[Tool] Cinexa Bitcointalk Tools - verify BTC/PGP and shared-address warnings

[Cinexa]

Hello!

I have been waiting for a couple of days to get my chrome extension approved on chrome web store.
The very first version of Cinexa Bitcointalk tools is now released there - https://chromewebstore.google.com/detail/cinexa-bitcointalk-tools/ilomdnceaahbknlpdkkipcfhhcfbfbnp

However, I still kept the userscript that I created.

So, there is two ways to install. You can pick one.

1. Chrome extension (Chrome, Edge, Brave)
https://chromewebstore.google.com/detail/cinexa-bitcointalk-tools/ilomdnceaahbknlpdkkipcfhhcfbfbnp

Name on the store: Cinexa Bitcointalk Tools
It only runs on bitcointalk.org. Updates come through the Chrome Web Store.

2. Userscript (Tampermonkey / Violentmonkey, any browser)
https://cinexacode.fun/cinexa-bitcointalk.user.js

Current version: 1.9.10
Update URL is set, so the script can update itself from that link.

What you get on a topic page

• Verify BTC on posts that contain an Address / Message / Signature block
  
• Verify PGP on posts that contain a clearsigned message and a public key
  
• A shared-address warning when that user’s BTC address was also posted by someone else in Staked addresses, Services, or Games and rounds.
• A link into the Cinexa Forum Dossier for a closer look at that username

Screenshot of Bitcoin signed message verifier.


Screenshot of PGP signed message verifier.


Screenshot of shared address warning result.

The same checks exist on the website if you do not want an extension or a script:

• https://cinexacode.fun/bitcoin-verifier
• https://cinexacode.fun/pgp-verifier
• https://cinexacode.fun/forum-dossier

How it works

The button sends the signed message (or the username, for the shared-address check) to https://cinexacode.fun over HTTPS. The forum page does not verify the signature by itself. Address and merit context comes from the public BitList archive (api.ninjastic.space).

Privacy: https://cinexacode.fun/privacy

Feedback and broken posts are welcome in this thread.

[Lillominato89]

Great work, cinexa.
The feature on Bitcoin addresses used by multiple users, in particular, could be useful when tracking down farm accounts. So scammers now have to be more careful about what they do.
This is really very useful.
Well done.
I can also see an emoji next to the username ⚠️ – what does that mean?

[Mia Chloe]

~snip

Well thumbs up for the effort you put in. So far I haven't tried the extension yet although I've visited the site and I guess I'll try it out later on so I could see if there are any important suggestions I could make based on my experience. Anyways just to be clear does this information automatically pop up?

It might be buggy to use if it automatically pops up and even if it does there should be something like a minimise button to hide them. Or better still a toggle menu to choose if it auto pops or not.

[AakZaki]

Anyways just to be clear does this information automatically pop up?

It might be buggy to use if it automatically pops up and even if it does there should be something like a minimise button to hide them. Or better still a toggle menu to choose if it auto pops or not.

I have installed the extension yesterday. I want to share a little experience, the information in the bottom corner does not appear automatically, but you have to click the sign "!" next to the username and the information will appear and then after a few seconds it will disappear again. As below

[Cinexa]

Great work, cinexa.
The feature on Bitcoin addresses used by multiple users, in particular, could be useful when tracking down farm accounts. So scammers now have to be more careful about what they do.
This is really very useful.
Well done.
I can also see an emoji next to the username ⚠️ – what does that mean?

Thank you.
I appreciate your feedback. The Emoji works as a sign that this user posted an address which was posted by another forum user. However, always make sure to verify using the forum Dossier page. Clicking on it will show the result.

Thank you Mia Chloe and specially AakZaki for trying out the extension.
I would appreciate if you share your experience.

[Upgrade00]

This is an actual useful community tool and looks well designed to not interfere with the page too much.

I will like more people who do not know how to verify signatures and PGP to test it out and get comfortable doing it themselves rather than relying on a tool to do that. For someone who already knows how to, a quick workaround is useful.

[dkbit98]

Cinexa can you tell us what type of Bitcoin addresses are supporting with this tool, and are you using any third party tools for doing this?

Userscript version should be better option, especially for people who already use other userscripts, and I like to keep number of installed extensions in my browser on minimum.

[Cinexa]

This is an actual useful community tool and looks well designed to not interfere with the page too much.

I will like more people who do not know how to verify signatures and PGP to test it out and get comfortable doing it themselves rather than relying on a tool to do that. For someone who already knows how to, a quick workaround is useful.

Thank you.
I appreciate your feedback. However, there is a manual way to verify the signed messages. You can click on the extension icon, and it will open the tool for manual verification.
Also, you can find the same tools here

https://cinexacode.fun/bitcoin-verifier
https://cinexacode.fun/pgp-verifier

Cinexa can you tell us what type of Bitcoin addresses are supporting with this tool, and are you using any third party tools for doing this?

