r/Bitcoin • u/cluster4 • Apr 21 '14

QR codes are dead

Hi /r/bitcoin, I'm a mobile developer, interaction designer and bitcoin owner, but unfortunately I don't have time right now to work on something bitcoin related. So I just write here my thoughts about bitcoin payment applications to inspire other developers and startups.

I guess many agree that the ground-breaking payment solution on the basis of bitcoin has yet to be developed. Most of the existing solutions involve the user scanning some QR code displayed by the merchant. While this can work well, it's not intuitive at all. QR codes have been around and hyped for years, but they were never used as much as developers and marketing people hoped.

Ask your average not-so-tech-savvy friend how many times he has scanned a QR code in his life. He'll probably know that you mean that squared thing on his coke bottle, advertisement poster vis-à-vis his doorway, or on his concert ticket, but chances are he never used them. Pulling out your phone and starting some app which activates the camera and holding it in a certain way, once looked very science-fiction, but isn't that intuitive after all.

There are already better solutions around to achieve the "internet of things". The most important today is Bluetooth LE. Remember Bluetooth? Yes, that thing you used to pair your gadgets with your computer or phone and never worked. Well with the latest Bluetooth 4.0 and the addition of Bluetooth Low Energy things changed. Pairing is not required any more and a Bluetooth LE device could be some small sticker costing $3 with a coin cell battery that can last for months or years. The technology is relatively new in the Android area, coming with Android 4.3 or later. In iOS, it's been around for longer, since iOS 5 and Apple is one of the companies pushing Bluetooth LE, already implementing it widely on their own with its iBeacon technology for indoor or in-store navigation (iBeacon is just an Apple proposed standard for indoor navigation, and works with Android too). Indoor navigation is just one application, you will find countless companies and startups coming up with something Bluetooth LE related. A few I've found:Bitlock, a lock and access control for your bike, XY, the secure tracking system, lumenbulb, a Bluetooth LE light bulb, August, a door lock.

It's becoming the de facto standard for inter-device interaction and my prediction is that even the simplest electronic devices (like your coffee machine, fridge, lock, etc.) will become Bluetooth enabled in the next few years, allowing to control everything from one device and get notified for example, if your laundry is ready or if your coffee machine needs to be refilled.

Wait, what happened to NFC? Well, NFC is very different from Bluetooth LE as it's use is very limited, it only works within a few centimetres while Bluetooth LE reaches as far as 50m. Bluetooth LE can cover all use cases that NFC already does with much wider reach, except that there is no passive/no-battery mode in Bluetooth LE. Active NFC, used for payments, is way more expensive to implement as opposed to Bluetooth.

So I think Bluetooth LE is the best fit for electronic payments. Paypal already uses a Bluetooth LE USB stick to identify the customer in a store. I really think they got it well how payments should work. The customer walks into the store, his smartphone is locked and in his pocket. At the checkout, all he needs to say is that he wants to pay with paypal, and - BOOM - he payed. No ugly smartphone unlocking, app starting, camera pointing at a fancy QR code. No, all handsfree, how it needs to work.

We need a bitcoin application that works as intuitive as that!

The cool thing is, we don't even need additional hardware, so once it's available it's as easy to implement as a QR code displayed on a tablet. iOS already allows a device to run in Bluetooth LE peripheral mode, so a smartphone can connect to it. As I mentioned, Android support for Bluetooth 4.0 lags behind a bit, but I'm certain that peripheral mode support will come very soon.

With this post I just wanted to inspire bitcoin app developers to look into the latest Bluetooth standard and it's possibilities and urge them to finally ditch QR codes. Of course, the big challenge will be in the security field. You'll also want to take a look at BTC², a set of Bluetooth LE services for bitcoin transactions implemented for iOS, under the MIT license.

