00:51 <harding> aj: re: "it’s possible that progress on BIP322 (signing messages against a Bitcoin address) may provide a path to avoiding address swapping attacks." from http://www.erisian.com.au/wordpress/2021/01/07/bitcoin-in-2021 , how do you envision that working?

03:26 <aj> harding: if you sign "please pay me $20 to addr X" with addr X, then just substituting X for Y fails. of course swapping X,sigX for Y,sigY succeeds. you could sign "pay me $20 to X" with some previously known key P as well, which might just be "reducing" the problem to PKI, not sure

03:29 <harding> aj: ah, ok. I was thinking it could be useful for a sort of trust-on-first-use-no-reused-addresses thing where Exchange Alice gives User Bob an address, Bob deposits so funds, then Alice gives address2 with a signature from address1 that Bob can verify. Though, at that point it seems easier just to use a BIP32 keychain.

03:33 <aj> harding: hmm, might be easier to sign than have to deal with a new bip32 path of arbitrary depth if you deal with lots of people paying you? (on-chain deposit + payment on a lambo/yacht/house or something where a whole new path seems a waste?)

14:31 <harding> aj: using a BIP32 path eliminates the round trip of "I want to send you more money, give me an address and a proof" and "ok, here's an adress and a proof". With a path, Bob just pays Alice's next index, and I think most receivers, especially those already running full nodes, would rather simplify receiving money than reduce output scanning burden.