1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
|
Received: from sog-mx-3.v43.ch3.sourceforge.com ([172.29.43.193]
helo=mx.sourceforge.net)
by sfs-ml-2.v29.ch3.sourceforge.com with esmtp (Exim 4.76)
(envelope-from <laanwj@gmail.com>) id 1WJeKB-0007X5-Aq
for bitcoin-development@lists.sourceforge.net;
Sat, 01 Mar 2014 07:27:07 +0000
Received-SPF: pass (sog-mx-3.v43.ch3.sourceforge.com: domain of gmail.com
designates 209.85.215.170 as permitted sender)
client-ip=209.85.215.170; envelope-from=laanwj@gmail.com;
helo=mail-ea0-f170.google.com;
Received: from mail-ea0-f170.google.com ([209.85.215.170])
by sog-mx-3.v43.ch3.sourceforge.com with esmtps (TLSv1:RC4-SHA:128)
(Exim 4.76) id 1WJeK7-0003hL-PD
for bitcoin-development@lists.sourceforge.net;
Sat, 01 Mar 2014 07:27:07 +0000
Received: by mail-ea0-f170.google.com with SMTP id g15so3229507eak.1
for <bitcoin-development@lists.sourceforge.net>;
Fri, 28 Feb 2014 23:26:57 -0800 (PST)
MIME-Version: 1.0
X-Received: by 10.204.104.193 with SMTP id q1mr4996263bko.6.1393658817526;
Fri, 28 Feb 2014 23:26:57 -0800 (PST)
Received: by 10.205.75.72 with HTTP; Fri, 28 Feb 2014 23:26:57 -0800 (PST)
In-Reply-To: <op.xb05iptvyldrnw@laptop-air>
References: <op.xb05iptvyldrnw@laptop-air>
Date: Sat, 1 Mar 2014 08:26:57 +0100
Message-ID: <CA+s+GJBD-L8Lz+dsEgL+_xzJbrqjC7z_9Z45ow=xoccxwEdssQ@mail.gmail.com>
From: Wladimir <laanwj@gmail.com>
To: Jeremy Spilman <jeremy@taplink.co>
Content-Type: multipart/alternative; boundary=001a11333b46c1e48204f3867a9b
X-Spam-Score: -0.6 (/)
X-Spam-Report: Spam Filtering performed by mx.sourceforge.net.
See http://spamassassin.org/tag/ for more details.
-1.5 SPF_CHECK_PASS SPF reports sender host as permitted sender for
sender-domain
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(laanwj[at]gmail.com)
-0.0 SPF_PASS SPF: sender matches SPF record
1.0 HTML_MESSAGE BODY: HTML included in message
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
author's domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature,
not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
X-Headers-End: 1WJeK7-0003hL-PD
Cc: "bitcoin-development@lists.sourceforge.net"
<bitcoin-development@lists.sourceforge.net>
Subject: Re: [Bitcoin-development] Positive and negative feedback on
certificate validation errors
X-BeenThere: bitcoin-development@lists.sourceforge.net
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: <bitcoin-development.lists.sourceforge.net>
List-Unsubscribe: <https://lists.sourceforge.net/lists/listinfo/bitcoin-development>,
<mailto:bitcoin-development-request@lists.sourceforge.net?subject=unsubscribe>
List-Archive: <http://sourceforge.net/mailarchive/forum.php?forum_name=bitcoin-development>
List-Post: <mailto:bitcoin-development@lists.sourceforge.net>
List-Help: <mailto:bitcoin-development-request@lists.sourceforge.net?subject=help>
List-Subscribe: <https://lists.sourceforge.net/lists/listinfo/bitcoin-development>,
<mailto:bitcoin-development-request@lists.sourceforge.net?subject=subscribe>
X-List-Received-Date: Sat, 01 Mar 2014 07:27:07 -0000
--001a11333b46c1e48204f3867a9b
Content-Type: text/plain; charset=UTF-8
On Sat, Mar 1, 2014 at 7:26 AM, Jeremy Spilman <jeremy@taplink.co> wrote:
> There's a open bug (#3628) and pull request (#3684) to provide negative
> feedback (yellow background) for a missing or invalid signature, but it
> seems like there's some debate on whether bitcoind should do that...
>
The consensus there is to treat invalid and unsigned payment requests the
same (apart from debug error logging). After all, the cost to the attacker
to remove the signature or corrupt it is exactly the same.
I do recommend testing that pull request (#3684) to see if it improves
payment request reporting, and provide testing reports or suggestions in
the github comments.
I've been very busy the last few weeks with integrating and testing other
pre-0.9 changes so I have been unable to look at the visual side of payment
request stuff much. We could use some help there.
