How can one verify the address you are sending BTC to

Question

I've had an incident with an exchange that provides addresses to deposit BTC funds. For some unknown reason, the exchange is telling me they have never received the funds. I read the address with a QR code reader so, unless there are problem using QR codes everything should be correct. I can see the transaction on the block chain and it has been sitting there for many days now.

Is there some method of verifying the addresses provided by an exchange (or anyone) that the address is theirs and they can confirm it is theirs via some sort of response mechanism to an address verification query on the blockchain prior to sending actual funds? Is this doable using the Sign Message feature? I've been researching this but don't understand what the Signing address is? Is it my public key or the key derived from my public key? Please point me to the docs that explain this process.

Thanks

Answer 1

No, this isn't something that can be accomplished within Bitcoin itself.

Normally you get this kind of verification from having the address presented to you by a secure website (HTTPS) which you know belongs to the intended recipient, via an SSL certificate signed by a trusted authority (signified by a padlock icon in your browser or something similar). But if either the recipient's server or your computer have been hacked, this address could be modified by an attacker to be his address instead. (SSL only guarantees that he can't do it simply by modifying the data traveling over the Internet between the two of you.) So in principle, you could verify the address by contacting the recipient some other way, e.g. a support phone number or something. But this depends on the recipient giving you a way to do this, and it doesn't happen via the blockchain or anything unique to Bitcoin.

Bitcoin does provide a mechanism for message signing, but it doesn't really help here. With this system, the owner of an address can sign a message, and others can verify the signature. So you could get a signed message saying "Yes we are the XYZ exchange", and verify that the address owner signed it. But in case of the attack mentioned above, you have been given an address that really belongs to the attacker, and the attacker can therefore sign a message saying "Yes we are the XYZ exchange", which will properly verify. A digital signature doesn't prove that the content of the message is truthful.