Received-SPF: pass (sog-mx-1.v43.ch3.sourceforge.com: domain of gmail.com
	designates 209.85.217.179 as permitted sender)
	client-ip=209.85.217.179; envelope-from=elarch@gmail.com;
	helo=mail-lb0-f179.google.com; 
MIME-Version: 1.0
In-Reply-To: <CAJna-Hhz+K0iw4b8DDp5tNpQg6nJABKmu__aDbgT9M26PJ9tAg@mail.gmail.com>
References: <CA+WZAEp3HsW5ESGUZ7YfR1MZXGC5jd+LucUt_MUP8K94Xwhuhg@mail.gmail.com>
	<CANEZrP0KVyp2Va7Wyy=t0qYkLNK9BDUaSzBfuzQss+=weLJ1Fw@mail.gmail.com>
	<CA+WZAEqYKv8T1OMCKhOJvf5FAy=WujJ=OhtsYP9aBf=4ZPNxmw@mail.gmail.com>
	<CANEZrP0DTYqobECBbw6eZqdk+-TR_2jhBtOviN08r31EQGmZHQ@mail.gmail.com>
	<CANEZrP2Z5x0_kOQ=8-BMzbmi9=D=ou=s3dgEksMA5F84BHSt9A@mail.gmail.com>
	<CA+WZAEqREDkDvmhM7AY+Ju3fkm3uOGm39Ef9+SYoEr43ybbg2Q@mail.gmail.com>
	<CAJna-Hhz+K0iw4b8DDp5tNpQg6nJABKmu__aDbgT9M26PJ9tAg@mail.gmail.com>
From: =?ISO-8859-1?Q?Eric_Larchev=EAque?= <elarch@gmail.com>
Date: Fri, 4 Apr 2014 17:09:08 +0200
Message-ID: <CA+WZAErh6M6BV1imAXZaHQjX+5RKtj7Ma7_-+5KW9BpLw354Sg@mail.gmail.com>
To: slush <slush@centrum.cz>
Content-Type: multipart/alternative; boundary=001a11349f4c7525aa04f638e7aa
Cc: Bitcoin Dev <bitcoin-development@lists.sourceforge.net>
Subject: Re: [Bitcoin-development] Draft BIP for seamless website
 authentication using Bitcoin address
Precedence: list

--001a11349f4c7525aa04f638e7aa
Content-Type: text/plain; charset=ISO-8859-1

On Fri, Apr 4, 2014 at 4:56 PM, slush <slush@centrum.cz> wrote:

> I'm cracking my head for many months with the idea of using TREZOR for web
> auth purposes. Unfortunately I'm far from any usable solution yet.
>
> My main comments to your BIP: Don't use bitcoin addresses directly and
> don't encourage services to use this "login" for financial purposes. Mike
> is right, mixing authentication and financial services is wrong. Use some
> function to generate other private/public key from bitcoin's seed/private
> key to not leak bitcoin-related data to website.
>
>
I'm probably very naive, but the fact that the authentication key is your
Bitcoin address was for me a great feature :)
What are the risks associated of id yourself with a bitcoin address you
plan to use on the website for transaction ?

I mean, what is the difference between doing that, and id with a login/pass
and add your bitcoin address in a settings field ? (knowing you could
always find a mechanism to transfer the account to another bitcoin address
if needed)

Eric

--001a11349f4c7525aa04f638e7aa
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_extra"><div class=3D"gmail_quote">On F=
ri, Apr 4, 2014 at 4:56 PM, slush <span dir=3D"ltr">&lt;<a href=3D"mailto:s=
lush@centrum.cz" target=3D"_blank">slush@centrum.cz</a>&gt;</span> wrote:<b=
r><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;borde=
r-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid=
;padding-left:1ex">

<div dir=3D"ltr">I&#39;m cracking my head for many months with the idea of =
using TREZOR for web auth purposes. Unfortunately I&#39;m far from any usab=
le solution yet.<div><br></div><div>My main comments to your BIP: Don&#39;t=
 use bitcoin addresses directly and don&#39;t encourage services to use thi=
s &quot;login&quot; for financial purposes. Mike is right, mixing authentic=
ation and financial services is wrong. Use some function to generate other =
private/public key from bitcoin&#39;s seed/private key to not leak bitcoin-=
related data to website.</div>


<div><br></div></div></blockquote><div><br></div><div>I&#39;m probably very=
 naive, but the fact that the authentication key is your Bitcoin address wa=
s for me a great feature :)</div><div>What are the risks associated of id y=
ourself with a bitcoin address you plan to use on the website for transacti=
on ?</div>

<div><br></div><div>I mean, what is the difference between doing that, and =
id with a login/pass and add your bitcoin address in a settings field ? (kn=
owing you could always find a mechanism to transfer the account to another =
bitcoin address if needed)</div>

<div><br></div><div>Eric</div><div><br></div></div></div></div>

--001a11349f4c7525aa04f638e7aa--