#webmonetization — Public Fediverse posts

@sebastian.eurosky.social

how does this work?

I want a protocol (not crypto) that every banking app can use to allow us to pay each other from bank to bank directly. no more middlemen (beyond the federated banking infrastructure that already exists and proper government oversight of course)

anything else is just another prison.

#WebMonetization #interledger #GNUtaler #AssetFlow

@sebastian.eurosky.social

how does this work?

I want a protocol (not crypto) that every banking app can use to allow us to pay each other from bank to bank directly. no more middlemen (beyond the federated banking infrastructure that already exists and proper government oversight of course)

anything else is just another prison.

#WebMonetization #interledger #GNUtaler #AssetFlow

@sebastian.eurosky.social

how does this work?

I want a protocol (not crypto) that every banking app can use to allow us to pay each other from bank to bank directly. no more middlemen (beyond the federated banking infrastructure that already exists and proper government oversight of course)

anything else is just another prison.

#WebMonetization #interledger #GNUtaler #AssetFlow

@rstockm „Dezentrales Flattr“? Finde @Taler und #WebMonetization von @Interledger sind interessante Elemente dafür.

@rstockm „Dezentrales Flattr“? Finde @Taler und #WebMonetization von @Interledger sind interessante Elemente dafür.

@rstockm „Dezentrales Flattr“? Finde @Taler und #WebMonetization von @Interledger sind interessante Elemente dafür.

@rstockm „Dezentrales Flattr“? Finde @Taler und #WebMonetization von @Interledger sind interessante Elemente dafür.

@rstockm „Dezentrales Flattr“? Finde @Taler und #WebMonetization von @Interledger sind interessante Elemente dafür.

Looks like Chimoney has shut down.

Bad news for @Interledger and #WebMonetization

Looks like Chimoney has shut down.

Bad news for @Interledger and #WebMonetization

Looks like Chimoney has shut down.

Bad news for @Interledger and #WebMonetization

Looks like Chimoney has shut down.

Bad news for @Interledger and #WebMonetization

Looks like Chimoney has shut down.

Bad news for @Interledger and #WebMonetization

Lighting a virtual candle in remembrance of Coil today.

🕯️🕯️🕯️

I look forward to the day when we all get off that waitlist.

#WebMonetization

Lighting a virtual candle in remembrance of Coil today.

🕯️🕯️🕯️

I look forward to the day when we all get off that waitlist.

#WebMonetization

Lighting a virtual candle in remembrance of Coil today.

🕯️🕯️🕯️

I look forward to the day when we all get off that waitlist.

#WebMonetization

Lighting a virtual candle in remembrance of Coil today.

🕯️🕯️🕯️

I look forward to the day when we all get off that waitlist.

#WebMonetization

Lighting a virtual candle in remembrance of Coil today.

🕯️🕯️🕯️

I look forward to the day when we all get off that waitlist.

#WebMonetization

Web Monetization is now available in Google’s Offerwall 🎉

Publishers can offer it alongside ads or surveys, giving users a direct way to support content through micropayments 🌱

Curious how it works?
Read more: https://interledger.org/news/web-monetization-meets-googles-offerwall

#WebMonetization #OpenWeb #Interledger

Web Monetization is now available in Google’s Offerwall 🎉

Publishers can offer it alongside ads or surveys, giving users a direct way to support content through micropayments 🌱

Curious how it works?
Read more: https://interledger.org/news/web-monetization-meets-googles-offerwall

#WebMonetization #OpenWeb #Interledger

Web Monetization is now available in Google’s Offerwall 🎉

Publishers can offer it alongside ads or surveys, giving users a direct way to support content through micropayments 🌱

Curious how it works?
Read more: https://interledger.org/news/web-monetization-meets-googles-offerwall

#WebMonetization #OpenWeb #Interledger

Web Monetization is now available in Google’s Offerwall 🎉

Publishers can offer it alongside ads or surveys, giving users a direct way to support content through micropayments 🌱

