User: liviu

Update - v0.9

Changelog:

v0.9 - 1.04.2012

* Update Electum to version 0.43a: https://gitorious.org/electrum/electrum/commit/9d6a386f97af0037e398b9795859aa1fa3436e59

Download:

http://blog.mybox.ro/wp-content/files/BitSafe-Electrum/BitSafe-Electrum-0.9.img (MD5 hash: 09b501770fa1379039ef4da4bc0d41b2)

I just released BitSafe-Electrum with 0.43, so you can always have with you the Bitcoin client you love and use

https://bitcointalk.org/index.php?topic=54376.0

Edit: and a small update to 0.43a. Please use this version.

Update - v0.8

Changelog:

v0.8 - 31.03.2012

* Update Electrum to version 0.43: https://gitorious.org/electrum/electrum/commit/3ee5561488f923a52d91b0989e24a985863d7836

Download:

http://blog.mybox.ro/wp-content/files/BitSafe-Electrum/BitSafe-Electrum-0.8.img (MD5 hash: b46a90d275be0edf0e3c9bfc517cf343)

Update - v0.7

Changelog:

v0.7 - 19.02.2012

* Update Electrum to version 0.40a: https://gitorious.org/electrum/electrum/commit/ec9118da42250945cef759767a557a3a1ddaaa57
* Build image with GTK gui for Electrum, if you want the QT version you need to build the image yourself from this branch: https://github.com/ovidiusoft/BitSafe/tree/electrum-qt

Download:

http://blog.mybox.ro/wp-content/files/BitSafe-Electrum/BitSafe-Electrum-0.7.img (MD5 sum: 0a61b84447cdb67d8c47a2ebb4977747)

You should display prices (also) in BTC, possibly via a currency drop-down.

It's better (and cool) but I think it's a little too complicated to use (for both the buyer and the seller). A different paper layout that hides the QR code is much easier to do and offers the same security.

Update - v0.6

Changelog:

* Update Electrum to version 0.39b: https://gitorious.org/electrum/electrum/commit/96e2a3d7e1ee7cada1da0d03bf1c089e4abba307

Download:

http://blog.mybox.ro/wp-content/files/BitSafe-Electrum/BitSafe-Electrum-0.6.img (MD5 sum: fefb1cebfbdc09162ace821c8cf8f41c)

If you get a nice design, please post it. In the mean time, I got my hands on a business card holder that opens on a side, so I can put the bills with the qr code first. When I need one, I only extract haft the bills, enough to see the numbers on them, but not also the QR code. If someone can manage to steal the key in this way, they deserve the coins

Also comitted a proposal for the QR code format: https://github.com/ovidiusoft/bitcoin-scripts/blob/master/PaperCoins/QR-code-format.txt

If includes the URL field proposed by casascius, and a few others. Don't take it as a full proposal, it's basically just a bunch of random ideas, with the only intention of starting a discussion. I'll post some scripts that produce the new QR codes soon.

So, waiting for your comments. As I said, I would love to get the attention of POS/client developers.

I comitted a new script for Electrum users at https://github.com/ovidiusoft/bitcoin-scripts/tree/master/PaperCoins . It's called papercoins-electrum.sh and can use your existing Electrum wallet to create, fund and make a PDF of your PaperCoins. It can either only generate the tx or also commit it to the network. Creates 2 files: the wallet (you can use it later to get back funds if you didn't use the PaperCoins) and the PDF to print. It can take a random number of arguments (the amounts). Here's a sample run for only 1 PaperCoin:


At the moment, it requires a patched electrum client (it's in the same dir). Read the README file for more information.

I hope this POC will attract some developers who will want to integrate a PaperCoins feature in their clients

I started with the assumption (I might be wrong...) that a store will run a custom POS. I checked out a few projects and services and this seems to be the trend. The problem I was trying to solve was "how to emulate cash transaction using BTC in such a way that it's as fast or even faster".

You're imagining a scenario where a seller is using a dumb QR code reader on a mobile phone by the rotten fruits company . I am not sure that your scenario can happen in a real store, at least not until Bitcoin will become so popular that everyone, irregardless of their knowledge, will want to accept BTC payments *NOW!*.


The user will be using the service long enough to be scammed by the website and/or the buyer. Imagine this scenario:

I am the evil attacker and I know that you don't run a custom POS, you're using online services from the QR codes. I quickly go home, create a custom QR code which points to my server. It looks just like you would expect, just that instead of sweeping the funds to your address, it displays a ok message. I walk out of the store with merchendise, you find out hours later that you don't have the money.

For even extra evilness, my server could actually commit the sweep, just use a different destination address (also mine). Even if you do get your hands on me, I will show you the tx and blame it on you for not pasting the correct address (I also had plenty of time to change my server so that now it's running as expected - I will even invite you to audit it ). I'm innocent until proven guilty, which you can't do. You'll take the loss and (probably) give up Bitcoin forever. Only such a successful attack is needed to have a lot of people lose trust in the system.

So no, the seller should not trust any service pushed by the user, only data that he can verify on the spot. If this means running a Bitcoin POS app on a real computer instead of using the phone, I think he should (well, if he cares about the money, of course...).

On the other hand, I did some tests with the Goggles app on my Android phone. It's capable of correctly detecting a URL even if the QR code is actually:


So I think we can support your scenario without too much trouble, if the QR scanner runs a decent app. Alternatively, it's copy-paste time for the seller . I'll post later some ideas about QR code formats and I'll also include your URL idea. But I do hope you'll change your mind

I don't think the payer should try to force a service onto the seller. Just providing the private key should be enough. The seller's POS can then do whatever he wants with that private key: sweep it directly, send it to a online service like you described, etc... My opinion is that we should not use a URL on the QR code.

