Electrum security model concerns



Summary:

MultiBit Merchant is a Java backend offering a RESTful API using HAL+JSON. The platform provides a comprehensive set of order and invoice processing, accounting, inventory/delivery management, and customer account handling facilities for use with a wide variety of online business models. There will be a variety of front ends, one of which is an online shop. Since most folks are shy of using any technology, it is likely that MultiBit Merchant+ will be offered as part of a SaaS type solution. This allows anyone who doesn't have the knowledge to configure it for themselves to make use of it. MBM will use BitcoinJ and will depend on a bucket of public keys for transactions until the HD support is in place to allow generation of public keys without private keys being present. This removes the need for private keys to be present on the servers and allows consumers of the SaaS model to provide their transaction keys. The code is released under MIT license so anyone, anywhere can use it to build the Bitcoin economy.Mike Hearn suggests MultiBit Merchant will provide something similar based on bcj. The protocol between the clients and servers is unauthenticated cleartext JSON in TCP. Communicating transaction confidence to users is something of an open UI design problem right now. The lack of actually reported double-spends against unconfirmed transactions makes it difficult to explain what the risks are for a given number confirmations. Mike Hearn hopes to find and get agreement on somebody clueful and trustworthy to work on the Bitcoin.org website. Bitcoin, the project, needs a stronger voice than it currently has, partly to speak about such issues. An FAQ that isn't on the wiki would be good. A simple "Welcome to Bitcoin" flow on the Bitcoin.org website that guides people to appropriate clients, teaches them the security basics, etc, would be excellent.


Updated on: 2023-06-06T07:46:07.815897+00:00