#webmonetization — Public Fediverse posts

@rstockm „Dezentrales Flattr“? Finde @Taler und #WebMonetization von @Interledger sind interessante Elemente dafür.

@rstockm „Dezentrales Flattr“? Finde @Taler und #WebMonetization von @Interledger sind interessante Elemente dafür.

Looks like Chimoney has shut down.

Bad news for @Interledger and #WebMonetization

Looks like Chimoney has shut down.

Bad news for @Interledger and #WebMonetization

Lighting a virtual candle in remembrance of Coil today.

🕯️🕯️🕯️

I look forward to the day when we all get off that waitlist.

#WebMonetization

Lighting a virtual candle in remembrance of Coil today.

🕯️🕯️🕯️

I look forward to the day when we all get off that waitlist.

#WebMonetization

Web Monetization is now available in Google’s Offerwall 🎉

Publishers can offer it alongside ads or surveys, giving users a direct way to support content through micropayments 🌱

Curious how it works?
Read more: https://interledger.org/news/web-monetization-meets-googles-offerwall

#WebMonetization #OpenWeb #Interledger

Web Monetization is now available in Google’s Offerwall 🎉

Publishers can offer it alongside ads or surveys, giving users a direct way to support content through micropayments 🌱

Curious how it works?
Read more: https://interledger.org/news/web-monetization-meets-googles-offerwall

#WebMonetization #OpenWeb #Interledger

🎤 Protocols for Publishers Lightning Talk

In this recorded talk, @Jeremiah, (Interledger Foundation Grant Program Officer & Tech Lead) explores why journalism must test new models powered by instant, interoperable payments.

What if readers could support journalism directly, no ads, no paywalls, no gatekeepers?

🎥 Watch here:
https://youtu.be/kwu8ELIa8B0

#Interledger #WebMonetization #FinancialInclusion #TechForGood

🎤 Protocols for Publishers Lightning Talk

In this recorded talk, @Jeremiah, (Interledger Foundation Grant Program Officer & Tech Lead) explores why journalism must test new models powered by instant, interoperable payments.

What if readers could support journalism directly, no ads, no paywalls, no gatekeepers?

🎥 Watch here:
https://youtu.be/kwu8ELIa8B0

#Interledger #WebMonetization #FinancialInclusion #TechForGood

If you are around the Greater #Vancouver Area (Canada) I’d love to invite you to join the #vanjs (Vancouver JavaScript) meetup. My colleague Bibi Souza will be hosting the event and talking about #WebMonetization!
https://luma.com/dk641anc

"We need far more than a different PayFac or a different Itch. We need an entire different way of transferring funds online.

But I still hate crypto."

#interledger #GNUtaler #WebMonetization #OpenPayments #FediForFiat

https://voidfox.com/blog/payment_processor_fun_2025_making_your_own_msp/

"We need far more than a different PayFac or a different Itch. We need an entire different way of transferring funds online.

But I still hate crypto."

#interledger #GNUtaler #WebMonetization #OpenPayments #FediForFiat

https://voidfox.com/blog/payment_processor_fun_2025_making_your_own_msp/

@IanTwenty @Edent

There is one exchange active: https://taler-ops.ch/en/index.html

For #WebMonetization I'm aware of only three wallet providers. Only one available in Switzerland.

Actually I'd love to have an open interface with multiple options, so that creators can have multiple options for their supporters to choose from. Then I can have e.g. #Librapay WebMonetization, and #GNUTaler, while @blog might prefer e.g. Paypal, and Bitcoin, etc.

That fits the #fediverse best.

@IanTwenty @Edent

There is one exchange active: https://taler-ops.ch/en/index.html

For #WebMonetization I'm aware of only three wallet providers. Only one available in Switzerland.

Actually I'd love to have an open interface with multiple options, so that creators can have multiple options for their supporters to choose from. Then I can have e.g. #Librapay WebMonetization, and #GNUTaler, while @blog might prefer e.g. Paypal, and Bitcoin, etc.

That fits the #fediverse best.

