Re: Proposed XMPP Extension: Payment Required

On 13/6/26 10:52, JC Brand wrote:
>
>
> On 6/12/26 18:44, Stephen Paul Weber wrote:
>>> I've kept "display-amount" to avoid clients having to be able to
>>> parse payment URIs, but it's non-authoritative.
>>
>> I can see why you want this. But I'm also a bit concerned abmut the 
>> security implications of having a possible "$2" label on a $2000 
>> payment.
>
>
> Yes, that's the risk, which is why I mention it in the security 
> considerations.
>
> Perhaps we should just remove it, but then clients which don't know 
> the URI scheme won't be able to show the amount to the user, which sucks.
>
> Also, if we removed "display-amount", there's still a "label" field 
> which could lie about the actual payment amount.
It's non-authoritative, clients can slap a "cannot verify this value, 
check the price on the next step" sticker on it as necessary.
>
> _______________________________________________
> Standards mailing list -- [email protected]
> To unsubscribe send an email to [email protected]
_______________________________________________
Standards mailing list -- [email protected]
To unsubscribe send an email to [email protected]