Userscript version should be better option, especially for people who already use other userscripts, and I like to keep number of installed extensions in my browser on minimum.

Hi, it supports legacy, nested SegWit, and native SegWit. Verification is done locally on Cinexa server with open-source crypto libraries like BitWasp Bitcoin / secp256k1-style EC recovery. We do not call 3rd party API's or use other services for that. As for the userscripts, it stays there. If I update the extension, I will update the userscript as well. So, two choices. You can pick any of them.

[Lillominato89]

Great work, cinexa.
The feature on Bitcoin addresses used by multiple users, in particular, could be useful when tracking down farm accounts. So scammers now have to be more careful about what they do.
This is really very useful.
Well done.
I can also see an emoji next to the username ⚠️ – what does that mean?

Thank you.
I appreciate your feedback. The Emoji works as a sign that this user posted an address which was posted by another forum user. However, always make sure to verify using the forum Dossier page. Clicking on it will show the result.

Thank you Mia Chloe and specially AakZaki for trying out the extension.
I would appreciate if you share your experience.

I’ve already installed the user script on my tablet – I mainly browse the forum from there when I’ve got time – and I have to say it works well, but to be honest, I haven’t looked for any issues with your tool.
But your reply has made me wonder about something.

Where do you get the BTC addresses from?
From Bitlist? Or do you fetch them from the forum yourself?
Because you could potentially create false positives.
For example, if I quote a post by a user where the BTC address was originally written, could that post be unintentionally linked to my profile?

[Cinexa]

I’ve already installed the user script on my tablet – I mainly browse the forum from there when I’ve got time – and I have to say it works well, but to be honest, I haven’t looked for any issues with your tool.
But your reply has made me wonder about something.

Where do you get the BTC addresses from?
From Bitlist? Or do you fetch them from the forum yourself?
Because you could potentially create false positives.
For example, if I quote a post by a user where the BTC address was originally written, could that post be unintentionally linked to my profile?

Thank you for giving it a try.
Yes, we collect the data from Bitlist.
I have no data on my server at all. The data come from Bitlist.co, bpip.org, and loyce.club.

Absolutely false positive is very much possible. That's why there I recommend to check the detailed forum dossier page. You can check if it is really posted by that user, or maybe quoted or something else.

BTW, we just launched signet Bitcoin faucet for the developers, testers, and anyone who wants to play with testnet coins.
Currently each claims sent 10K sat. But if anyone wants large amount for testing purposes and promise to return later, they should contact us.
Link - https://cinexacode.fun/signet-faucet

[dkbit98]

Hi, it supports legacy, nested SegWit, and native SegWit. Verification is done locally on Cinexa server with open-source crypto libraries like BitWasp Bitcoin / secp256k1-style EC recovery. We do not call 3rd party API's or use other services for that. As for the userscripts, it stays there. If I update the extension, I will update the userscript as well. So, two choices. You can pick any of them.

OK, sounds good.
So let me just confirm that if I sign message with Electrum wallet or with Trezor Suite, your Cinexa tool will be able to verify them both, and it's compatible with them?

[Cinexa]

OK, sounds good.
So let me just confirm that if I sign message with Electrum wallet or with Trezor Suite, your Cinexa tool will be able to verify them both, and it's compatible with them?

Yes. A valid Sign message from Electrum or Trezor Suite are accepted here, and those two wallets already used the same format, so a signature from one verifies the same way as the other.

Cinexa supports BIP-137 signed messages for legacy, nested SegWit and native SegWit (bc1q...). You can input address, message and signature separately, or paste the entire signed-message block.

Taproot (bc1p...) encodes BIP-322 this tool is not verifying. The message text must match exactly, including spacing and new lines.

However, I am working on it already. I will post a new update soon. But updating the extension will take time since google review the code for each update.

Edited Update:

Electrum and Trezor Suite Sign a Taproot Address (bc1p…) as a BIP-322 simple signature Cinexa accept to that signature, whether the plain base64 format those wallets export, or the smp prefix from the final BIP-322 specification. Native SegWit (bc1q…) BIP-322 signatures verify just the same. Note it works on web version only at this moment.

[Lillominato89]

BTW, we just launched signet Bitcoin faucet for the developers, testers, and anyone who wants to play with testnet coins.
Currently each claims sent 10K sat. But if anyone wants large amount for testing purposes and promise to return later, they should contact us.
Link - https://cinexacode.fun/signet-faucet

That’s a brilliant idea, Cinexa.
Personally, I don’t need it – I’m not a very good programmer, so I’ll leave that task to you lot, who are ten steps ahead of me.

Getting back to the issue of false positives, perhaps it would be better to check where the BTC address was posted before flagging a user? Might that be useful for your tool?