handshake-org / handshake-org/HIPs

HIP-0002

Open
#42 9 comments 0 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
41
Forks
27
PR merge metrics
No merged PRs in 30d

Description

The known wallet file, `.wallet`, is not actually fully secured by the chain of trust in this proposal. The certificate itself is but not the contents of the web server which are served out of band.

There are better options:

## Coupling the name and the receive wallet
1. The name itself is associated with a UTXO, and therefore, a wallet already.

## Decoupling the name and the receive wallet
1. A receive address can be stored on chain as a TXT record.
2. A receive address can be served as TXT record by a DNSSEC secured authoritative zone.
3. Use suggested HTTPS method, but with a **signed** message containing the receive address.

There are likely other options. By including the language in Decoupling#3 or by using one of the other options, a sender can rest assured they are sending to an address verified by the chain of trust as opposed to a potentially hacked web server that continues to maintain the right cert.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reviewing HIP-0002 and the known `.wallet` trust concern described in the issue. Compare the listed coupling, on-chain TXT, DNSSEC TXT, and signed HTTPS options, then document a decided approach that ensures the receive address is verified by the chain of trust.

Written by the indexing model from the issue text.

Assessment

Tech stack
blockchain
Domain
blockchain, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.