Re: P2P Payments

On 12/05/2014 09:48 AM, Melvin Carvalho wrote:
> Are you saying that all key material is governed by same origin 
> policy?

Yes, but that's not as big of an issue as Anders' is making it out to be
(IMHO). In the current WebCrypto spec, the server controls your private
key. If you trust the server, this is perfectly fine. In fact, you don't
have a choice, you have to trust the server.

What Ander's is concerned about (I think) is that you can't then use
that same key to sign something on another site, which is not entirely
accurate.

The way the Web Payments CG specs handle this is via the use of a 3rd
party signing site.

1. Data is sent to the 3rd party to sign.
2. The 3rd party has access to some private key and signs the data.
3. The data is transmitted to where it needs to go.

This is perfectly in line w/ the current WebCrypto spec and the U2F
specs, and it works just fine.

Yes, there is no way to access a SE and ask it to sign something (yet),
but the crypto folks at W3C are on it. They're trying to build momentum
to make that happen and I think they will be successful at some point in
the next 3-5 years. Until then, we have a solution that'll work.

> So what's the difference between this and just using localStorage?

There is effectively no difference.

> Sounds like a bit of a train smash, if so, for web payments and the 
> decentralized social web in general.  Are there any ways round it?

Yep, there are several ways around it. It's not a show stopper.

-- manu

-- 
Manu Sporny (skype: msporny, twitter: manusporny, G+: +Manu Sporny)
Founder/CEO - Digital Bazaar, Inc.
blog: High-Stakes Credentials and Web Login
http://manu.sporny.org/2014/identity-credentials/

Received on Friday, 5 December 2014 16:07:35 UTC