public inbox for bitcoindev@googlegroups.com
 help / color / mirror / Atom feed
From: Troy Benjegerdes <hozer@hozed.org>
To: Jeremy Spilman <jeremy@taplink.co>
Cc: "bitcoin-development@lists.sourceforge.net"
	<bitcoin-development@lists.sourceforge.net>
Subject: Re: [Bitcoin-development] Positive and negative feedback on certificate validation errors
Date: Sun, 2 Mar 2014 12:18:18 -0600	[thread overview]
Message-ID: <20140302181818.GR3180@nl.grid.coop> (raw)
In-Reply-To: <op.xb05iptvyldrnw@laptop-air>

On Fri, Feb 28, 2014 at 10:26:39PM -0800, Jeremy Spilman wrote:
> We currently have subtle positive feedback of a signed payment request in  
> the form of the green background. Unsigned requests simply show up without  
> the green background, as well as requests which provide a certificate but  
> have a missing or invalid signature.

Are we talking a third-party 'root certificate'?

I don't quite see why a cryptographic currency that has the most widely 
deployed ECDSA public/private key infrastructure ever needs to use external
certificates. That seems like a significant reduction in security to pretend
that a 'signed' certificate is any good when it's pretty easy to buy a
compromised cert, or just hack the server its on.

If it's 'signed' by the ECDSA private key that you are sending the payment
to, by all means, make it bright green.

I mean if you want to make it expensive for small businesses to take secure
payments, why don't you add a native 'signing fee' extension and have a 
(more) transparent market for the price of perceived security, or at least
a compile time option so i can turn this nonsense off for my customers.


-- 
----------------------------------------------------------------------------
Troy Benjegerdes                 'da hozer'                  hozer@hozed.org
7 elements      earth::water::air::fire::mind::spirit::soul        grid.coop

      Never pick a fight with someone who buys ink by the barrel,
         nor try buy a hacker who makes money by the megahash




      parent reply	other threads:[~2014-03-02 18:18 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2014-03-01  6:26 [Bitcoin-development] Positive and negative feedback on certificate validation errors Jeremy Spilman
2014-03-01  7:26 ` Wladimir
2014-03-01  7:50   ` Jeremy Spilman
2014-03-02 10:37     ` Mike Hearn
2014-03-02  7:52 ` [Bitcoin-development] Payment Protocol Hash Comments Jeremy Spilman
2014-03-02  8:44   ` Mike Hearn
2014-03-02  8:52     ` Drak
2014-03-02 10:39       ` Mike Hearn
2014-03-03 12:39         ` Drak
2014-03-02 18:18 ` Troy Benjegerdes [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20140302181818.GR3180@nl.grid.coop \
    --to=hozer@hozed.org \
    --cc=bitcoin-development@lists.sourceforge.net \
    --cc=jeremy@taplink.co \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox