Re: [Taler] denomination manipulation

[Christian Grothoff]

On 11/27/2015 05:06 PM, Jeff Burdges wrote:
> The frequency doesn't matter, the only question is if the mint knows
> who calls /keys. 

Sree and I have written now several times that /keys is supposed to be
fetched via Tor, by the wallet, in the background without some strange
cookies or god knows what self-identifying information you assume may be
provided. Please stop ignoring this.

> So the question is : Why does the wallet fetch /keys?  

Because it needs to know which denomination/signing keys the mint offers.

> It's always because the customer visits a mint's web page that
> identifies itself, yes?

No. Not always. More typically, because its old /keys state got stale /
expired.  Wallets will do this periodically in the background for all
mints they have discovered/located/found are active/etc.  Wallets may
need /keys also simply to refresh existing coins.  So there are many
reasons why a wallet may request /keys, and merchants do the same.

> That gives the mint control over when this
> happens.

No, it does not. It is 100% up to the wallet to decide if/when it needs
/keys.  Wallets can fetch /keys multiple times, over different exits and
compare if they feel like it. The mint has no control over this.

> In particular, if a mint asks that customers login before
> revealing itself to the wallet, then that's potentially problematic,
> depending upon the mint's userbase size. 

Mints do not have accounts or logins. Did you even read the spec? Please
refer to the spec, and don't spew this kind of total nonsense.

> We cannot necessarily control this outright, but we can influence it by
> making the Taler browser icon useful as soon as a customer visits a
> mint page.  If clicked, it could offer information like the wallet's
> balance,

I'm totally confused. The wallet knows its balance. It doesn't need a
mint for that. The balance is in the wallet, not at the mint. Also, we
don't have a Taler browser, but a Taler wallet extension, which is
always "useful" to get the balance. And really, after discovering the
mint the first time, you pretty much never need to navigate back to it.

> information about the mint, maybe an option to login to the
> mint, etc.  This would encourage mints to identify themselves to the
> wallet quickly.

I don't see this. Besides, mints want to be added to the wallet as
mints, so they will self-identify ASAP anyway, that's their most primal
business operation after all (customer acquisition).