The GNU project has released its free electronic payment system GNU Taler 0.8. A key feature of the system is that it provides customers with anonymity, while sellers are not anonymous to ensure transparency in tax reporting. This means the system does not track information about where a user spends money, but it provides means to track incoming funds (the sender remains anonymous), addressing issues related to tax audits associated with BitCoin. The code is written in Python and is distributed under the AGPLv3 and LGPLv3 licenses.
GNU Taler does not create its own cryptocurrency but works with existing currencies, including dollars, euros, and bitcoins. Support for new currencies can be ensured by creating a bank that acts as a financial guarantor. The business model of GNU Taler is based on performing exchange transactions—money from traditional payment systems like Bitcoin, Mastercard, SEPA, Visa, ACH, and SWIFT is converted into anonymous electronic money in the same currency. Users can transfer electronic money to sellers, who can then exchange it back into real money at the exchange point, represented by traditional payment systems.
All transactions in GNU Taler are secured using modern cryptographic algorithms that ensure integrity even in the event of leakage of private keys belonging to clients, sellers, and exchange points. The database format allows for the verification of all transactions made and confirms their consistency. The confirmation of payment for sellers is a cryptographic proof of transfer within the contract concluded with the client, along with a cryptographically signed confirmation of available funds at the exchange point. GNU Taler comprises a set of basic components that provide functionality for operating the bank, exchange point, marketplace, wallet, and auditor.
The new release contains changes made to address shortcomings identified during a security audit of the codebase. The audit was conducted in 2020 by Code Blau and financed through a grant awarded by the European Commission as part of a program for developing next-generation internet technologies. After the review, recommendations were made regarding enhancing the isolation of private keys and privilege separation, improving code documentation, simplifying complex structures, reworking methods for handling NULL pointers, and initializing structures and callback calls.
Key Changes:
- The isolation of private keys has been enhanced, which are now processed using separate executable files taler-exchange-secmod-*, running under a separate user. This allows for the separation of key handling logic from the process taler-exchange-httpd, which handles external network requests.
- The isolation of confidential configuration parameters for exchange points has been strengthened.
- The wallet implementation (Wallet-core) has added support for backup and recovery.
- The wallet has updated the presentation of information related to transactions, history, errors, and pending operations. The wallet's stability and usability have been improved. The wallet API has been documented, now used across all user interfaces.
- In the WebExtension-based wallet, designed for use in browsers, support for the GNU IceCat browser has been added. The access permissions required for the WebExtension-based wallet have been significantly reduced.
- For exchange points and marketplaces, the ability to define their own service delivery conditions has been provided.
- Optional tools for inventory management have been added to the backend for organizing marketplace operations.
- The contract allows for the display of product image sketches.
- The F-Droid catalog hosts Android applications for point-of-sale and cash register operations, used for organizing sales on marketplaces.
- The implementation of the refund process has been improved.
- The HTTP API for marketplaces has been enhanced and simplified. The creation of frontends for marketplaces has been simplified, and the backend can now generate ready-made HTML pages for wallet interaction.
Source: opennet.ru
