Per the spec "k1": string, // Random or non-random string, so it's not opinionated either way
On the subject of sniping, that foot note on the spec is related and @k00b actually mentioned this before too...
When you go to the stacker wallet and click on QR Code, the QR just displays on your screen and contains the k1... any cameras behind you could potentially sweep funds before you do.
The expiring of the k1 is a mitigation for a camera behind you doing a replay attack later.
2 simple ways to fix both problems:
One is to instead of the QR code, provide the LNURL as a clickable link so that only the designated protocol handler can see the k1 parameter.
The other is to keep the QR code, but blur it out and make the user click off a warning to be sure they have privacy first, this would mitigate the existing sniping vulnerability.
Personally I think both would be good.
The flow in ShockWallet, when it gets an LUD03, is it asks the user if they want to sweep the balance... or add it as a source so they can subject it to continued automation in accordance with their trust preferences and budgeting rules.
"k1": string, // Random or non-random string, so it's not opinionated either wayk1... any cameras behind you could potentially sweep funds before you do.