Using HD Bitcoin wallets with Drupal Coin Tools

Submitted by jbrown on Wed, 01/07/2015 - 13:10

Each Coin Tools payment needs its own Bitcoin address. This is necessary so that it is clear whether or not the payment has been completed. It is also important for preserving anonymity.

In order to participate in the Bitcoin network, a Drupal website must talk to a Bitcoin node. Currently Coin Tools utilises the reference implementation, bitcoind.

bitcoind has wallet functionality built in. In fact, it was originally released as a desktop wallet for Microsoft Windows. By default, bitcoind will pre-generate a pool of 100 pairs of addresses and corresponding private keys. This pool will be increased as necessary.

This presents a number of problems. If data-loss were to occur on the server, the private keys could be unrecoverable and therefore the funds stored on the addresses would be unspendable. If a hacker gains access to the server they could copy the keys and steal the funds. The private keys can be encrypted, but the password is exposed on the server when generating new keys and spending funds.

Drupal / Bitcoin BIP 70 / PKI certificates

Submitted by jbrown on Mon, 11/03/2014 - 14:00

BIP 70 provides a mechanism so that a customer can be sure that they are sending a Bitcoin payment to the correct place. Before BIP 70, the customer would simply be presented with a Bitcoin address to send the amount to. This address could potentially be tampered with so the funds get sent to someone else. It is also not very user-friendly to be sending money to a random collection of letters and numbers.

Update on Drupal / Bitcoin Payment Protocol (BIP 70) integration

Submitted by jbrown on Thu, 10/30/2014 - 17:03

BIP 70 describes a high-level payment system for Bitcoin. It uses Protocol Buffers and X.509 certificates for the following major improvements:

  • Human-readable payment destinations instead of Bitcoin addresses
  • Resistance from man-in-the-middle attacks
  • Payment received messages sent back to the wallet
  • Refund addresses

Pages