On Sat, Mar 1, 2014 at 7:26 AM, Jeremy Spilman <jeremy@taplink.co> wrote:

There's a open bug (#3628) and pull request (#3684) to provide negative
feedback (yellow background) for a missing or invalid signature, but it
seems like there's some debate on whether bitcoind should do that...

The consensus there is to treat invalid and unsigned payment requests the same (apart from debug error logging). After all, the cost to the attacker to remove the signature or corrupt it is exactly the same.

I do recommend testing that pull request (#3684) to see if it improves payment request reporting, and provide testing reports or suggestions in the github comments.

I've been very busy the last few weeks with integrating and testing other pre-0.9 changes so I have been unable to look at the visual side of payment request stuff much. We could use some help there.

If an attacker can avoid the negative feedback by just stripping the
signature and setting pki_type to none, then arguably there's no security
benefit by singling out badly signed payment requests from unsigned
payment requests.

Exactly.

So perhaps the root problem is that the positive feedback (green
background) is not strong enough to make its absence highly conspicuous to
the end user.

Well, ideas to make the difference more conspicuous are welcome. The green background is just to make a basic distinction.

If it involves any imagery or graphics we do need contributions (with the appropriate MIT license), no one of us is an artist.

As an aside, how could we go about implementing the equivalent of HTTP
Strict Transport Security for payment protocol to prevent this trivial
signature stripping attack? Is this a possible extension field merchants
are interested in?

Such a thing would be interesting for a future BIP standard. I see one problem here: for an unsigned payment request there isn't really an "origin". Browser URI handlers don't send the referrer either.

This rules out adding a field to the Bitcoin URI 'requests from us must be signed from now on' (there's no us).

The server that serves the payment requests *could* serve an HSTS-like header 'only accept signed payment requests from us from now on'. The client needs to remember this for this server. Then if someone has compromised that server (or hijacked DNS) to serve fake and unsigned payment requests, the client can block these.

Neither scenario will help in the case in which the server serving the Bitcoin URIs is compromised.

Wladimir