As I was researching (again) #WebMonetization for the blogs, and didn't like the 3 available "Wallet" options, for myself and users visiting, I went back to "Buy me a Coffee" and created a simple membership tier: €1 / month.
https://buymeacoffee.com/cybeardjm/membership

As I was researching (again) #WebMonetization for the blogs, and didn't like the 3 available "Wallet" options, for myself and users visiting, I went back to "Buy me a Coffee" and created a simple membership tier: €1 / month.
https://buymeacoffee.com/cybeardjm/membership

Grant for the Web to Make the Fediverse More Sustainable, Democratic, and Fun

https://socialwebfoundation.org/2026/02/04/grant-for-the-web-to-make-the-fediverse-more-sustainable-democratic-and-fun/

Grant for the Web to Make the Fediverse More Sustainable, Democratic, and Fun

https://socialwebfoundation.org/2026/02/04/grant-for-the-web-to-make-the-fediverse-more-sustainable-democratic-and-fun/

How do #interledger and #GNUTaler differ?

We need federated fiat. Trusted banks or credit unions acting like servers. Apps that let you send money as easily as we send email today, without a middleman. Enabling us to build cool programs that connect to other services, like paying creators for the time we spend with their work. But doing all this without the problems of crypto, just like we don't keep all our money in cash under the mattress.

#FediForFiat #WebMonetization #OpenPayments

How do #interledger and #GNUTaler differ?

We need federated fiat. Trusted banks or credit unions acting like servers. Apps that let you send money as easily as we send email today, without a middleman. Enabling us to build cool programs that connect to other services, like paying creators for the time we spend with their work. But doing all this without the problems of crypto, just like we don't keep all our money in cash under the mattress.

#FediForFiat #WebMonetization #OpenPayments

Last year at #FOSDEM, I met with @pfefferle about hooks in @activitypub.blog in order for @Interledger’s Web Monetization plugin to add wallet addresses to profiles and posts.

A year later, it’s reality! 🙌

https://wordpress.org/plugins/interledger-web-monetization-integration/

#WebMonetization

Last year at #FOSDEM, I met with @pfefferle about hooks in @activitypub.blog in order for @Interledger’s Web Monetization plugin to add wallet addresses to profiles and posts.

A year later, it’s reality! 🙌

https://wordpress.org/plugins/interledger-web-monetization-integration/

#WebMonetization

🆕 blog! “Responsible Disclosure: Chimoney Android App and KYCaid”

Chimoney is a new "multi-currency wallet" provider. Based out of Canada, it allows users to send money to and from a variety of currencies. It also supports the new Interledger protocol for WebMonetization.

But it has a security flaw which cannot be ignored.

👀 Read more: https://shkspr.mobi/blog/2026/01/responsible-disclosure-chimoney-android-app-and-kycaid/
⸻
#android #CyberSecurity #ResponsibleDisclosure #security #WebMonetization

🆕 blog! “Responsible Disclosure: Chimoney Android App and KYCaid”

Chimoney is a new "multi-currency wallet" provider. Based out of Canada, it allows users to send money to and from a variety of currencies. It also supports the new Interledger protocol for WebMonetization.

But it has a security flaw which cannot be ignored.

👀 Read more: https://shkspr.mobi/blog/2026/01/responsible-disclosure-chimoney-android-app-and-kycaid/
⸻
#android #CyberSecurity #ResponsibleDisclosure #security #WebMonetization

Responsible Disclosure: Chimoney Android App and KYCaid

Chimoney is a new "multi-currency wallet" provider. Based out of Canada, it allows users to send money to and from a variety of currencies. It also supports the new Interledger protocol for WebMonetization.

It is, as far as I can tell, unregulated by any financial institution. Nevertheless, it performs a "Know Your Customer" (KYC) check on all new account in order to prevent fraud. To do this, it uses the Ukranian KYCaid platform.

So far, so standard. But there's a small problem with how they both integrate.

I installed Chimoney's Android app and attempted to go through KYCaid's verification process. For some reason it hit me with this error message.

Well, I'd better click that email and report the problem.

Oh, that's odd. What happens if I click the protected link?

Huh! I guess I've been taken to Cloudflare's website. What happens if I click on the links on their page?

Looks like I can now visit any site on the web. If Cloudflare has a link to it, I can go there. For example, GitHub.

Why is this a problem?