Curious how it works?
Read more: https://interledger.org/news/web-monetization-meets-googles-offerwall

#WebMonetization #OpenWeb #Interledger

Web Monetization is now available in Google’s Offerwall 🎉

Publishers can offer it alongside ads or surveys, giving users a direct way to support content through micropayments 🌱

Curious how it works?
Read more: https://interledger.org/news/web-monetization-meets-googles-offerwall

#WebMonetization #OpenWeb #Interledger

🎤 Protocols for Publishers Lightning Talk

In this recorded talk, @Jeremiah, (Interledger Foundation Grant Program Officer & Tech Lead) explores why journalism must test new models powered by instant, interoperable payments.

What if readers could support journalism directly, no ads, no paywalls, no gatekeepers?

🎥 Watch here:
https://youtu.be/kwu8ELIa8B0

#Interledger #WebMonetization #FinancialInclusion #TechForGood

🎤 Protocols for Publishers Lightning Talk

In this recorded talk, @Jeremiah, (Interledger Foundation Grant Program Officer & Tech Lead) explores why journalism must test new models powered by instant, interoperable payments.

What if readers could support journalism directly, no ads, no paywalls, no gatekeepers?

🎥 Watch here:
https://youtu.be/kwu8ELIa8B0

#Interledger #WebMonetization #FinancialInclusion #TechForGood

🎤 Protocols for Publishers Lightning Talk

In this recorded talk, @Jeremiah, (Interledger Foundation Grant Program Officer & Tech Lead) explores why journalism must test new models powered by instant, interoperable payments.

What if readers could support journalism directly, no ads, no paywalls, no gatekeepers?

🎥 Watch here:
https://youtu.be/kwu8ELIa8B0

#Interledger #WebMonetization #FinancialInclusion #TechForGood

🎤 Protocols for Publishers Lightning Talk

In this recorded talk, @Jeremiah, (Interledger Foundation Grant Program Officer & Tech Lead) explores why journalism must test new models powered by instant, interoperable payments.

What if readers could support journalism directly, no ads, no paywalls, no gatekeepers?

🎥 Watch here:
https://youtu.be/kwu8ELIa8B0

#Interledger #WebMonetization #FinancialInclusion #TechForGood

🎤 Protocols for Publishers Lightning Talk

In this recorded talk, @Jeremiah, (Interledger Foundation Grant Program Officer & Tech Lead) explores why journalism must test new models powered by instant, interoperable payments.

What if readers could support journalism directly, no ads, no paywalls, no gatekeepers?

🎥 Watch here:
https://youtu.be/kwu8ELIa8B0

#Interledger #WebMonetization #FinancialInclusion #TechForGood

If you are around the Greater #Vancouver Area (Canada) I’d love to invite you to join the #vanjs (Vancouver JavaScript) meetup. My colleague Bibi Souza will be hosting the event and talking about #WebMonetization!
https://luma.com/dk641anc

If you are around the Greater #Vancouver Area (Canada) I’d love to invite you to join the #vanjs (Vancouver JavaScript) meetup. My colleague Bibi Souza will be hosting the event and talking about #WebMonetization!
https://luma.com/dk641anc

If you are around the Greater #Vancouver Area (Canada) I’d love to invite you to join the #vanjs (Vancouver JavaScript) meetup. My colleague Bibi Souza will be hosting the event and talking about #WebMonetization!
https://luma.com/dk641anc

If you are around the Greater #Vancouver Area (Canada) I’d love to invite you to join the #vanjs (Vancouver JavaScript) meetup. My colleague Bibi Souza will be hosting the event and talking about #WebMonetization!
https://luma.com/dk641anc

"We need far more than a different PayFac or a different Itch. We need an entire different way of transferring funds online.

But I still hate crypto."

