Revision of logic for "verify ownership of an address"

[HW1132]

https://github.com/Samar1110/userguide/blob/main/guides/en/transactions_and_verification/verify_address_ownership.md

Sorry I don't know how to link better to the issue I'm commenting on. There is no way to verify an address that someone else owns, so your rationale supplied in this section is not accurate. The reason you would use Seedsigner to verify an address is to ensure that you have an accurate transcription of an address for which you expect payment. You want to ensure that you control that address and can spend from it in the future. You could use Seedsigner as an alternative to verify the receive addresses that are generated by your wallet. For example, I can enter a seed into Sparrow wallet, by default it generates 25 receive addresses. I can load the same seed into Seedsigner, and I can choose one of these addresses to verify that Sparrow has generated the correct addresses for that seed.

[Samar1110]

You’re absolutely right: SeedSigner’s Verify Address function can only confirm whether a specific address was derived from the seed loaded on the device. It can’t be used to verify ownership of addresses controlled by third parties like exchanges or merchants.

I will update the rationale in the documentation to reflect this, emphasizing that the main purpose is to help users verify that addresses—like those generated by Sparrow or another wallet—truly originate from their own seed. This way, users can ensure they have control over the address and can spend from it in the future.

Thank you again for pointing this out and If you have any further suggestions on the userguide, please let me know!

[Baker66]

[Note: my feedback below is based on the most likely use of "Verify Address." This is currently under the section of 'Transactions and Verification.' I think the better location is immediately following 'Export Public Key.' The first thing to do after exporting and XPUB is to verify that it is producing valid receive addresses. Verifying a target address from a 3rd party is a differnt function. See comments at the very bottom."

Current language in the header:
"Confirm that a specific Bitcoin address was actually generated by your loaded seed. This is crucial for verifying that addresses shared with you are legitimate."

Recommendation: "Confirm that an address produced by a linked software wallet (e.g. Sparrow, see [[link]]) is legitimate and matches an address prodcued by the seed on the SeedSigner. This is crucial to confirm the linked wallet is functioning correctly and securely. Only the SeedSigner never touches an internet connection. If the address does not match one derived from the airgapped seed, then the software wallet may be misconfigured or compromised."

Justification: It is appropriate that the title of the section is "Verify Address Ownership." This matches "Verify Address" in the Tools section. Within the guide, the term "matches" between the software and hardware wallets is more friendly for new users, and speaks to the OPs intial concern. How is the SeedSigner going to verify? By matching.

Current language in step 2: "Enter Address: Select the seed address you want to verify by choosing a saved seed, scanning a new seed, or manually entering a 12/24-word seed phrase."

Even though all three options are available, this is confusing for a new users. The primary work flow would be to verify/match a single software wallet receive address to a loaded seed. Recommendation: "Enter Address: scan a receive address from the software wallet you want to verify. You may also choose to scan an entire seed of manually enter a 12/24-word seed phrase." (Although I'm not sure the work flow use case of the other two. You certainly could verify an entire child seed, but this a very specific use case.)

Security use case (at the bottom): "Use this feature to verify that addresses provided by exchanges, merchants, or other parties were actually generated by your seed before sending funds. Never send Bitcoin to unverified addresses."

Why would an "exchange, merchant, or other parties" produce an address generated by our seed? They should not have our XPUB! Maybe I don't understand which work flow we are focusing on. In the "Sign Bitcoin Transaction" section, there is also a step to Verify Recipient Address. This is also an important verification, but can only be done by eye. The Seedsigner will not have access to the origin seed.

[Samar1110]

[Note: my feedback below is based on the most likely use of "Verify Address." This is currently under the section of 'Transactions and Verification.' I think the better location is immediately following 'Export Public Key.' The first thing to do after exporting and XPUB is to verify that it is producing valid receive addresses. Verifying a target address from a 3rd party is a differnt function. See comments at the very bottom."

Current language in the header: "Confirm that a specific Bitcoin address was actually generated by your loaded seed. This is crucial for verifying that addresses shared with you are legitimate."

Recommendation: "Confirm that an address produced by a linked software wallet (e.g. Sparrow, see [[link]]) is legitimate and matches an address prodcued by the seed on the SeedSigner. This is crucial to confirm the linked wallet is functioning correctly and securely. Only the SeedSigner never touches an internet connection. If the address does not match one derived from the airgapped seed, then the software wallet may be misconfigured or compromised."

Justification: It is appropriate that the title of the section is "Verify Address Ownership." This matches "Verify Address" in the Tools section. Within the guide, the term "matches" between the software and hardware wallets is more friendly for new users, and speaks to the OPs intial concern. How is the SeedSigner going to verify? By matching.

Current language in step 2: "Enter Address: Select the seed address you want to verify by choosing a saved seed, scanning a new seed, or manually entering a 12/24-word seed phrase."

Even though all three options are available, this is confusing for a new users. The primary work flow would be to verify/match a single software wallet receive address to a loaded seed. Recommendation: "Enter Address: scan a receive address from the software wallet you want to verify. You may also choose to scan an entire seed of manually enter a 12/24-word seed phrase." (Although I'm not sure the work flow use case of the other two. You certainly could verify an entire child seed, but this a very specific use case.)

Security use case (at the bottom): "Use this feature to verify that addresses provided by exchanges, merchants, or other parties were actually generated by your seed before sending funds. Never send Bitcoin to unverified addresses."

Why would an "exchange, merchant, or other parties" produce an address generated by our seed? They should not have our XPUB! Maybe I don't understand which work flow we are focusing on. In the "Sign Bitcoin Transaction" section, there is also a step to Verify Recipient Address. This is also an important verification, but can only be done by eye. The Seedsigner will not have access to the origin seed.

You’re absolutely right the core use case is to “match” a receive address produced by a software wallet (like Sparrow) to one derived from the same seed on SeedSigner. This way, users can be sure their software wallet is not compromised or misconfigured, and that they truly control the address before receiving funds.

Also referring to addresses provided by exchanges, merchants, or other parties is confusing and inaccurate, so I will remove that.

I agree that this section belongs right after "Export Public Key," since verifying addresses is the immediate next step when setting up a watch-only or receive-only wallet.

I’ll also simplify the workflow instructions to highlight scanning receive addresses as the primary use, and move details about loading or entering seeds to an advanced note.

Thank you once again for highlighting this. If you have any additional feedback or suggestions regarding the user guide, I’d be glad to hear them!