MASTG-KNOW-0018: WebViews

One of the most important things to do when testing WebViews is to make sure that only trusted content can be loaded in it. Any newly loaded page could be potentially malicious, try to exploit any WebView bindings or try to phish the user. Unless you're developing a browser app, usually you'd like to restrict the pages being loaded to the domain of your app. A good practice is to prevent the user from even having the chance to input any URLs inside WebViews (which is the default on Android) nor navigate outside the trusted domains. Even when navigating on trusted domains there's still the risk that the user might encounter and click on other links to untrustworthy content

Emphasis added

A company's app is its sacred space. It shouldn't let anyone penetrate its inner sanctum because it has no control over what that 3rd party shows its customers.

There's nothing stopping an external service displaying a message like "To continue, please transfer 0.1 Bitcon to …"

(Of course, if your KYC provider - or their CDN - decides to turn evil then you probably have bigger problems!)

There are some other problems. It has long been known that people can use in-app browsers to circumvent restrictions. Some in-app browsers have insecure configurations which can be used for exploits. These sorts of "accidentally open" browsers are often considered to be a security vulnerability.

The Fix

Ideally, an Android app like this wouldn't use a web view. It should use a KYC provider's API rather than giving them wholesale control of the user experience.

But, suppose you do need a webview. What's the recommendation?

Boring old URl validation using Android's shouldOverrideUrlLoading() method.

Essentially, your app restricts what can be seen in the webview and rejects anything else.

Risk

Look, this is pretty low risk. A user would have to take several deliberate steps to find themselves in a place of danger.

Ultimately, it is "Code Smell" - part of the app is giving off a noxious whiff. That's something you cannot afford to have on a money transfer app. If this simple security fix wasn't implemented, what other horrors are lurking in the source code?

Contacting the company

There was no security.txt contact - nor anything on their website about reporting security bugs. I reached out to the CEO by email, but didn't hear back.

In desperation, I went on to Discord and asked in their support channel for help.

Unfortunately, that email address didn't exist.

I also tried contacting KYCaid, but they seemed unable or unwilling to help - and redirected me back to Chimoney.

As it has been over two month since I sent them video of this bug, I'm performing a responsible disclosure to make people aware of the problem.

Responsible Disclosure: Chimoney Android App and KYCaid

Chimoney is a new "multi-currency wallet" provider. Based out of Canada, it allows users to send money to and from a variety of currencies. It also supports the new Interledger protocol for WebMonetization.

It is, as far as I can tell, unregulated by any financial institution. Nevertheless, it performs a "Know Your Customer" (KYC) check on all new account in order to prevent fraud. To do this, it uses the Ukranian KYCaid platform.

So far, so standard. But there's a small problem with how they both integrate.

I installed Chimoney's Android app and attempted to go through KYCaid's verification process. For some reason it hit me with this error message.

Well, I'd better click that email and report the problem.

Oh, that's odd. What happens if I click the protected link?

Huh! I guess I've been taken to Cloudflare's website. What happens if I click on the links on their page?

Looks like I can now visit any site on the web. If Cloudflare has a link to it, I can go there. For example, GitHub.

Why is this a problem?

MASTG-KNOW-0018: WebViews

One of the most important things to do when testing WebViews is to make sure that only trusted content can be loaded in it. Any newly loaded page could be potentially malicious, try to exploit any WebView bindings or try to phish the user. Unless you're developing a browser app, usually you'd like to restrict the pages being loaded to the domain of your app. A good practice is to prevent the user from even having the chance to input any URLs inside WebViews (which is the default on Android) nor navigate outside the trusted domains. Even when navigating on trusted domains there's still the risk that the user might encounter and click on other links to untrustworthy content

Emphasis added

A company's app is its sacred space. It shouldn't let anyone penetrate its inner sanctum because it has no control over what that 3rd party shows its customers.

There's nothing stopping an external service displaying a message like "To continue, please transfer 0.1 Bitcon to …"

(Of course, if your KYC provider - or their CDN - decides to turn evil then you probably have bigger problems!)

There are some other problems. It has long been known that people can use in-app browsers to circumvent restrictions. Some in-app browsers have insecure configurations which can be used for exploits. These sorts of "accidentally open" browsers are often considered to be a security vulnerability.

The Fix

Ideally, an Android app like this wouldn't use a web view. It should use a KYC provider's API rather than giving them wholesale control of the user experience.

But, suppose you do need a webview. What's the recommendation?