#interledger #GNUtaler #WebMonetization #OpenPayments #FediForFiat

https://voidfox.com/blog/payment_processor_fun_2025_making_your_own_msp/

"We need far more than a different PayFac or a different Itch. We need an entire different way of transferring funds online.

But I still hate crypto."

#interledger #GNUtaler #WebMonetization #OpenPayments #FediForFiat

https://voidfox.com/blog/payment_processor_fun_2025_making_your_own_msp/

"We need far more than a different PayFac or a different Itch. We need an entire different way of transferring funds online.

But I still hate crypto."

#interledger #GNUtaler #WebMonetization #OpenPayments #FediForFiat

https://voidfox.com/blog/payment_processor_fun_2025_making_your_own_msp/

@IanTwenty @Edent

There is one exchange active: https://taler-ops.ch/en/index.html

For #WebMonetization I'm aware of only three wallet providers. Only one available in Switzerland.

Actually I'd love to have an open interface with multiple options, so that creators can have multiple options for their supporters to choose from. Then I can have e.g. #Librapay WebMonetization, and #GNUTaler, while @blog might prefer e.g. Paypal, and Bitcoin, etc.

That fits the #fediverse best.

@IanTwenty @Edent

There is one exchange active: https://taler-ops.ch/en/index.html

For #WebMonetization I'm aware of only three wallet providers. Only one available in Switzerland.

Actually I'd love to have an open interface with multiple options, so that creators can have multiple options for their supporters to choose from. Then I can have e.g. #Librapay WebMonetization, and #GNUTaler, while @blog might prefer e.g. Paypal, and Bitcoin, etc.

That fits the #fediverse best.

@IanTwenty @Edent

There is one exchange active: https://taler-ops.ch/en/index.html

For #WebMonetization I'm aware of only three wallet providers. Only one available in Switzerland.

Actually I'd love to have an open interface with multiple options, so that creators can have multiple options for their supporters to choose from. Then I can have e.g. #Librapay WebMonetization, and #GNUTaler, while @blog might prefer e.g. Paypal, and Bitcoin, etc.

That fits the #fediverse best.

@IanTwenty @Edent

There is one exchange active: https://taler-ops.ch/en/index.html

For #WebMonetization I'm aware of only three wallet providers. Only one available in Switzerland.

Actually I'd love to have an open interface with multiple options, so that creators can have multiple options for their supporters to choose from. Then I can have e.g. #Librapay WebMonetization, and #GNUTaler, while @blog might prefer e.g. Paypal, and Bitcoin, etc.

That fits the #fediverse best.

@IanTwenty @Edent

There is one exchange active: https://taler-ops.ch/en/index.html

For #WebMonetization I'm aware of only three wallet providers. Only one available in Switzerland.

Actually I'd love to have an open interface with multiple options, so that creators can have multiple options for their supporters to choose from. Then I can have e.g. #Librapay WebMonetization, and #GNUTaler, while @blog might prefer e.g. Paypal, and Bitcoin, etc.

That fits the #fediverse best.

Grant for the Web to Make the Fediverse More Sustainable, Democratic, and Fun

https://socialwebfoundation.org/2026/02/04/grant-for-the-web-to-make-the-fediverse-more-sustainable-democratic-and-fun/

Grant for the Web to Make the Fediverse More Sustainable, Democratic, and Fun

https://socialwebfoundation.org/2026/02/04/grant-for-the-web-to-make-the-fediverse-more-sustainable-democratic-and-fun/

Grant for the Web to Make the Fediverse More Sustainable, Democratic, and Fun

https://socialwebfoundation.org/2026/02/04/grant-for-the-web-to-make-the-fediverse-more-sustainable-democratic-and-fun/

Grant for the Web to Make the Fediverse More Sustainable, Democratic, and Fun

https://socialwebfoundation.org/2026/02/04/grant-for-the-web-to-make-the-fediverse-more-sustainable-democratic-and-fun/

Grant for the Web to Make the Fediverse More Sustainable, Democratic, and Fun

https://socialwebfoundation.org/2026/02/04/grant-for-the-web-to-make-the-fediverse-more-sustainable-democratic-and-fun/

How do #interledger and #GNUTaler differ?

