Received: from sog-mx-1.v43.ch3.sourceforge.com ([172.29.43.191] helo=mx.sourceforge.net) by sfs-ml-4.v29.ch3.sourceforge.com with esmtp (Exim 4.76) (envelope-from ) id 1VOqF8-0001cQ-8w for bitcoin-development@lists.sourceforge.net; Wed, 25 Sep 2013 14:39:06 +0000 Received-SPF: pass (sog-mx-1.v43.ch3.sourceforge.com: domain of gmail.com designates 209.85.214.54 as permitted sender) client-ip=209.85.214.54; envelope-from=mh.in.england@gmail.com; helo=mail-bk0-f54.google.com; Received: from mail-bk0-f54.google.com ([209.85.214.54]) by sog-mx-1.v43.ch3.sourceforge.com with esmtps (TLSv1:RC4-SHA:128) (Exim 4.76) id 1VOqF6-00082x-Np for bitcoin-development@lists.sourceforge.net; Wed, 25 Sep 2013 14:39:06 +0000 Received: by mail-bk0-f54.google.com with SMTP id mz12so2328341bkb.13 for ; Wed, 25 Sep 2013 07:38:58 -0700 (PDT) MIME-Version: 1.0 X-Received: by 10.204.168.197 with SMTP id v5mr28054280bky.24.1380119938206; Wed, 25 Sep 2013 07:38:58 -0700 (PDT) Sender: mh.in.england@gmail.com Received: by 10.204.237.74 with HTTP; Wed, 25 Sep 2013 07:38:58 -0700 (PDT) In-Reply-To: References: <521298F0.20108@petersson.at> Date: Wed, 25 Sep 2013 16:38:58 +0200 X-Google-Sender-Auth: CncDn4aKkpCJbE0dqb5xgG_vn3w Message-ID: From: Mike Hearn To: Jeff Garzik Content-Type: multipart/alternative; boundary=bcaec52c5efbaa41bf04e7363680 X-Spam-Score: -0.5 (/) X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. -1.5 SPF_CHECK_PASS SPF reports sender host as permitted sender for sender-domain 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (mh.in.england[at]gmail.com) -0.0 SPF_PASS SPF: sender matches SPF record 1.0 HTML_MESSAGE BODY: HTML included in message 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature X-Headers-End: 1VOqF6-00082x-Np Cc: Bitcoin Dev , Andreas Schildbach Subject: Re: [Bitcoin-development] Payment Protocol: BIP 70, 71, 72 X-BeenThere: bitcoin-development@lists.sourceforge.net X-Mailman-Version: 2.1.9 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Sep 2013 14:39:06 -0000 --bcaec52c5efbaa41bf04e7363680 Content-Type: text/plain; charset=UTF-8 Low light shouldn't be an issue for QRcodes generated by phones. They have backlit screens that should always be bright enough. I can see how it might be an issue for printed codes. If your phone has no Bitcoin app installed then being redirected to an invoice page is pretty useless, you still won't be able to pay the bill no matter what (where do you get the money from?). If they are just raw HTTP URLs then it means the effect of scanning a QRcode with a standalone scanner app is different to scanning it inside the wallet, which is unlike all other uses of QRcodes I know of. So I'm not really convinced by that UX yet. Perhaps we can thrash it out in Amsterdam. Right now I'm thinking QRcodes should always contain bitcoin URIs. On Wed, Sep 25, 2013 at 4:31 PM, Jeff Garzik wrote: > BitPay experimented with QR codes in low light, restaurant and other > conditions. QR codes become difficult to use even at 100 chars. > > On the merchant side, we prefer a short URL that speaks payment > protocol if visited via bitcoin client, but will gracefully work if > scanned by a phone with zero bitcoin support -- you will simply be > redirected to a BitPay invoice page for a normal browser. > > > > On Wed, Sep 25, 2013 at 7:59 AM, Andreas Schildbach > wrote: > > On 09/25/2013 01:45 PM, Mike Hearn wrote: > > > >> OK, it might fit if you don't use any of the features the protocol > >> provides :) > > > > Now you're dver-dramaticing (-: > > > > I'm just skipping one feature which I think is useless for QR codes > > scanned in person. > > > >> You can try it here: > > > > Thanks. A typical request would be around 60 bytes, which should produce > > an URL with around 100 chars. That should be fine for scanning, but I > > will experiment. > > > >> If you're thinking about governments and so on subverting CA's, then > >> there is a plan for handling that (outside the Bitcoin world) called > >> certificate transparency which is being implemented now. > > > > Good to hear. Let's see if it gets momentum. > > > >> Now when you are getting a QR code from the web, it's already being > >> served over HTTPS. So if you're up against an attacker who can break a > >> CA in order to steal your money, then you already lose, the QRcode > >> itself as MITMd. > > > > Sure. I was talking about QR codes scanned in person. > > > >> In the Bluetooth case we might have to keep the address around and use > >> it to do ECDHE or something like that. > > > > Yeah, will look at that as soon as we're implementing the payment > > protocol fully. > > > > > > > > > ------------------------------------------------------------------------------ > > October Webinars: Code for Performance > > Free Intel webinars can help you accelerate application performance. > > Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most > from > > the latest Intel processors and coprocessors. See abstracts and register > > > > > http://pubads.g.doubleclick.net/gampad/clk?id=60133471&iu=/4140/ostg.clktrk > > _______________________________________________ > > Bitcoin-development mailing list > > Bitcoin-development@lists.sourceforge.net > > https://lists.sourceforge.net/lists/listinfo/bitcoin-development > > > > -- > Jeff Garzik > Senior Software Engineer and open source evangelist > BitPay, Inc. https://bitpay.com/ > > > ------------------------------------------------------------------------------ > October Webinars: Code for Performance > Free Intel webinars can help you accelerate application performance. > Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most > from > the latest Intel processors and coprocessors. See abstracts and register > > http://pubads.g.doubleclick.net/gampad/clk?id=60133471&iu=/4140/ostg.clktrk > _______________________________________________ > Bitcoin-development mailing list > Bitcoin-development@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/bitcoin-development > --bcaec52c5efbaa41bf04e7363680 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Low light shouldn't be an issue for QRcodes generated = by phones. They have backlit screens that should always be bright enough. I= can see how it might be an issue for printed codes.