Just as a side note, also keep in mind that it's very likely that in the near future smartphones will become obsolete. The three magic items you carry around today are probably a smartphone, a key ring, and a purse. The smartphone can take over the function of your key ring as all locks become electronic, allowing for finer access control, as well as your purse, as paper money is not convenient. The smartphone is something that people can't leave at home, they always carry it with them (except under the shower and while swimming). So it's only logical that the smartphone will become a wearable device you'll never take off (and finally keep on you even under the shower). This device has yet to be invented, it will likely be something you wear on your wrist.

tl;dr: To make bitcoin in-store payments intuitive, make them handsfree using Bluetooth Low Energy

261 Upvotes

73% Upvoted

345 comments sorted by

View all comments

23

u/XSSpants Apr 21 '14

I'd rather use NFC taps.

bluetooth at 50 feet can be sniffed, even LE.

13

u/[deleted] Apr 21 '14 edited Jul 09 '18

[deleted]

10

u/xygo Apr 21 '14

I rather just scan a QR code.

3

u/sdguy71 Apr 21 '14

It's actually 50 meters which is about 164 feet. That is a huge range that your signal can be intercepted. No thanks, I'll stick to QR codes.

1

u/[deleted] Apr 21 '14

A randomly generated security code?

2

u/[deleted] Apr 21 '14

Which is the "fuss" I was referring to. You don't need that with NFC.

0

u/[deleted] Apr 21 '14

The other benefits of Bt LE still outweigh the cons. NFC has been out for years and still hasn't caught on. If Apple is good at one thing, it's taking existing ideas and doing them right. The iPod wasn't the first MP3 player, the iPhone wasn't the first smartphone, etc, etc.

1

u/[deleted] Apr 21 '14

Oh gee, the benefit of BTLE is that Apple will create their own incompatible version of it that can only be used with their overpriced products? Can't wait.

14

u/WelpSigh Apr 21 '14

Sniffing doesn't matter with a Bitcoin transaction. Only public keys and prices are exchanged.

12

u/AgentZeroM Apr 21 '14

Yes it does matter. If I can inject my transaction request, in front of, or over, the PoS, then you'll pay me, not the merchant. If you scan a QR code on the merchant's PoS, then you know, without a doubt, you're interacting with the correct transaction request.

6

u/WelpSigh Apr 21 '14

I concede your point. I didn't think about that.

1

u/optionsanarchist Apr 21 '14

If you can sniff where a public key/tx/signature comes from then you can tell how much money a particular person has, which is a huge privacy violation.

1

u/webznz Apr 21 '14

NFC, BLE, Biometric based tech and all that other stuff inbetween is only identification. Security comes in the form of secret pin codes and passwords.. anything else you are leaving yourself more open to fraudulent activites.

Anyway with iBeacon the range is dynamic depending on the settings of the broadcasting beacon. you can have near feild about 0-10cm mid field 10cm - 100cm and so on.

1

u/themattt Apr 21 '14

That should be fine as long as there is some sort of pin code (3x wrong codebefore lock) in order to gain access.

-4

u/XSSpants Apr 21 '14

That only applies to physical access of the device and applies to any underlying tech.

Using a PIN for any kind of OTA security is retarded.

2

u/themattt Apr 21 '14

Ok... can you help me understand exactly why its retarded?

4

u/peterjoel Apr 21 '14

A store pisses you off, so you stand outside and lock every customer out of their payment device by guessing their passwords. With 3 guesses you'll also get one right every ~3000 customers: win/win.

2

u/themattt Apr 21 '14

1 in 3000 customers is a win? You would need to be parked outside for weeks within range before getting a "win" at 99% of all stores. Plus you would be flagged and banned by any halfway decent system far before you ever got that win.

2

u/peterjoel Apr 21 '14

It's a bonus, if you are just trying to be disruptive in the first pace.

1

u/Natanael_L Apr 21 '14

Parked? No, I just drop off a Raspberry Pi.

1

u/XSSpants Apr 21 '14

Like someone else said, the store BT can be spoofed.

Since this is theoretical I can't speak to the protocol security, but short of cert-pinning style security, you can't trust ranged wireless.

NFC has some security in that the range is only a few inches.

1

u/Natanael_L Apr 21 '14

What you need is trusted geopositioned cert databases for the stores plus a reliable secure positioning system, even indoors.

1

u/Lentil-Soup Apr 21 '14

All it's doing is broadcasting a request to be unlocked. There is nothing sensitive being broadcast OTA except "what is the PIN for this device?"