We need federated fiat. Trusted banks or credit unions acting like servers. Apps that let you send money as easily as we send email today, without a middleman. Enabling us to build cool programs that connect to other services, like paying creators for the time we spend with their work. But doing all this without the problems of crypto, just like we don't keep all our money in cash under the mattress.

#FediForFiat #WebMonetization #OpenPayments

How do #interledger and #GNUTaler differ?

We need federated fiat. Trusted banks or credit unions acting like servers. Apps that let you send money as easily as we send email today, without a middleman. Enabling us to build cool programs that connect to other services, like paying creators for the time we spend with their work. But doing all this without the problems of crypto, just like we don't keep all our money in cash under the mattress.

#FediForFiat #WebMonetization #OpenPayments

How do #interledger and #GNUTaler differ?

We need federated fiat. Trusted banks or credit unions acting like servers. Apps that let you send money as easily as we send email today, without a middleman. Enabling us to build cool programs that connect to other services, like paying creators for the time we spend with their work. But doing all this without the problems of crypto, just like we don't keep all our money in cash under the mattress.

#FediForFiat #WebMonetization #OpenPayments

Last year at #FOSDEM, I met with @pfefferle about hooks in @activitypub.blog in order for @Interledger’s Web Monetization plugin to add wallet addresses to profiles and posts.

A year later, it’s reality! 🙌

https://wordpress.org/plugins/interledger-web-monetization-integration/

#WebMonetization

Last year at #FOSDEM, I met with @pfefferle about hooks in @activitypub.blog in order for @Interledger’s Web Monetization plugin to add wallet addresses to profiles and posts.

A year later, it’s reality! 🙌

https://wordpress.org/plugins/interledger-web-monetization-integration/

#WebMonetization

Last year at #FOSDEM, I met with @pfefferle about hooks in @activitypub.blog in order for @Interledger’s Web Monetization plugin to add wallet addresses to profiles and posts.

A year later, it’s reality! 🙌

https://wordpress.org/plugins/interledger-web-monetization-integration/

#WebMonetization

Last year at #FOSDEM, I met with @pfefferle about hooks in @activitypub.blog in order for @Interledger’s Web Monetization plugin to add wallet addresses to profiles and posts.

A year later, it’s reality! 🙌

https://wordpress.org/plugins/interledger-web-monetization-integration/

#WebMonetization

Last year at #FOSDEM, I met with @pfefferle about hooks in @activitypub.blog in order for @Interledger’s Web Monetization plugin to add wallet addresses to profiles and posts.

A year later, it’s reality! 🙌

https://wordpress.org/plugins/interledger-web-monetization-integration/

#WebMonetization

🆕 blog! “Responsible Disclosure: Chimoney Android App and KYCaid”

Chimoney is a new "multi-currency wallet" provider. Based out of Canada, it allows users to send money to and from a variety of currencies. It also supports the new Interledger protocol for WebMonetization.

But it has a security flaw which cannot be ignored.

👀 Read more: https://shkspr.mobi/blog/2026/01/responsible-disclosure-chimoney-android-app-and-kycaid/
⸻
#android #CyberSecurity #ResponsibleDisclosure #security #WebMonetization

🆕 blog! “Responsible Disclosure: Chimoney Android App and KYCaid”

Chimoney is a new "multi-currency wallet" provider. Based out of Canada, it allows users to send money to and from a variety of currencies. It also supports the new Interledger protocol for WebMonetization.

But it has a security flaw which cannot be ignored.

👀 Read more: https://shkspr.mobi/blog/2026/01/responsible-disclosure-chimoney-android-app-and-kycaid/
⸻
#android #CyberSecurity #ResponsibleDisclosure #security #WebMonetization

🆕 blog! “Responsible Disclosure: Chimoney Android App and KYCaid”

Chimoney is a new "multi-currency wallet" provider. Based out of Canada, it allows users to send money to and from a variety of currencies. It also supports the new Interledger protocol for WebMonetization.