If = your phone has no Bitcoin app installed then being redirected to an invoice= page is pretty useless, you still won't be able to pay the bill no mat= ter what (where do you get the money from?). If they are just raw HTTP URLs= then it means the effect of scanning a QRcode with a standalone scanner ap= p is different to scanning it inside the wallet, which is unlike all other = uses of QRcodes I know of. So I'm not really convinced by that UX yet. = Perhaps we can thrash it out in Amsterdam. Right now I'm thinking QRcod= es should always contain bitcoin URIs.


On Wed,= Sep 25, 2013 at 4:31 PM, Jeff Garzik <jgarzik@bitpay.com> = wrote:
BitPay experimented with QR codes in low lig= ht, restaurant and other
conditions. =C2=A0QR codes become difficult to use even at 100 chars.

On the merchant side, we prefer a short URL that speaks payment
protocol if visited via bitcoin client, but will gracefully work if
scanned by a phone with zero bitcoin support -- you will simply be
redirected to a BitPay invoice page for a normal browser.



On Wed, Sep 25, 2013 at 7:59 AM, Andreas Schildbach
<andreas@schildbach.de> = wrote:
> On 09/25/2013 01:45 PM, Mike Hearn wrote:
>
>> OK, it might fit if you don't use any of the features the prot= ocol
>> provides :)
>
> Now you're dver-dramaticing (-:
>
> I'm just skipping one feature which I think is useless for QR code= s
> scanned in person.
>
>> You can try it here:
>
> Thanks. A typical request would be around 60 bytes, which should produ= ce
> an URL with around 100 chars. That should be fine for scanning, but I<= br> > will experiment.
>
>> If you're thinking about governments and so on subverting CA&#= 39;s, then
>> there is a plan for handling that (outside the Bitcoin world) call= ed
>> certificate transparency which is being implemented now.
>
> Good to hear. Let's see if it gets momentum.
>
>> Now when you are getting a QR code from the web, it's already = being
>> served over HTTPS. So if you're up against an attacker who can= break a
>> CA in order to steal your money, then you already lose, the QRcode=
>> itself as MITMd.
>
> Sure. I was talking about QR codes scanned in person.
>
>> In the Bluetooth case we might have to keep the address around and= use
>> it to do ECDHE or something like that.
>
> Yeah, will look at that as soon as we're implementing the payment<= br> > protocol fully.
>
>
>
> ----------------------------------------------------------------------= --------
> October Webinars: Code for Performance
> Free Intel webinars can help you accelerate application performance. > Explore tips for MPI, OpenMP, advanced profiling, and more. Get the mo= st from
> the latest Intel processors and coprocessors. See abstracts and regist= er >
> http://pubads.g.doubleclick.net= /gampad/clk?id=3D60133471&iu=3D/4140/ostg.clktrk
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-d= evelopment@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitco= in-development



--
Jeff Garzik
Senior Software Engineer and open source evangelist
BitPay, Inc. =C2=A0 =C2=A0 =C2=A0https://bitpay.com/

-----------------------------= -------------------------------------------------
October Webinars: Code for Performance
Free Intel webinars can help you accelerate application performance.
Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most fr= om
the latest Intel processors and coprocessors. See abstracts and register &g= t;
http://pubads.g.doubleclick.net/gam= pad/clk?id=3D60133471&iu=3D/4140/ostg.clktrk
_______________________________________________
Bitcoin-development mailing list
Bitcoin-develo= pment@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bitcoin-de= velopment

--bcaec52c5efbaa41bf04e7363680--