Talk about rep. @anon47418038, lots of people are trusting you as a community developer for wallet binaries. (Also your involvement in other projects.) Big amount of ZEC is riding on your bits being clean. If you wind up having coin to sell, I think I can trust you for a much bigger transaction than I can afford!
Multisig UI, interesting topic. The UI on my end will be whatever I can do in my terminal. I’m adventurous. But I have some idea for your Windows/Mac users. See below.
First: I realized, people with stolen Paypal accounts, etc. are always in a hurry. I wish I had realized this a few weeks ago, and made then the following cryptographic commitment of my identity (legal name + Paypal account mail) to prove it’s the same account all along. Anyway, as you can see, I am not in a hurry. I may close this offer if the market swings (expected soon), or if I find another convenient way to get my coins. But, I’m not in a hurry. You probably noticed also, I didn’t move the coin I’m willing to risk; I don’t need to, as long as I might buy another.
Now please, people, for your safety, listen up here. I realize many of the regulars here will know this, but I am sick of seeing people publicly commit identity-linking info using simple hashes. (See Wikipedia.) The right way is with a keyed hash, and a random key:
$ EMAIL="[my paypal account mail]"
$ NAME="[my legal name]"
$ dd if=/dev/urandom bs=32 count=1 status=none | xxd -c64 -p > emailkey
$ dd if=/dev/urandom bs=32 count=1 status=none | xxd -c64 -p > namekey
$ echo -n "$EMAIL" | \
openssl dgst -sha256 -hex -mac hmac -macopt hexkey:`cat emailkey` | \
egrep -o '[0-9a-f]{64}$'
21546500a0bd3197c7deab563f672410ad29340b7d3ec4804e9b80734759b0bf
$ echo -n "$NAME" | \
openssl dgst -sha256 -hex -mac hmac -macopt hexkey:`cat namekey` | \
egrep -o '[0-9a-f]{64}$'
2c8d5241d352c171b5c05771d41fea4a707e262e00d8683b48b37c663d624d6c
This way, unless my random device is hardcoded with a fair die roll or something, my identity cannot be linked to this post even by somebody with full access to Paypal account database (such as Paypal). But if I fulfill this offer with anybody, I will be able to privately prove to that person that I am paying with the committed Paypal address. And I did it so I can prove name and email separately.
Re: multisig, UI and otherwise (and not presuming to tell you anything you don’t know, @anon47418038, maybe you solved all this already):
First there is the problem of the serialization format for unsigned and partly signed transactions. Bitcoin in the wild, there are a bunch of different incompatible formats. Core has one, Electrum has another, I have seen at least 3 or 4 others, and there are probably a dozen more. AFAIK, there is no standard (not even a pretend “standard” nobody uses).
I think most existing multisig use is vertically integrated into a bigger protocol. Totally opaque to user, “just works”. Per below, users should never be copypasting and passing around fragile big blobby things anyway. And if they do? In addition to UI problems below, you need a bunch of features which make “use what zcashd spits out” a bad choice for serialization. At least by itself.
You will need a checksum of some kind. (Please no truncated SHA256; with all due respect to Satoshi, that’s the wrong tool for the job.) Also defense against email truncated/wrapped lines. Maybe serialize the raw (binary) bytes with a checksum, base64 (url?) it, wrap at 72 chars (but then what if user needs it all on same line?). Note, I don’t think any of the major Bitcoin formats go this far; their incompatibility is for simpler reasons. But AFAIK, none of them intend for nontechnical users to do their own multisig for custom purposes.
Then another thing: Correct me if I’m wrong, but don’t you need to be running (your port of) zcashd with -txindex? I do that anyway. I’m not sure about the multisig case, gotta look at the code. (Shouldn’t all necessary data be in UTXO set? But this is with raw transactions, right? Help me, I’m ignorant here.) If so, good luck having your average user reindex at 210k+ blocks. I reindexed at about 100k, and that was right before hitting that first serious spot of quadratic sighash pain. It took about 15 hours on an old laptop, slow CPU but with SSD (and it can do joinsplits!). Then going forward, txindex requires nontrivial higher resources.
Solve that, then I think for 99% of your Windows/Mac users (plus another 98% those on Ubuntu), the biggest problems are:
-
Explain what multisig means. As said above, I think most userfriendly Bitcoin multisig stuff is a prepackaged app with its own ecosystem. They don’t need to explain what, but why. I mean, use cases: “It does escrow” (many applications) or “it protects your funds from being stolen” (wallets where neither the wallet provider nor malware on your machine can steal funds). How? Then a high-level explanation of multisig, but not necessary for user to understand. It’s just magic. “Click here to do escrow.”
-
Users need big blobby strings well hidden. If it can’t be stuffed into a QR code, if it needs random looking stuff copypasted, this a problem.
-
For parties signing a partly signed transaction, how to verify user expectation? Mallory can give Alice a bunch of gibberish and say, “Here, sign this like we agreed.” In addition to serialization problems discussed above, when it’s deserialized, of course you need to verify everything with extra care including wetware confirmation that the transaction outputs are really precisely exactly what the user expects. Oh, then you need to tie payee identity to a zcash address; and it’s even harder than usual, because the multisig is a kind of action at a distance. Hello, Zooko’s Triangle.
At the bottom line: I think unless you can get rock solid standards for serialization etc. (I mean: not one of 15 competing standards, not a BIP39-style incompatible implementation meltdown), and some real use cases, it’s just not worth it. How many users will know what it’s for? (Not counting those who can do it from zcash-cli.) Chicken and egg problem though. Maybe users just need a good UI! Maybe you are better at UI and navigating these issues than I am. High probability.
My idea of good UI is a pipeline typed in at the terminal, it’s the UNIX way, maybe you should not listen to me about UI. zcash-cli, JSON-RPC, or hex dump is good enough UI, hahah. Maybe if all the existing UI are “suck”, it means they were written by somebody with that habit of thinking. Either that or the polar opposite, Web 2.0 brain damage. No, not “maybe”.