If an attacker can avoid the negative feedback by just stripping the
> signature and setting pki_type to none, then arguably there's no security
> benefit by singling out badly signed payment requests from unsigned
> payment requests.
>
Exactly.
> So perhaps the root problem is that the positive feedback (green
> background) is not strong enough to make its absence highly conspicuous to
> the end user.
>
Well, ideas to make the difference more conspicuous are welcome. The green
background is just to make a basic distinction.
If it involves any imagery or graphics we do need contributions (with the
appropriate MIT license), no one of us is an artist.
> As an aside, how could we go about implementing the equivalent of HTTP
> Strict Transport Security for payment protocol to prevent this trivial
> signature stripping attack? Is this a possible extension field merchants
> are interested in?
>
Such a thing would be interesting for a future BIP standard. I see one
problem here: for an unsigned payment request there isn't really an
"origin". Browser URI handlers don't send the referrer either.
This rules out adding a field to the Bitcoin URI 'requests from us must be
signed from now on' (there's no us).
The server that serves the payment requests *could* serve an HSTS-like
header 'only accept signed payment requests from us from now on'. The
client needs to remember this for this server. Then if someone has
compromised that server (or hijacked DNS) to serve fake and unsigned
payment requests, the client can block these.
Neither scenario will help in the case in which the server serving the
Bitcoin URIs is compromised.
Wladimir
--001a11333b46c1e48204f3867a9b
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr"><div class=3D"gmail_extra"><div class=3D"gmail_quote">On S=
at, Mar 1, 2014 at 7:26 AM, Jeremy Spilman <span dir=3D"ltr"><<a href=3D=
"mailto:jeremy@taplink.co" target=3D"_blank">jeremy@taplink.co</a>></spa=
n> wrote:<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex">There's a open bug (#3628) and pull requ=
est (#3684) to provide negative<br>
feedback (yellow background) for a missing or invalid signature, but it<br>
seems like there's some debate on whether bitcoind should do that...<br=
></blockquote><div><br></div><div>The consensus there is to treat invalid a=
nd unsigned payment requests the same (apart from debug error logging). Aft=
er all, the cost to the attacker to remove the signature or corrupt it is e=
xactly the same.</div>
<div><br></div><div>I do recommend testing that pull request (#3684) to see=
if it improves payment request reporting, and provide testing reports or s=
uggestions in the github comments.</div><div><br></div><div>I've been v=
ery busy the last few weeks with integrating and testing other pre-0.9 chan=
ges so I have been unable to look at the visual side of payment request stu=
ff much. We could use some help there.</div>
<div><br></div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex=
;border-left:1px #ccc solid;padding-left:1ex">If an attacker can avoid the =
negative feedback by just stripping the<br>
signature and setting pki_type to none, then arguably there's no securi=
ty<br>
benefit by singling out badly signed payment requests from unsigned<br>
payment requests.<br></blockquote><div><br></div><div>Exactly.</div><div>=
=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;bo=
rder-left:1px #ccc solid;padding-left:1ex">So perhaps the root problem is t=
hat the positive feedback (green<br>
background) is not strong enough to make its absence highly conspicuous to<=
br>
the end user.<br></blockquote><div><br></div><div>Well, ideas to make the d=
ifference more conspicuous are welcome. The green background is just to mak=
e a basic distinction.</div><div><br></div><div>If it involves any imagery =
or graphics we do need contributions (with the appropriate MIT license), no=
one of us is an artist.</div>
<div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8=
ex;border-left:1px #ccc solid;padding-left:1ex">As an aside, how could we g=
o about implementing the equivalent of HTTP<br>
Strict Transport Security for payment protocol to prevent this trivial<br>
signature stripping attack? Is this a possible extension field merchants<br=
>
are interested in?<br></blockquote><div><br></div><div>Such a thing would b=
e interesting for a future BIP standard. I see one problem here: for an uns=
igned payment request there isn't really an "origin". Browser=
URI handlers don't send the referrer either.=C2=A0</div>
<div><br></div><div>This rules out adding a field to the Bitcoin URI 'r=
equests from us must be signed from now on' (there's no us).<br></d=
iv><div><br></div><div>The server that serves the payment requests *could* =
serve an HSTS-like header 'only accept signed payment requests from us =
from now on'. The client needs to remember this for this server. Then i=
f someone has compromised that server (or hijacked DNS) to serve fake and u=
nsigned payment requests, the client can block these.</div>
<div><br></div><div>Neither scenario will help in the case in which the ser=
ver serving the Bitcoin URIs is compromised.</div><div><br></div><div>Wladi=
mir</div><div><br></div></div></div></div>
--001a11333b46c1e48204f3867a9b--
|
