16

Could a chrome extension be made that maintains a bitcoin wallet while also making it easy for web stores to integrate a one-click purchase experience.

Suppose a button on a webpage is clicked. Is it possible for that to trigger a function call to the chrome extension to send bitcoins?

Obviously letting webpages unlimited access to chrome extensions would never have been designed. But is there some way to make this work securely?

user782220
  • 10,677
  • 21
  • 72
  • 135
  • Bitcoin has evolved so that it is possible for merchants to offer a "Zero-Click" shopping experience through the use of extended public keys. It is still better from a security point of view to hand over to a dedicated protocol handler for Bitcoin. – Gary Mar 16 '14 at 14:49

4 Answers4

6

Chrome extensions can insert arbitrary code into web pages (content scripts).

Content scripts are JavaScript files that run in the context of web pages. By using the standard Document Object Model (DOM), they can read details of the web pages the browser visits, or make changes to them.

This code can communicate with the original web page via the DOM and with the rest of the extension via message passing.

In theory, this should suffice. But make it secure, please.

nisc
  • 4,222
  • 4
  • 29
  • 34
4

Multibit provides an external application solution

Clicking on a "bitcoin:" protocol URI in Chrome (or any other browser) will transfer the URI over to MultiBit (v0.3+), starting the application if necessary. This approach removes the need for private keys to be held (and potentially shared) within the browser.

Gary
  • 7,167
  • 3
  • 38
  • 57
3

This is very dangerous because a single security hole in Chrome could allow any website to empty your wallet.

First, any payment have to be confirmed with the wallet password. But, as that password is typed inside Chrome itself, it might be possible for an attacker to read that password.

In fact, there are so many security issues to solve that I think it's better to let the bitcoin client do that job.

What should be done is a way for any software to ask the bitcoin client for a transaction. The first idea that comes to mind is using DBus.

That way, the Chrome extension would only have to transform any bitcoin address by a button which calls a DBus method.

ploum
  • 242
  • 1
  • 8
0

The blockchain.info Bitcoin Wallet provides some support for this by using navigator.registerProtocolHandler and Bitcoin URI's. Unfortunately it only works in firefox at present.