Date: Fri, 01 Jul 2022 12:41:45 +0000
To: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
From: Alfred Hodler <alfred_hodler@protonmail.com>
Reply-To: Alfred Hodler <alfred_hodler@protonmail.com>
Message-ID: <ssSz15zsnav_kwhbS29ErU1VEi1DleCTSVuahEbHvAsA7sGWIAJswrai3f51PrO7JH6w8qmN1BdFd5cuNrFt-6NmC-13TI6Q4aayS-DACfs=@protonmail.com>
In-Reply-To: <CAHGSxGvfe_quLxrFTPtsHsrtw25h6LiT4m_xrT8aiG-pUf=AYg@mail.gmail.com>
References: <rH1Js_T_UWcAg9lS9NDw_Qb6Js5bgs8rPILej69BjqsEZcJZwsvHhZRilkkOQZRGXabai63hrGgbTP2Yk99ojKEN6fU6HT4TmukiafqiKjo=@protonmail.com>
 <CAHGSxGvfe_quLxrFTPtsHsrtw25h6LiT4m_xrT8aiG-pUf=AYg@mail.gmail.com>
Feedback-ID: 44065311:user:proton
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [bitcoin-dev] [BIP proposal] Private Payments
Precedence: list

Hi Clark,

Thanks for your input.

I agree with your proposal to use bech32 instead of base58. It looks sound =
to me and as you said, the standard would benefit from more compact QR code=
s. The `pay1` prefix is fairly recognizable.

> I don't see how this would work, and others have pointed out that the
> cost of block space is itself an anti-spam measure.

I agree.

> A third-party service could offer to publish OP_RETURN notification
> payloads in the blockchain for a fee, paid over Lightning Network.
> This completely de-links Alice's notification from her wallet, while
> accepting the less-known privacy implications of a Lightning payment.
> The service would remain ignorant of Bob's identity in any event. Such
> a service would also be incentivized to charge market rates for the
> potential privacy boost and for block space.

The manner of publishing or outsourcing notifications cannot be enforced by=
 the standard but we can add this as a recommendation. We can also release =
such a service in tandem with the BIP in order to encourage its use. The fa=
ct that the service would use its own coins would be beneficial to notifier=
s since they wouldn't have to engage in coin control on their end.

I'm not too familiar with the innerworkings of Lightning, but it is my unde=
rstanding that a message can be embedded in each payment. The message in th=
is case can be the OP_RETURN payload. That way both the payment and the not=
ification payload are sent out in one go. Please correct me if I'm wrong.

The downside is that this isn't as censorship resistant as direct notificat=
ions but that's probably not going to be a big problem in reality. If these=
 services ever go down, users should still be able to notify from their own=
 wallets.

> Alternatively, the service publishes the block height along with the
> notification data contained within that block. Light clients could
> download relevant blocks over the p2p network and perform full
> validation.

This sounds better than requesting transaction data, both from the standpoi=
nt of simplicity and privacy. The danger is that the service drops notifica=
tions, either on purpose or by accident, eventually causing clients to miss=
 notifications. Two possible solutions: a) the service publishes Merkle Tre=
es b) each client subscribes to more than one service.

Alfred