymore. Anyway, a hurdle
> that can be jumped if/when it becomes an issue.
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20150205/8f1e83dc/attachment.html>

2023-06-07 15:29:52

- reply

📅 Original date posted:2015-02-05
📝 Original message:Although not perfect, and it may require visual/verbal verification, I
don't see what the trust issue is.
[image: logo]
*Paul Puey* CEO / Co-Founder, Airbitz Inc
+1-619-850-8624 | http://airbitz.co | San Diego
<http://facebook.com/airbitz> <http://twitter.com/airbitz>
<https://plus.google.com/118173667510609425617>
<https://go.airbitz.co/comments/feed/> <http://linkedin.com/in/paulpuey>
<https://angel.co/paul-puey>
*DOWNLOAD THE AIRBITZ WALLET:*
<https://play.google.com/store/apps/details?id=com.airbitz>
<https://itunes.apple.com/us/app/airbitz/id843536046>
On Thu, Feb 5, 2015 at 2:05 PM, Eric Voskuil <eric at voskuil.org> wrote:
> Hi Paul,
>
> The issue is in the establishment of trust. Anyone can broadcast the
> initial information.
>
> e
>
> On Feb 5, 2015, at 2:01 PM, Paul Puey <paul at airbitz.co> wrote:
>
> The broadcast is ONLY done when the wallet is in Receive mode. Same as
> when the QR code is visible. The use of the *Name* section is specifically
> so that a recipient can broadcast their name/handle. Not so the recipient
> would broadcast the name of the Sender.
>
> On Thu, Feb 5, 2015 at 12:50 PM, Mike Hearn <mike at plan99.net> wrote:
>
>> I'm imagining myself walking around broadcasting my photo and MAC
>>> address while hucksters push payment requests to me for approval
>>
>>
>> I hate to break it to you, but you broadcast a photo of your face every
>> time you walk outside ;)
>>
>> Bluetooth MAC addresses are random, they aren't useful identifiers. If
>> someone can see you, a face is a far more uniquely identifying thing than a
>> MAC.
>>
>> "Payment spam" might be a problem. I can imagine a wallet requiring that
>> such requests are signed and then spammers can be blacklisted in the usual
>> fashion so they can't push things to your phone anymore. Anyway, a hurdle
>> that can be jumped if/when it becomes an issue.
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20150205/1d6f9332/attachment.html>

2023-06-07 15:29:51

- reply

📅 Original date posted:2015-02-05
📝 Original message:The trust can be considered bootstrapped by visual verification of the address prefix. If we are really concerned about someone jamming a Bluetooth signal in a coffeeshop then the UI can encourage verification of the prefix. Much like how regular Bluetooth requires 'pairing' via entering a 4-6 digit code.
Paul Puey CEO / Co-Founder, Airbitz Inc
619.850.8624 | http://airbitz.co | San Diego
On Feb 5, 2015, at 3:46 PM, Eric Voskuil <eric at voskuil.org> wrote:
On 02/05/2015 03:36 PM, MⒶrtin HⒶboⓋštiak wrote:
>> A BIP-70 signed payment request in the initial broadcast can resolve the
>> integrity issues, but because of the public nature of the broadcast
>> coupled with strong public identity, the privacy compromise is much
>> worse. Now transactions are cryptographically tainted.
>>
>> This is also the problem with BIP-70 over the web. TLS and other
>> security precautions aside, an interloper on the communication, desktop,
>> datacenter, etc., can capture payment requests and strongly correlate
>> transactions to identities in an automated manner. The payment request
>> must be kept private between the parties, and that's hard to do.
>
> What about using encryption with forward secrecy? Merchant would
> generate signed request containing public ECDH part, buyer would send
> back transaction encrypted with ECDH and his public ECDH part. If
> receiving address/amount is meant to be private, use commit protocol
> (see ZRTP/RedPhone) and short authentication phrase (which is hard to
> spoof thanks to commit protocol - see RedPhone)?
Hi Martin,
The problem is that you need to verify the ownership of the public key.
A MITM can substitute the key. If you don't have verifiable identity
associated with the public key (PKI/WoT), you need a shared secret (such
as a secret phrase). But the problem is then establishing that secret
over a public channel.
You can bootstrap a private session over the untrusted network using a
trusted public key (PKI/WoT). But the presumption is that you are
already doing this over the web (using TLS). That process is subject to
attack at the CA. WoT is not subject to a CA attack, because it's
decentralized. But it's also not sufficiently deployed for some scenarios.
e
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20150205/6bf6a7d3/attachment.html>

2023-06-07 15:29:51

- reply

📅 Original date posted:2015-02-05
📝 Original message:The implementation on Airbitz does not encourage or even let a user
broadcast a photo. Just an address prefix and "name/handle". And it's only
broadcast during the Receive request. Not generally while the app is
running although that's up to the implementation.
[image: logo]
*Paul Puey* CEO / Co-Founder, Airbitz Inc
+1-619-850-8624 | http://airbitz.co | San Diego
<http://facebook.com/airbitz> <http://twitter.com/airbitz>
<https://plus.google.com/118173667510609425617>
<https://go.airbitz.co/comments/feed/> <http://linkedin.com/in/paulpuey>
<https://angel.co/paul-puey>
*DOWNLOAD THE AIRBITZ WALLET:*
<https://play.google.com/store/apps/details?id=com.airbitz>
<https://itunes.apple.com/us/app/airbitz/id843536046>
On Thu, Feb 5, 2015 at 1:19 PM, Brian Hoffman <brianchoffman at gmail.com>
wrote:
> This sounds horrible. You could basically monitor anyone with a wallet in
> a highly populated area and track them super easily by doing facial
> recognition. Yes you could photograph people but it's way more burdensome.
> Sorry to go off topic a little.
>
>
> On Feb 5, 2015, at 3:50 PM, Mike Hearn <mike at plan99.net> wrote:
>
> I'm imagining myself walking around broadcasting my photo and MAC
>> address while hucksters push payment requests to me for approval
>
>
> I hate to break it to you, but you broadcast a photo of your face every
> time you walk outside ;)
>
> Bluetooth MAC addresses are random, they aren't useful identifiers. If
> someone can see you, a face is a far more uniquely identifying thing than a
> MAC.
>
> "Payment spam" might be a problem. I can imagine a wallet requiring that
> such requests are signed and then spammers can be blacklisted in the usual
> fashion so they can't push things to your phone anymore. Anyway, a hurdle
> that can be jumped if/when it becomes an issue.
>
>
> ------------------------------------------------------------------------------
> Dive into the World of Parallel Programming. The Go Parallel Website,
> sponsored by Intel and developed in partnership with Slashdot Media, is
> your
> hub for all things parallel software development, from weekly thought
> leadership blogs to news, videos, case studies, tutorials and more. Take a
> look and join the conversation now. http://goparallel.sourceforge.net/
>
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20150205/0a99ec39/attachment.html>