Boring old URl validation using Android's shouldOverrideUrlLoading() method.

Essentially, your app restricts what can be seen in the webview and rejects anything else.

Risk

Look, this is pretty low risk. A user would have to take several deliberate steps to find themselves in a place of danger.

Ultimately, it is "Code Smell" - part of the app is giving off a noxious whiff. That's something you cannot afford to have on a money transfer app. If this simple security fix wasn't implemented, what other horrors are lurking in the source code?

Contacting the company

There was no security.txt contact - nor anything on their website about reporting security bugs. I reached out to the CEO by email, but didn't hear back.

In desperation, I went on to Discord and asked in their support channel for help.

Unfortunately, that email address didn't exist.

I also tried contacting KYCaid, but they seemed unable or unwilling to help - and redirected me back to Chimoney.

As it has been over two month since I sent them video of this bug, I'm performing a responsible disclosure to make people aware of the problem.

Our first monthly community call of the year will be on Wednesday, January 14.

Join us for a first look at the foundation’s 2026 plans for advancing digital financial inclusion, #OpenPayments, and #WebMonetization.

https://community.interledger.org/interledger/join-us-for-the-interledger-community-call-14-january-2026-4fn0?ref=activitypub

Our first monthly community call of the year will be on Wednesday, January 14.

Join us for a first look at the foundation’s 2026 plans for advancing digital financial inclusion, #OpenPayments, and #WebMonetization.

https://community.interledger.org/interledger/join-us-for-the-interledger-community-call-14-january-2026-4fn0?ref=activitypub

@raymondcamden I fail to read between the lines if this is sarcastic, ironic, or literal. Sorry for the direct question, but as someone interested in #WebMonetization (https://blog.tomayac.com/2025/11/07/using-the-web-monetization-api-for-fun-and-profit/), I'm honestly hoping to understand if ads work for personal/indie blogs like yours.

@raymondcamden I fail to read between the lines if this is sarcastic, ironic, or literal. Sorry for the direct question, but as someone interested in #WebMonetization (https://blog.tomayac.com/2025/11/07/using-the-web-monetization-api-for-fun-and-profit/), I'm honestly hoping to understand if ads work for personal/indie blogs like yours.

Curious how Web Monetization uses #OpenPayments?

Part 1 of our new series breaks down the basics, the browser extension, wallet setup, budgets, and how creators get supported behind the scenes.

👉 Read Part 1 by Sid Vishnoi: https://interledger.org/developers/blog/web-monetization-open-payments-part-1-connecting-wallet/

#WebMonetization #OpenPayments

Curious how Web Monetization uses #OpenPayments?

Part 1 of our new series breaks down the basics, the browser extension, wallet setup, budgets, and how creators get supported behind the scenes.

👉 Read Part 1 by Sid Vishnoi: https://interledger.org/developers/blog/web-monetization-open-payments-part-1-connecting-wallet/

#WebMonetization #OpenPayments

Web Monetization is Still Inching Along, But Still Too Difficult

https://web.brid.gy/r/https://frontendmasters.com/blog/web-monetization-is-still-inching-along-but-still-too-difficult/

A theory has occurred to me as I woke up (probably irrational but I'll voice it anyway, just to get it out of my head)

I have an Uphold account from when the coil Web Monetization thing was running. They recently moved from allowing standards based 2FA (TOTP) to mandating installing their mobile app to sign in even on the web.

My first thought was that this was an information grab, but now wondering if it is also to stop people cashing out during a price crash

#coil #WebMonetization #2FA

A theory has occurred to me as I woke up (probably irrational but I'll voice it anyway, just to get it out of my head)

I have an Uphold account from when the coil Web Monetization thing was running. They recently moved from allowing standards based 2FA (TOTP) to mandating installing their mobile app to sign in even on the web.

