Re: [whatwg] URI scheme whitelisting and the case of cryptocurrencies

Dnia 2015-03-07, sob o godzinie 15:45 -0800, Michael A. Peters pisze:
> Another thing to consider, most crypto-currencies use the same Qt
> client 
> codebase - so it is easy for a web site to specify a price in one 
> crypto-currency but use the URI scheme for a different one, and some 
> users may not realize the wrong client launched until it is too late
> and 
> can't be undone.
> 
> e.g. `Please donate 3 QRK - that's all I ask'
> 
> but 3 bitcoins are sent before the user realize it was bitcoin-qt
> that 
> the link launched.

There is also an example of multiple currency wallets, like Coinomi
Android wallet or previously mentioned Coinkite. An user may launch a QR
scanner inside his multi-wallet and scan a code which is said to
represent 3 blackcoins, but instead will resolve to 3 bitcoins. Or the
site may say it is requesting a payment of 35254.432424452 blackcoins,
but instead 352534.432424452 blackcoins will be presented on QR code.
Those are issues which can’t be fixed by HTML5 specification and in my
opinion it is the client which should ensure that the user really knows
what he’s doing. If the client feels scared by externally given URIs, it
may choose not to register itself as a protocol handler or, for example,
strip the “amount” part and require the user to enter currency symbol as
an additional confirmation.

Received on Tuesday, 10 March 2015 16:43:36 UTC