Bitcoin NFC Ring Insecure payments proposal
Here we propose a method for doing "one touch" consumer payments using Bitcoin.
We do this by making a transfer("top up") from our bitcoin current account into a temporary "beer money" account. This temporary account can have funds transferred out simply by a merchants reader reading the correct NDEF record and GUID from the NFC Ring.
This method is cordially named the "Top up Beer Money".
This approach of customer to merchant transfer is insecure so the temporary account funds amount is limited by the customers secure mobile app. IE the user chooses what the maximum amount the ring can store is and can only transfer that much money to the ring. This amount should be an amount that the consumer can "afforded to lose".
No private keys are exchanged, the NDEF record contains a hash that transferred to a web service, this web service stores the private keys.
Potential security issues:
The merchant could increase the amount without the user knowing because the user can't see the screen
The merchant may be able to clone the GUID/NDEF record and take multiple payments (But limited to the amount in the bitcoin account)
A merchants device may get infected and route all bitcoin transfers through to another account.
The third party storage that stores the private bitcoin key may get exploited resulting in terror and explosions
Skimming, but not so much with the NFC Ring as it's designed with some Anti-Skimming technology.
MITM, a Man in the middle attack on the wifi of the merchant could potentially inject a fake SSL certificate for the web service and record all outbound transactions injecting their own public key in as the recipient for transactions.
Potential limitations:
The bitcoins would need to be transferred from one temporary account to another on each "top up"
Obvious questions:
Why use this technique and not my phone to do NFC transfer? This technique is meant for the following scenarios.
When you are too drunk to get your phone out of your pocket.
When your phone battery dies
When you trust the merchant
When you want to do a transient payment (IE no one can tell you just paid for something)
If you get mugged/attacked, most of the time they wont try to get a ring off your finger as they will go straight for your phone/keys/wallet. You can walk to a merchant you trust and to a transaction to get some funds to sort your shit out.
Github repo: https://github.com/JohnMcLear/bitcoin... -- build using phonegap build
Feel free to comment with more security issues I haven't thought of yet :)