Pieter, it was more rhetorical question than asking for explanation, but thanks anyway. As an Internet application developer, I of course understand security issues while using HTTPS and CA.<div><br></div><div>I have a gut feeling that there simply does not exist any single solution which is both easy to use and secure enough. At least nobody mentioned it yet. And if I need to choose between easy solution or secure solution for aliases, I'll pick that easy one. I mean - we need some solution which will be easy enough for daily use; it is something what we currently don't have. But if I want to be really really sure I'm using correct destination for paying $1mil for a house, I can every time ask for real bitcoin addresses, this is that secure way which we currently have. </div>
<div><br></div><div>slush<br><br><div class="gmail_quote">On Mon, Dec 19, 2011 at 2:14 AM, Pieter Wuille <span dir="ltr"><<a href="mailto:pieter.wuille@gmail.com">pieter.wuille@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">On Mon, Dec 19, 2011 at 12:58:37AM +0100, slush wrote:<br>
> Maybe I'm retarded, but where's the point in providing alliases containing<br>
> yet another hash in URL?<br>
<br>
</div>Any DNS-based alias system is vulnerable to spoofing. If I can make people's<br>
DNS server believe that <a href="http://mining.cz" target="_blank">mining.cz</a> points to my IP, I'll receive payments to<br>
you...<br>
<br>
If no trusted CA is used to authenticate the communication, there is no way<br>
to be sure the one you are asking how to pay, is the person you want to pay.<br>
Therefore, one solution is to put a bitcoin address in the identification<br>
string itself, and requiring SSL communication authenticated using the<br>
respective key.<br>
<br>
This makes the identification strings obviously less useful as aliases,<br>
but pure aliases in the sense of human-typable strings have imho<br>
limited usefulness anyway - in most cases these identification strings<br>
will be communicated through other electronic means anyway.<br>
<br>
Furthermore, the embedded bitcoin address could be hidden from the user:<br>
retrieved when first connecting, and stored together with the URI in<br>
an address book. Like ssh, it could warn the user if the key changes<br>
(which wil be ignored by most users anyway, but what do you do about<br>
that?)<br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
Pieter<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
------------------------------------------------------------------------------<br>
Learn Windows Azure Live! Tuesday, Dec 13, 2011<br>
Microsoft is holding a special Learn Windows Azure training event for<br>
developers. It will provide a great way to learn Windows Azure and what it<br>
provides. You can attend the event by watching it streamed LIVE online.<br>
Learn more at <a href="http://p.sf.net/sfu/ms-windowsazure" target="_blank">http://p.sf.net/sfu/ms-windowsazure</a><br>
_______________________________________________<br>
Bitcoin-development mailing list<br>
<a href="mailto:Bitcoin-development@lists.sourceforge.net">Bitcoin-development@lists.sourceforge.net</a><br>
<a href="https://lists.sourceforge.net/lists/listinfo/bitcoin-development" target="_blank">https://lists.sourceforge.net/lists/listinfo/bitcoin-development</a><br>
</div></div></blockquote></div><br></div>