handshake-org / handshake-org/HIPs
HIP-0002
- Dominant language
- No language data
- Stars
- 41
- Forks
- 27
- PR merge metrics
- No merged PRs in 30d
Description
The known wallet file, `.wallet`, is not actually fully secured by the chain of trust in this proposal. The certificate itself is but not the contents of the web server which are served out of band.
There are better options:
## Coupling the name and the receive wallet
1. The name itself is associated with a UTXO, and therefore, a wallet already.
## Decoupling the name and the receive wallet
1. A receive address can be stored on chain as a TXT record.
2. A receive address can be served as TXT record by a DNSSEC secured authoritative zone.
3. Use suggested HTTPS method, but with a **signed** message containing the receive address.
There are likely other options. By including the language in Decoupling#3 or by using one of the other options, a sender can rest assured they are sending to an address verified by the chain of trust as opposed to a potentially hacked web server that continues to maintain the right cert.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reviewing HIP-0002 and the known `.wallet` trust concern described in the issue. Compare the listed coupling, on-chain TXT, DNSSEC TXT, and signed HTTPS options, then document a decided approach that ensures the receive address is verified by the chain of trust.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- blockchain
- Domain
- blockchain, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100