bitcoin-dev

Combined summary - BIP Proposal - Address Paste Improvement

Combined summary - BIP Proposal - Address Paste Improvement

The discussion thread focuses on the need to establish a standard for transferring Bitcoin addresses from web pages or messages to wallet address input fields.

Various methods were suggested, including QR code scanning, "bitcoin:" URI intent, and the BIP70 payment protocol. However, concerns were raised about incentivizing users to use copypaste functionality extensively, as it can be easily compromised by crypto hijackers. It was argued that moving to other ways of specifying destinations could also pose security issues. The conversation also touched on BIP75 and BIP47 protocols, which may help with address transfer but have limited wallet support due to their complexity. A work-in-progress implementation exists in Wasabi. Ultimately, the decision whether this needs to be a BIP or not depends on the community's valuation of user experience.In the Bitcoin developer email thread, the issue of transferring an address from a webpage to a wallet address input field was discussed. Suggestions included QR code scanning and using "bitcoin:" URI intent on Android. However, in many cases, addresses are presented as text to copy. Some proposed autodetecting Bitcoin addresses and converting them to "bitcoin:" links, but adoption of this feature may be slow. The conversation also delved into the BIP70, BIP75, and BIP47 payment protocols, with limited wallet support for the latter two due to their complexity. One commenter questioned the need for this to be a BIP, emphasizing that it is more of a UX detail rather than a Bitcoin protocol. They requested further elaboration on the need for documentation. Another commenter raised concerns about incentivizing excessive use of copypaste functionality, but argued that crypto hijackers use the clipboard because it is convenient, not because it is the only method they can hijack. The existence of a work-in-progress implementation in Wasabi was mentioned.The mechanism for end-users to transfer an address from a web page to the wallet address input field was discussed in the thread. Various methods such as QR code scanning, "bitcoin:" URI intent, and BIP70 payment message intent were suggested. However, in many cases, addresses are presented as text for users to copy. There were concerns about incentivizing excessive use of copypaste functionality, countered by the argument that crypto hijackers use the clipboard because it is convenient, not because it is their only method of hijacking. The conversation also touched on crypto hijackers, which was considered off-topic. It was noted that there is a work-in-progress implementation in Wasabi. For well-known entities, the BIP70 payment protocol with authentication via certificates can be used, but it does not cover the use case of relying solely on the person in front of you as the trust anchor. BIP75 and BIP47 protocols may help, but their limited wallet support is attributed to their complexity.There are several mechanisms available for end-users to transfer an address from a web page to the wallet address input field, including QR code scanning, "bitcoin:" URI intent, and BIP70 payment message intent. However, in many cases, addresses are presented as text for users to copy. This raised concerns about incentivizing excessive use of copypaste functionality. On the other hand, it was argued that crypto hijackers use the clipboard because it is convenient, rather than it being their only method of hijacking. The discussion also mentioned the existence of a work-in-progress implementation in Wasabi. For cases where the payee is a well-known entity, the BIP70 payment protocol with authentication via certificates can be used. However, this protocol does not address the use case where the person in front of you is the only trust anchor. BIP75 and BIP47 protocols were also mentioned as potential solutions, but their limited wallet support is likely due to their relative complexity.The act of copying addresses to the clipboard is discouraged due to security risks, as malware can easily replace addresses with their own. Suggestions were made to implement an address authentication procedure that balances convenience and security. These suggestions include using 2FA, visual fingerprints, and signing the destination address with the key of an already-known address. However, finding a solution that meets both criteria remains a challenge. The discussion also highlighted the need for a convenient mechanism for end-users to transfer an address from a web page to the wallet address input field. Various methods such as QR code scanning and URI intents were suggested, but the adoption of these features may be slow. The BIP70 payment protocol with authentication via certificates was mentioned as a solution for well-known entities, but it does not cover the use case of relying solely on the person in front of you as the trust anchor.

Discussion History

0
Adam FicsorOriginal Post
November 7, 2018 14:09 UTC
1
November 7, 2018 21:28 UTC
2
November 8, 2018 08:11 UTC
3
November 8, 2018 15:28 UTC
4
November 8, 2018 17:12 UTC
5
November 8, 2018 17:43 UTC
6
November 8, 2018 18:00 UTC
7
November 12, 2018 03:23 UTC
8
December 1, 2018 04:57 UTC
9
December 1, 2018 12:07 UTC