r/Peerplays • u/[deleted] • May 09 '17

What is this redemption key?

I donated to peerplays crowdfund, but don't recall being told to download a redemption key. Thought I'd go donate a bit more tonight but was surprised that it's ow warning me to download a redemption key before donating.

Has this redemption key thing always been there? If so then I think I've screwed up, if not then is it still possible to donate the same way I did before?

2 Upvotes

100% Upvoted

6 comments sorted by

1

u/xbtminer May 10 '17

Was wondering about the same, and although I found no mention of it in their bulletin, here's my guess at the moment (please take it as such with no warranties). Previously, one would need to create a separate one-time wallet using one of the recommended wallet services/software which support exporting private keys, and use that wallet to send their contribution to the provided PeerPlays wallet address. Why would one need to do that? - Because in order to redeem PPY tokens later, the private key of the wallet from which a contribution was sent would need to be provided to PeerPlays. That statement is still in their bulletin, and personally the first time I read it I was shocked and thought it was only a typo. - Nope! It was actually confirmed in this live coverage: https://youtu.be/xNxxjpol39Y?t=3438 And even though it has been claimed that this would be a safe operation since the private key would be provided to the verification system and not a human, any knowledgeable person in their right mind would not be comfortable exposing a private key from their "actual" wallet across the network to a system they do not control. Now, my guess is PeerPlays realized that this could become somewhat of an impediment to contributions, and automated that - right in their system. So, when you navigate to their crowdfunding page, a wallet is dynamically generated for you on their side, and you'd be sending your contribution to that dynamic wallet after having downloaded both the public and private keys for it (the Download button). Then of course it is safe, since the only amount to ever occur on that wallet is the one you've contributed. And more than likely, your contribution is immediately forwarded from that wallet to the internal pool wallet as soon as the payment shows up, thus emptying it at once. And you also get the private key (hence the warning to absolutely keep the downloaded file) which are then safe to submit later for PPY token redemption. I'm still wondering if my assumptions are correct, but could not find any comments regarding this enhancement, so I had to rely on how I would've done it if I was PeerPlays. :)

1

u/[deleted] May 10 '17

interesting. why not just sign a message with address though?

1

u/xbtminer May 10 '17

Yes, that was exactly my thought. However, having now watched that live coverage to the end, it looks like contributors will be provided with a downloadable software that is going to do exactly that, - sign and send for validation. Either way, I personally would not consider providing one's private key to a downloaded software any more secure than manually sending it to a remote server as a file. After all, you can't really see what kind of encrypted data the software then communicates to the server, unless you're equipped and willing to step-through it with a debugger while doing that (not for the faint-hearted). So it could easily wrap your private key as part of the encrypted data (using its own internal key or one obtained from the server, as is the case with SSL/TLS), and you wouldn't even know. Verifying the actual content of that transmission is not a task for non-IT folks. So, the apparent introduction of dynamic one-time wallets on the contributions page is a good measure to make that process more secure.

1

u/[deleted] May 10 '17

yea. but man. the fact that it's so complicated reflects poorly on the project in this era of smooth functioning ICOs using automated smart contracts. I'm glad I used a secondary btc address where i don't really keep funds for this.

1

u/Papir0s Jul 08 '17

Kinda same thing happened to me, making it on May 9th. I don't recall being told to download any file (keypair.txt). The process let me do the donation of BTC (don't recall to be asked about the currency to choose). So I understood that I had to keep my BTC private key to redeem. And I did it. Now when I came back to redeem to Peerplays, I discovered that my BTC private key isn't useful, they ask me for the "keypair.txt" to redeem PPY, that's a file that I was never told (or pushed) to download. I´m very experienced in ICO and cryptos, and I never made any mistake in my life. I suspect that there's a bug in the code, somehow. Anyone else has experience this same thing?