7 events
when toggle format what by license comment
Jun 11 '12 at 3:46 comment added nanotube luke: well, that can be done regardless of the content of the signed message. even if it is of the form "DATE, authenticating joe on #bitcoin-otc, NONCE", i can take it and say "hey here's a token signed to prove i'm joe".
Jun 11 '12 at 2:42 comment added Luke-Jr "Hi, I want to cancel <Joe's order> and get my refund sent to <nanotube's address>. Here is a token signed to prove I am Joe: <Joe's #bitcoin-otc auth>" Even if we trust you specifically, it sets a bad precedent for people to sign/accept these.
Jun 6 '12 at 4:09 comment added nanotube while this question is here, let me piggyback and ask for comments on signing one-time nonce values (as is currently implemented for #bitcoin-otc signmessage authentication). Any thoughts on that? it has been proposed by luke that even nonce values shouldn't be signed, without accompanying readable text stating what it is for and a timestamp. Is that a reasonable precaution to take, or are attacks on that pretty far-out in paranoia-land?
Apr 1 '12 at 18:57 comment added David Schwartz If you're really, really paranoid, you can include the transaction ID as well.
Apr 1 '12 at 17:00 history edited Chris Moore CC BY-SA 3.0
incorporate sipa's suggestion
Apr 1 '12 at 12:28 comment added Pieter Wuille Additionally, it's a good idea to add: a) who you (the sender) are (name, customer id, email, ...), b) who it is intended for (business name, ...) c) time and date.
Apr 1 '12 at 5:15 history answered Chris Moore CC BY-SA 3.0