But it has a security flaw which cannot be ignored.

👀 Read more: https://shkspr.mobi/blog/2026/01/responsible-disclosure-chimoney-android-app-and-kycaid/
⸻
#android #CyberSecurity #ResponsibleDisclosure #security #WebMonetization

🆕 blog! “Responsible Disclosure: Chimoney Android App and KYCaid”

Chimoney is a new "multi-currency wallet" provider. Based out of Canada, it allows users to send money to and from a variety of currencies. It also supports the new Interledger protocol for WebMonetization.

But it has a security flaw which cannot be ignored.

👀 Read more: https://shkspr.mobi/blog/2026/01/responsible-disclosure-chimoney-android-app-and-kycaid/
⸻
#android #CyberSecurity #ResponsibleDisclosure #security #WebMonetization

🆕 blog! “Responsible Disclosure: Chimoney Android App and KYCaid”

Chimoney is a new "multi-currency wallet" provider. Based out of Canada, it allows users to send money to and from a variety of currencies. It also supports the new Interledger protocol for WebMonetization.

But it has a security flaw which cannot be ignored.

👀 Read more: https://shkspr.mobi/blog/2026/01/responsible-disclosure-chimoney-android-app-and-kycaid/
⸻
#android #CyberSecurity #ResponsibleDisclosure #security #WebMonetization

Responsible Disclosure: Chimoney Android App and KYCaid

Chimoney is a new "multi-currency wallet" provider. Based out of Canada, it allows users to send money to and from a variety of currencies. It also supports the new Interledger protocol for WebMonetization.

It is, as far as I can tell, unregulated by any financial institution. Nevertheless, it performs a "Know Your Customer" (KYC) check on all new account in order to prevent fraud. To do this, it uses the Ukranian KYCaid platform.

So far, so standard. But there's a small problem with how they both integrate.

I installed Chimoney's Android app and attempted to go through KYCaid's verification process. For some reason it hit me with this error message.

Well, I'd better click that email and report the problem.

Oh, that's odd. What happens if I click the protected link?

Huh! I guess I've been taken to Cloudflare's website. What happens if I click on the links on their page?

Looks like I can now visit any site on the web. If Cloudflare has a link to it, I can go there. For example, GitHub.

Why is this a problem?

MASTG-KNOW-0018: WebViews

One of the most important things to do when testing WebViews is to make sure that only trusted content can be loaded in it. Any newly loaded page could be potentially malicious, try to exploit any WebView bindings or try to phish the user. Unless you're developing a browser app, usually you'd like to restrict the pages being loaded to the domain of your app. A good practice is to prevent the user from even having the chance to input any URLs inside WebViews (which is the default on Android) nor navigate outside the trusted domains. Even when navigating on trusted domains there's still the risk that the user might encounter and click on other links to untrustworthy content

Emphasis added

A company's app is its sacred space. It shouldn't let anyone penetrate its inner sanctum because it has no control over what that 3rd party shows its customers.

There's nothing stopping an external service displaying a message like "To continue, please transfer 0.1 Bitcon to …"

(Of course, if your KYC provider - or their CDN - decides to turn evil then you probably have bigger problems!)

There are some other problems. It has long been known that people can use in-app browsers to circumvent restrictions. Some in-app browsers have insecure configurations which can be used for exploits. These sorts of "accidentally open" browsers are often considered to be a security vulnerability.

The Fix

Ideally, an Android app like this wouldn't use a web view. It should use a KYC provider's API rather than giving them wholesale control of the user experience.

But, suppose you do need a webview. What's the recommendation?

Boring old URl validation using Android's shouldOverrideUrlLoading() method.

Essentially, your app restricts what can be seen in the webview and rejects anything else.

