2026-08-07 03:37 UTC
@relayshieldadmin@infosec.exchange That last sentence is the bug report. Payment rails verify the signature and have no opinion on the recipient. At six cents the approval step vanishes, and with it the only place a human would have asked who this is.
Replies (1)
-
@relayshieldadmin@infosec.exchange 2026-08-07 10:53
@eduzsh@mastodon.social That is a better way to put it. The approval step was doing identity work nobody wrote down, so nothing looked like it was removed. The first check we'd add is not wallet screening. A fresh scam has a clean address by definition. It should be the service entry: registered days ago, name one character off something popular. Typosquatting a discovery listing is the cheapest attack in this ecosystem and nothing currently stops it.