My first thought was that this was an information grab, but now wondering if it is also to stop people cashing out during a price crash

#coil #WebMonetization #2FA

📢 New blog post! Using the Web Monetization API for fun 🤩
and profit 🤑:

🔗 https://blog.tomayac.com/2025/11/07/using-the-web-monetization-api-for-fun-and-profit/

Learn how I use the proposed #WebMonetization standard by the @Interledger Foundation on my blog to (hopefully) pay for my virtual private server! The whole secret is this tag:

```html
<link rel="monetization" href="https://ilp.gatehub.net/348218105/eur" />
```

📢 New blog post! Using the Web Monetization API for fun 🤩
and profit 🤑:

🔗 https://blog.tomayac.com/2025/11/07/using-the-web-monetization-api-for-fun-and-profit/

Learn how I use the proposed #WebMonetization standard by the @Interledger Foundation on my blog to (hopefully) pay for my virtual private server! The whole secret is this tag:

```html
<link rel="monetization" href="https://ilp.gatehub.net/348218105/eur" />
```

@ricmac

the incentives are to create content for big tech platforms. to work for them. to get promoted by their algos and paid by them. we have a fedi coming together re an fair playing field for discovery, but we all need to come together to make #WebMonetization happen too. #PublicPatron

@ricmac

the incentives are to create content for big tech platforms. to work for them. to get promoted by their algos and paid by them. we have a fedi coming together re an fair playing field for discovery, but we all need to come together to make #WebMonetization happen too. #PublicPatron

Holy shit you guys!

Someone at Meta remembered that #OpenGraphProtocol exists.

An update was made in June - https://github.com/facebook/open-graph-protocol/commits/master/

Which adds Payment link metadata - https://ogp.me/#type_payment

Nothing about #WebMonetization, sadly, but good to know the project isn't completely abandoned.

Holy shit you guys!

Someone at Meta remembered that #OpenGraphProtocol exists.

An update was made in June - https://github.com/facebook/open-graph-protocol/commits/master/

Which adds Payment link metadata - https://ogp.me/#type_payment

Nothing about #WebMonetization, sadly, but good to know the project isn't completely abandoned.

@Sascha @teezeh hat schon jemand Erfahrung mit #webmonetization?
Beeabee sieht so aus, als ob es nicht mehr gepflegt wird. Die Links zum Impressum etc sind tot.

@Sascha @teezeh hat schon jemand Erfahrung mit #webmonetization?
Beeabee sieht so aus, als ob es nicht mehr gepflegt wird. Die Links zum Impressum etc sind tot.

@wjmaggos was going to boost that till I read the #WebMonetization hashtag, need some clarification on that bit :)

@wjmaggos was going to boost that till I read the #WebMonetization hashtag, need some clarification on that bit :)

Most of the money that gets donated to political campaigns, gets spent on advertising. Getting people off media distribution systems with ads and instead funding the work directly, would do so much to fix our political process.

It's a huge part of why I want the #SocialWeb and #WebMonetization to win.

#DemocracyOfReach #PublicPatron

Most of the money that gets donated to political campaigns, gets spent on advertising. Getting people off media distribution systems with ads and instead funding the work directly, would do so much to fix our political process.

It's a huge part of why I want the #SocialWeb and #WebMonetization to win.

#DemocracyOfReach #PublicPatron

What if you could pay the same for media but have the money only go directly to the creators whose work you spent the most time with? That should be possible with decentralized social media and a protocol for bank to bank fiat transfers. If we gave enough, they'd tear down the paywalls themselves.

#SocialWeb #WebMonetization #PublicPatron

What if you could pay the same for media but have the money only go directly to the creators whose work you spent the most time with? That should be possible with decentralized social media and a protocol for bank to bank fiat transfers. If we gave enough, they'd tear down the paywalls themselves.

#SocialWeb #WebMonetization #PublicPatron

Anybody here using #pix in Brazil? Is it the open protocol standard for direct bank to bank transfers that I've been dying for in the US? I hear that this new system is squeezing middleman money transfer systems like PayPal etc out of their market and pissing off Trump. #WebMonetization

cc @Jeremiah

@ben

lots of good points but the first thing we should focus on (cause it will matter even if we don't go full authoritarian) is to just further decentralize all our media distribution and payments to them.

#peertube #owncast #WebMonetization

#DemocracyOfReach project ideas:

#FediFBNextDoor - comfy communities for normies

#FediOGTwitter - it's not microblogging, it's a news feed

#FediPodcasts - AP instead of RSS would make them social

#FediReader - articles and text to speech

#FediYouTube - places for all peertube + owncast content

#FediSpotify - separate artist sites w unified streaming

#FediRadio - indy w chat

#WebMonetization - fiat protocol

#PublicPatron - pay what you can afford based on time spent with their work