Risk

Look, this is pretty low risk. A user would have to take several deliberate steps to find themselves in a place of danger.

Ultimately, it is "Code Smell" - part of the app is giving off a noxious whiff. That's something you cannot afford to have on a money transfer app. If this simple security fix wasn't implemented, what other horrors are lurking in the source code?

Contacting the company

There was no security.txt contact - nor anything on their website about reporting security bugs. I reached out to the CEO by email, but didn't hear back.

In desperation, I went on to Discord and asked in their support channel for help.

Unfortunately, that email address didn't exist.

I also tried contacting KYCaid, but they seemed unable or unwilling to help - and redirected me back to Chimoney.

As it has been over two month since I sent them video of this bug, I'm performing a responsible disclosure to make people aware of the problem.

Responsible Disclosure: Chimoney Android App and KYCaid

Chimoney is a new "multi-currency wallet" provider. Based out of Canada, it allows users to send money to and from a variety of currencies. It also supports the new Interledger protocol for WebMonetization.

It is, as far as I can tell, unregulated by any financial institution. Nevertheless, it performs a "Know Your Customer" (KYC) check on all new account in order to prevent fraud. To do this, it uses the Ukranian KYCaid platform.

So far, so standard. But there's a small problem with how they both integrate.

I installed Chimoney's Android app and attempted to go through KYCaid's verification process. For some reason it hit me with this error message.

Well, I'd better click that email and report the problem.

Oh, that's odd. What happens if I click the protected link?

Huh! I guess I've been taken to Cloudflare's website. What happens if I click on the links on their page?

Looks like I can now visit any site on the web. If Cloudflare has a link to it, I can go there. For example, GitHub.

Why is this a problem?

MASTG-KNOW-0018: WebViews

One of the most important things to do when testing WebViews is to make sure that only trusted content can be loaded in it. Any newly loaded page could be potentially malicious, try to exploit any WebView bindings or try to phish the user. Unless you're developing a browser app, usually you'd like to restrict the pages being loaded to the domain of your app. A good practice is to prevent the user from even having the chance to input any URLs inside WebViews (which is the default on Android) nor navigate outside the trusted domains. Even when navigating on trusted domains there's still the risk that the user might encounter and click on other links to untrustworthy content

Emphasis added

A company's app is its sacred space. It shouldn't let anyone penetrate its inner sanctum because it has no control over what that 3rd party shows its customers.

There's nothing stopping an external service displaying a message like "To continue, please transfer 0.1 Bitcon to …"

(Of course, if your KYC provider - or their CDN - decides to turn evil then you probably have bigger problems!)

There are some other problems. It has long been known that people can use in-app browsers to circumvent restrictions. Some in-app browsers have insecure configurations which can be used for exploits. These sorts of "accidentally open" browsers are often considered to be a security vulnerability.

The Fix

Ideally, an Android app like this wouldn't use a web view. It should use a KYC provider's API rather than giving them wholesale control of the user experience.

But, suppose you do need a webview. What's the recommendation?

Boring old URl validation using Android's shouldOverrideUrlLoading() method.

Essentially, your app restricts what can be seen in the webview and rejects anything else.

Risk

Look, this is pretty low risk. A user would have to take several deliberate steps to find themselves in a place of danger.

Ultimately, it is "Code Smell" - part of the app is giving off a noxious whiff. That's something you cannot afford to have on a money transfer app. If this simple security fix wasn't implemented, what other horrors are lurking in the source code?

Contacting the company

There was no security.txt contact - nor anything on their website about reporting security bugs. I reached out to the CEO by email, but didn't hear back.

In desperation, I went on to Discord and asked in their support channel for help.

Unfortunately, that email address didn't exist.

I also tried contacting KYCaid, but they seemed unable or unwilling to help - and redirected me back to Chimoney.

As it has been over two month since I sent them video of this bug, I'm performing a responsible disclosure to make people aware of the problem.