Topic: [SUGGESTION] To The Signature Campaign Managers - Payout Address Changes (Read 443 times)
April 07, 2015, 02:07:35 PM
Some campaigns ask you to put your address in your profile page and don't pay if you change or remove it. A hacker controlling someone's account could not divert those funds to himself.
April 07, 2015, 08:40:38 AM
If a user wants to change payout address on a campaign you should ask for a signed message with old address.
That prevents users funds from hacking. Let's say X hacked some hero member's account on a signature campaing who earned 0.15 BTC in a week, and X comes to thread and says "hey please change my address to that one". If the campaign manager don't ask for signed message that Hero member will loose that money.
I'm asking to the campaing managers to consider that condition.
Ps: I've posted this suggestion on the Dadice campaign, posting here for more publicity.
That prevents users funds from hacking. Let's say X hacked some hero member's account on a signature campaing who earned 0.15 BTC in a week, and X comes to thread and says "hey please change my address to that one". If the campaign manager don't ask for signed message that Hero member will loose that money.
I'm asking to the campaing managers to consider that condition.
Ps: I've posted this suggestion on the Dadice campaign, posting here for more publicity.
If I can say my opinion: I support your idea and this is a normal use of bitcoin (signed message) so why shouldn't we use it? However to control if someone has change password (through email or directly) check here https://bitcointalk.org/seclog.php and it will be more souspicious if he change the payout address after that the password was changed.
April 07, 2015, 08:36:53 AM
I guess you can't really force people to do this but it's definitely a good idea. I've seen several campaigns require some proof from an old address but also a few that don't care but I guess it's just up to each campaign manager individually whether they do or not.
April 07, 2015, 06:10:07 AM
If a user wants to change payout address on a campaign you should ask for a signed message with old address.
That prevents users funds from hacking. Let's say X hacked some hero member's account on a signature campaing who earned 0.15 BTC in a week, and X comes to thread and says "hey please change my address to that one". If the campaign manager don't ask for signed message that Hero member will loose that money.
I'm asking to the campaing managers to consider that condition.
Ps: I've posted this suggestion on the Dadice campaign, posting here for more publicity.
That prevents users funds from hacking. Let's say X hacked some hero member's account on a signature campaing who earned 0.15 BTC in a week, and X comes to thread and says "hey please change my address to that one". If the campaign manager don't ask for signed message that Hero member will loose that money.
I'm asking to the campaing managers to consider that condition.
Ps: I've posted this suggestion on the Dadice campaign, posting here for more publicity.
I think this is already in cycle and most of the campaigns doesnt accept changes of payment address until the payment is made for the current week or month
April 06, 2015, 09:50:13 PM
This is how evil panda handled address changes. It also keeps the campaign manager accountable as they have documentation as to why they sent payment to specific addresses. People should be able to freely change their payment addresses at the start of a payment period though
April 06, 2015, 07:13:44 PM
If a user wants to change payout address on a campaign you should ask for a signed message with old address.
That prevents users funds from hacking. Let's say X hacked some hero member's account on a signature campaing who earned 0.15 BTC in a week, and X comes to thread and says "hey please change my address to that one". If the campaign manager don't ask for signed message that Hero member will loose that money.
I'm asking to the campaing managers to consider that condition.
Ps: I've posted this suggestion on the Dadice campaign, posting here for more publicity.
That prevents users funds from hacking. Let's say X hacked some hero member's account on a signature campaing who earned 0.15 BTC in a week, and X comes to thread and says "hey please change my address to that one". If the campaign manager don't ask for signed message that Hero member will loose that money.
I'm asking to the campaing managers to consider that condition.
Ps: I've posted this suggestion on the Dadice campaign, posting here for more publicity.
Jump to: