Bitcoin at POS using BIP70, NFC and offline payments [combined summary]


Individual post summaries: Click here to read the original discussion on the bitcoin-dev mailing list

Published on: 2015-03-03T00:54:18+00:00

Summary:

The email conversations revolve around various aspects of improving the bitcoin URI scheme and addressing security concerns in NFC and Bluetooth transactions. There are suggestions to add parameters to the bitcoin URI to simplify wallet development for NFC-only wallets and to improve security for Bluetooth transactions. The use of fallback addresses is debated, with some participants suggesting adding their own parameter instead. The discussion also covers the format of the Session ID, the elimination of the h= parameter, and the use of base58 encoding.There are concerns about the compromise of public keys and the potential for abuse scenarios in point-of-sale systems. The conversation explores the use of public keys via NFC or QR codes and the need for authentication of payers by payees. Reusing public keys is deemed insecure, and suggestions are made to encrypt secrets with public keys or use ephemeral keys. The debate extends to using self-signed certificates versus those signed by a Certificate Authority (CA) and the identification of customers in various scenarios.The reliability of NFC payment transfers is discussed, with suggestions to limit connection speed or run mechanisms in parallel. Compatibility issues with NFC based on the long certificate chain are also discussed, as well as concerns about enabling Bluetooth and potential solutions to turn it on programmatically. Changes to the "ack" memo field and BitPay's memo field are considered. The security risks of NFC and Bluetooth payment transactions are examined, with proposals to send a unique public key over NFC to prevent spoofing and seller impersonation. The use of public certificates versus session keys is debated, with the consensus leaning towards the former for increased security.In another email conversation, the topic of limiting Bitcoin capabilities based on Apple's product capabilities and their stance towards Bitcoin is discussed. It is suggested that Bitcoin should not be limited due to Apple's restrictions and that an Airbitz-like proposal could be implemented as a fallback. The general consensus is that Apple will likely open up NFC to developers in iOS 9 and that Apple doesn't really care about Bitcoin. The history of Bitcoin wallets being banned from the app store and then allowed back in is mentioned, with the opinion that Bitcoin is too small for Apple to be concerned about.In an email exchange on February 22, 2015, Eric Voskuil suggested encoding MAC addresses and resource names using base58 instead of base16. Another person responded, stating that Base64Url is a more efficient encoding method than Base58 and is implemented in more libraries and operating systems. They also noted that Base58 was designed for copy-typing by humans.The email conversations also discuss the security of NFC and Bluetooth communication. Concerns are raised about the privacy of NFC communication and the possibility of eavesdropping. The use of SSL/TLS for private communication over a public channel is debated, as well as the privacy implications of NFC and Bluetooth communication.Overall, the email conversations cover various aspects of implementing NFC and offline payments, proposing changes to the bitcoin payment protocol, and addressing security concerns in NFC and Bluetooth transactions. The discussions aim to improve the bitcoin URI scheme, find solutions to authentication and abuse scenarios, and ensure the security of payment transactions.

Updated on: 2023-08-01T11:54:07.905855+00:00