Delivery-date: Fri, 03 May 2024 17:15:00 -0700
Sender: bitcoindev@googlegroups.com
Received-SPF: pass (google.com: domain of luke@dashjr.org designates 2001:470:88ff:2f::1 as permitted sender) client-ip=2001:470:88ff:2f::1;
Content-Type: multipart/alternative;
 boundary="------------uoblP8yacIbtpmlM1guODxIo"
Message-ID: <e617f6eb-dd11-4ca2-aba6-f80ace8863a8@dashjr.org>
Date: Fri, 3 May 2024 20:11:49 -0400
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [bitcoindev] BIP 322 use case
To: bitcoindev@googlegroups.com
References: <9004c5d4-6b9d-4ac1-834c-902ba4901e05n@googlegroups.com>
Content-Language: en-US, en-GB
From: Luke Dashjr <luke@dashjr.org>
In-Reply-To: <9004c5d4-6b9d-4ac1-834c-902ba4901e05n@googlegroups.com>
Precedence: list
Mailing-list: list bitcoindev@googlegroups.com; contact bitcoindev+owners@googlegroups.com

This is a multi-part message in MIME format.
--------------uoblP8yacIbtpmlM1guODxIo
Content-Type: text/plain; charset="UTF-8"; format=flowed

KYC is not an intended use case for signed messages, and attempts to use 
it for that are probably one of the bigger reasons BIP322 has not moved 
further - most people do not want to encourage nor enable such nonsense. 
If you absolutely must only allow withdrawls to the user's own address, 
I would suggest taking a more traditional approach of asking the user to 
affirm it with a checkbox. (This is not legal advice, but it seems crazy 
to demand cryptographic proof from Bitcoin companies, when traditional 
finance is okay with a mere attestation)

Technically speaking, however, the biggest hurdle is that there is very 
little apparent interest in the one limited use case it *is* meant for: 
agreeing to a contract before funds are sent. To a limited extent, a 
secondary use case has been simply using Bitcoin addresses as a kind of 
login mechanism (eg, #Bitcoin-OTC and OCEAN). But the feature with much 
higher demand is proof-of-funds and proof-of-sender, which BIP322 began 
to address, but turns out to be much more complicated than it seems at 
face value (I recently looked into this again as part of relaunching 
OCEAN). That being said, BIP322 as-is has already been adopted by at 
least some wallets, despite its unfinished state. So if someone were to 
pick up this task, it would probably need to be done as a new BIP. :/

Luke


On 5/3/24 19:53, ProfEduStream wrote:
>
> Hey,
>
> As a Bitcoin association, we're currently facing an issue because 
> we're unable to sign an address with our multi-sig wallet.
> After conducting some research, I came across BIP322 in these 
> threads:https://bitcointalk.org/index.php?topic=5408898.0 & 
> https://github.com/bitcoin/bips/pull/1347
>
> _Explanation_:
>
> As a Bitcoin association, we offer membership to everyone for a few 
> thousand sats per year. To facilitate this process, we utilize "Swiss 
> Bitcoin Pay". It's an application that allows us to easily manage our 
> accounting. Additionally, we onboard merchants with this app because 
> of its user-friendly interface and self-custodial capabilities, making 
> it very convenient. The accounting features are also highly beneficial.
>
> To utilize this application in a self-custodial manner, users need to 
> paste a Bitcoin address on the "Swiss Bitcoin Pay" dashboard and then 
> sign a message with this address. This serves as a 
> "Proof-of-Ownership" and is a legal requirement in some regulated 
> countries. "Swiss Bitcoin Pay" is not the only application that 
> requires signing a message as a "Proof-of-Ownership". Peach, a non-KYC 
> P2P Bitcoin application, is another example.
>
> Given our goal to decentralize our treasury, we naturally opt for a 
> multi-sig wallet, similar to many companies. However, as you know, BIP 
> 322 hasn't been pushed and it's currently impossible to sign a message 
> with a multi-sig wallet.
>
>
> _Conclusion_:
>
> I'm unsure why BIP322 hasn't been pushed or addressed in the past few 
> months/years, but I want to highlight its necessity.
> Additionally, I hope that this comment sheds light on a deficiency in 
> our Bitcoin ecosystem, and I trust that further improvements will be 
> made to enable people to sign a message with a multi-sig wallet.
>
>
> I'm available to assist if needed.
>
> @ProfEduStream
>
> -- 
> You received this message because you are subscribed to the Google 
> Groups "Bitcoin Development Mailing List" group.
> To unsubscribe from this group and stop receiving emails from it, send 
> an email to bitcoindev+unsubscribe@googlegroups.com.
> To view this discussion on the web visit 
> https://groups.google.com/d/msgid/bitcoindev/9004c5d4-6b9d-4ac1-834c-902ba4901e05n%40googlegroups.com 
> <https://groups.google.com/d/msgid/bitcoindev/9004c5d4-6b9d-4ac1-834c-902ba4901e05n%40googlegroups.com?utm_medium=email&utm_source=footer>.

-- 
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/bitcoindev/e617f6eb-dd11-4ca2-aba6-f80ace8863a8%40dashjr.org.