Indeed. It should be fairly easy to change my design so that you fold the QR code, leaving only the amount visible.

Sweeping is importing a private key and immediately transfering all funds to another address. It's good practice when someone else knows that private key.

My initial thought was that the remainder will be sent by the seller to another address you provide (I even thought we might include it in the QR code), basically emulating how you pay with cash right now. I also assumed the buyer trusts the seller.

But your idea of expiration is much better, if it's doable. At a minimum, one could run another sweep after returning from the store ("gather all remainders from my used PaperCoins"), but doing it automatically would be cool.

Indeed . So my script duplicates that functionality - but it allow some customization (I hope someone with more talent than me can contribut a getter design). The next script I'll release will make it easier for Electrum users to generate PaperCoins. You will run it like this: "script <amount> <amount> <amount> ...." and it will create a new wallet (so you'll have it later if you want to, but separate from your main one), transfer funds, generate PDF, all automagically. Later, I want to integrate it into the Electrum client GUI and I'm hoping this topic will attract other client developers who will want to add the same functionality to their software. Then, we can work with POS software developers to add the sweep (+send remainder) functionality. That's my secret plan! Oh wait...

Yep, I know about them. I ignored online services on purpose (trust issues).

Warning, long post. Skip to last like for LT;DR version.

I though a little about in-store usage of bitcoins and physical bitcoins over the last few days. I actually convinced myself that using physical bitcoins in stores is better than using a smartphone

* it's definitely faster to take a piece of paper out of your pocket, just like you would a bill, than to take out the phone, unlock it, start the Bitcoin app, enter password, scan a QR code, enter amount, press Send, wait, then wait for the tx confirmation from the store "register". Using physical bitcoins means give a paper to the clerk, who will scan the QR code and sweep the funds and (optionally) send you the remainder (change). 15 seconds versus 2 minutes (2 minutes if the store is kind enough to accept 0-confirmation transactions).

* it's safer for you (the buyer). You only carry with you some bills, no need to store a wallet on your phone. So you can now "safely" install that naked pics app you wanted, without fear of losing your coins.

* it's safer for the seller, too. They don't need to wait for confirmation and a double spend is a lot more difficult to time right. This will allow buying valuable stuff without waiting 1 hour for 6 confirmations.

Having said that, I looked at the physical coins that exist now. They are all very nice (I want to get my hands on a Casascius coin, nao!), but I don't think they will work in real life, because I believe they were created with a few wrong ideas in mind:

* it's assumed they will be passed along untouched. For that reason, the private key is protected with a hologram, so the person receiving can check if it's still untouched. This means the person receiving them knows how to detect a forged/openend hologram.

* as I believe that's not the case (clerk in store, remember? not security/hologram/forgery specialist), then the receiver must check the balance by scanning the QR code. So then, all those holograms are useless...

* they are mighty expensive. One of the reasons stores might accept BTC is because they can dodge card/bank fees - so they can lower their prices. Then why would the buyer pay even more for using a physical Bitcoin? He will probably prefer to pay cash...

* you need to trust the issuer. That's simply too unbitcoiny. Sorry guys, I do believe you're trustworthy, but this is a bad idea.

So here's another idea (it's not new, I'm sure you already know about "cold storage" and I know 1-2 products who have related - paper backup - functions).

Let's use a very simple bill that basically just has on it a QR code of the private key, plus the amount on it (5 BTC, for example). No protection, no fancy logos and colors. Something that you can print on your own cheap inkjet, cut and use in store. Remember they will be used only once, after sweeping the funds, the clerk will throw them away (recycle). Something like this:

http://blog.mybox.ro/wp-content/files/PaperCoins-1327877209.pdf

I'm sure the design can be improved a lot. I created some glabels templates and a bash script to generate PDF files of PaperCoins from a simple CSV file. You can find them here:

https://github.com/ovidiusoft/bitcoin-scripts/tree/master/PaperCoins

I would love to hear you oppinions on this (and maybe get a better design? is 10x5 cm too small?), and also I would like to ask developers what they think about adding such a feature to their clients:

* Option "Create PaperCoins", where the user selects the number of bills to create and amounts on each. The software creates N new addresses, sends the amounts and produces a PDF or prints the bills. Also, mark those addresses as "don't use" except sweep the funds back (if you didn't use the bills for some reason).

I will write another bash script that does exactly this for Electrum. I also have some other random ideas, like:

* encode the "remainder" (change) address into the QR code. For example, the QR code might be a string "FUNDSKEY=<private-key>,VALIDAMOUNT=<expected-amount>,REMAINDERADDRESS=<address>". This needs discussion, as the software used in stores needs to know about it.

* it would be nice if developers will consider using some design standards, like: bill should be rectangle, amount is in the left/center of the bill, QR code on the right, (if printed) remainder address on the back of the bill. I am thinking it would be easier for the sellers - they will easily recognize a bitcoin bill, no matter who/what printed it.

That's all. What do you think?

Update: See this post https://bitcointalk.org/index.php?topic=61818.msg723880#msg723880 for a script for Electrum users, that automatically creates new PaperCoins addresses and funds them. Also see README file at the URL above.

Update 2: Some ideas about the QR code format: https://github.com/ovidiusoft/bitcoin-scripts/blob/master/PaperCoins/QR-code-format.txt

TL;DR ? Download PDF in 1st link, print, cut. PaperCoins!

A faster way would be to use VirtualBox. Change the image extension to .hdd and you can boot BAMT as a harddisk. Apply any changes you need, then write it to a USB stick. It's also useful so you have an up-to-date backup in case your USB stick decides to commit suicide.