{"action":"opened","issue":{"url":"https://api.github.com/repos/bitcoin-solutions/multibit-hd/issues/371","labels_url":"https://api.github.com/repos/bitcoin-solutions/multibit-hd/issues/371/labels{/name}","comments_url":"https://api.github.com/repos/bitcoin-solutions/multibit-hd/issues/371/comments","events_url":"https://api.github.com/repos/bitcoin-solutions/multibit-hd/issues/371/events","html_url":"https://github.com/bitcoin-solutions/multibit-hd/issues/371","id":55415285,"number":371,"title":"Verify signed transaction from Trezor is the same as original","user":{"login":"gary-rowe","id":342133,"avatar_url":"https://avatars.githubusercontent.com/u/342133?v=3","gravatar_id":"","url":"https://api.github.com/users/gary-rowe","html_url":"https://github.com/gary-rowe","followers_url":"https://api.github.com/users/gary-rowe/followers","following_url":"https://api.github.com/users/gary-rowe/following{/other_user}","gists_url":"https://api.github.com/users/gary-rowe/gists{/gist_id}","starred_url":"https://api.github.com/users/gary-rowe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gary-rowe/subscriptions","organizations_url":"https://api.github.com/users/gary-rowe/orgs","repos_url":"https://api.github.com/users/gary-rowe/repos","events_url":"https://api.github.com/users/gary-rowe/events{/privacy}","received_events_url":"https://api.github.com/users/gary-rowe/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/bitcoin-solutions/multibit-hd/milestones/2","labels_url":"https://api.github.com/repos/bitcoin-solutions/multibit-hd/milestones/2/labels","id":658391,"number":2,"title":"Release 0.1 Payment Protocol","description":"Entry conditions:\r\nBeta 5 is available on the beta web site\r\n\r\nExit conditions:\r\nPayment protocol support is reliable across a range of merchant providers (BitPay etc). \r\nAround 2000 people have successfully used the app under a variety of operating systems\r\nHave seen some BRIT income to Redeemer addresses\r\nNo outstanding issues\r\nConsidered very robust across a range of corner cases\r\nComprehensive code coverage through FEST tests\r\nZero bugs on Findbugs \"low\" threshold.","creator":{"login":"gary-rowe","id":342133,"avatar_url":"https://avatars.githubusercontent.com/u/342133?v=3","gravatar_id":"","url":"https://api.github.com/users/gary-rowe","html_url":"https://github.com/gary-rowe","followers_url":"https://api.github.com/users/gary-rowe/followers","following_url":"https://api.github.com/users/gary-rowe/following{/other_user}","gists_url":"https://api.github.com/users/gary-rowe/gists{/gist_id}","starred_url":"https://api.github.com/users/gary-rowe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gary-rowe/subscriptions","organizations_url":"https://api.github.com/users/gary-rowe/orgs","repos_url":"https://api.github.com/users/gary-rowe/repos","events_url":"https://api.github.com/users/gary-rowe/events{/privacy}","received_events_url":"https://api.github.com/users/gary-rowe/received_events","type":"User","site_admin":false},"open_issues":27,"closed_issues":3,"state":"open","created_at":"2014-05-14T08:08:51Z","updated_at":"2015-01-25T13:12:49Z","due_on":null,"closed_at":null},"comments":0,"created_at":"2015-01-25T13:12:49Z","updated_at":"2015-01-25T13:12:49Z","closed_at":null,"body":"We have an opportunity to verify the returned signed transaction from the Trezor to ensure that it contains the same information that we sent. \r\n\r\nThis should detect any tampering on the wire during the send process that the user may miss on the Trezor screen. For example, an opportunistic shifted decimal place for a low value: 0.005432 vs 0.0005432 BTC and/or an additional output to an unknown address.\r\n\r\nOf course this is no defence against a rooted machine but it closes off a potential attack vector for malware."}}