--------------uoblP8yacIbtpmlM1guODxIo
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DUTF-8=
">
  </head>
  <body>
    <p>KYC is not an intended use case for signed messages, and attempts
      to use it for that are probably one of the bigger reasons BIP322
      has not moved further - most people do not want to encourage nor
      enable such nonsense. If you absolutely must only allow withdrawls
      to the user's own address, I would suggest taking a more
      traditional approach of asking the user to affirm it with a
      checkbox. (This is not legal advice, but it seems crazy to demand
      cryptographic proof from Bitcoin companies, when traditional
      finance is okay with a mere attestation)<br>
    </p>
    <p>Technically speaking, however, the biggest hurdle is that there
      is very little apparent interest in the one limited use case it
      *is* meant for: agreeing to a contract before funds are sent. To a
      limited extent, a secondary use case has been simply using Bitcoin
      addresses as a kind of login mechanism (eg, #Bitcoin-OTC and
      OCEAN). But the feature with much higher demand is proof-of-funds
      and proof-of-sender, which BIP322 began to address, but turns out
      to be much more complicated than it seems at face value (I
      recently looked into this again as part of relaunching OCEAN).
      That being said, BIP322 as-is has already been adopted by at least
      some wallets, despite its unfinished state. So if someone were to
      pick up this task, it would probably need to be done as a new BIP.
      :/<br>
    </p>
    <p>Luke</p>
    <p><br>
    </p>
    <div class=3D"moz-cite-prefix">On 5/3/24 19:53, ProfEduStream wrote:<br=
>
    </div>
    <blockquote type=3D"cite"
      cite=3D"mid:9004c5d4-6b9d-4ac1-834c-902ba4901e05n@googlegroups.com">
      <p dir=3D"auto">Hey,</p>
      <p dir=3D"auto">As a Bitcoin association, we're currently facing an
        issue because we're unable to sign an address with our multi-sig
        wallet.<br>
        After conducting some research, I came across BIP322 in these
        threads:<span> </span><a
          href=3D"https://bitcointalk.org/index.php?topic=3D5408898.0"
          moz-do-not-send=3D"true" class=3D"moz-txt-link-freetext">https://=
bitcointalk.org/index.php?topic=3D5408898.0</a>
        &amp; <a href=3D"https://github.com/bitcoin/bips/pull/1347"
          moz-do-not-send=3D"true" class=3D"moz-txt-link-freetext">https://=
github.com/bitcoin/bips/pull/1347</a><br>
        <br>
      </p>
      <p dir=3D"auto"><u>Explanation</u>:</p>
      <p dir=3D"auto">As a Bitcoin association, we offer membership to
        everyone for a few thousand sats per year. To facilitate this
        process, we utilize "Swiss Bitcoin Pay". It's an application
        that allows us to easily manage our accounting. Additionally, we
        onboard merchants with this app because of its user-friendly
        interface and self-custodial capabilities, making it very
        convenient. The accounting features are also highly beneficial.</p>
      <p dir=3D"auto">To utilize this application in a self-custodial
        manner, users need to paste a Bitcoin address on the "Swiss
        Bitcoin Pay" dashboard and then sign a message with this
        address. This serves as a "Proof-of-Ownership" and is a legal
        requirement in some regulated countries. "Swiss Bitcoin Pay" is
        not the only application that requires signing a message as a
        "Proof-of-Ownership". Peach, a non-KYC P2P Bitcoin application,
        is another example.</p>
      <p dir=3D"auto">Given our goal to decentralize our treasury, we
        naturally opt for a multi-sig wallet, similar to many companies.
        However, as you know, BIP 322 hasn't been pushed and it's
        currently impossible to sign a message with a multi-sig wallet.</p>
      <p dir=3D"auto"><br>
      </p>
      <p dir=3D"auto"><u>Conclusion</u>:</p>
      <p dir=3D"auto">I'm unsure why BIP322 hasn't been pushed or
        addressed in the past few months/years, but I want to highlight
        its necessity.<br>
        Additionally, I hope that this comment sheds light on a
        deficiency in our Bitcoin ecosystem, and I trust that further
        improvements will be made to enable people to sign a message
        with a multi-sig wallet.</p>
      <p dir=3D"auto"><br>
      </p>
      <p dir=3D"auto">I'm available to assist if needed<span>.</span></p>
      <p dir=3D"auto"><span>@ProfEduStream<br>
        </span></p>
      -- <br>
      You received this message because you are subscribed to the Google
      Groups "Bitcoin Development Mailing List" group.<br>
      To unsubscribe from this group and stop receiving emails from it,
      send an email to <a
        href=3D"mailto:bitcoindev+unsubscribe@googlegroups.com"
        moz-do-not-send=3D"true" class=3D"moz-txt-link-freetext">bitcoindev=
+unsubscribe@googlegroups.com</a>.<br>
      To view this discussion on the web visit <a
href=3D"https://groups.google.com/d/msgid/bitcoindev/9004c5d4-6b9d-4ac1-834=
c-902ba4901e05n%40googlegroups.com?utm_medium=3Demail&amp;utm_source=3Dfoot=
er"
        moz-do-not-send=3D"true">https://groups.google.com/d/msgid/bitcoind=
ev/9004c5d4-6b9d-4ac1-834c-902ba4901e05n%40googlegroups.com</a>.<br>
    </blockquote>
  </body>
</html>

<p></p>

-- <br />
You received this message because you are subscribed to the Google Groups &=
quot;Bitcoin Development Mailing List&quot; group.<br />
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:bitcoindev+unsubscribe@googlegroups.com">bitcoind=
ev+unsubscribe@googlegroups.com</a>.<br />
To view this discussion on the web visit <a href=3D"https://groups.google.c=
om/d/msgid/bitcoindev/e617f6eb-dd11-4ca2-aba6-f80ace8863a8%40dashjr.org?utm=
_medium=3Demail&utm_source=3Dfooter">https://groups.google.com/d/msgid/bitc=
oindev/e617f6eb-dd11-4ca2-aba6-f80ace8863a8%40dashjr.org</a>.<br />

--------------uoblP8yacIbtpmlM1guODxIo--