4 ms·

To be fair, this isn't just a problem with Bitcoin. Spear phishing attacks leading to fraudulent wire transfers are fairly common.

pbreit 11y ago
Bitcoin itself does have a mechanism to mitigate the risk: "2 of 3". As in, transfers require 2 out of 3 parties (or any n/n+m) to approve.
- dogma1138 11y ago
  No it doesn't you can't choose not to "mine" a specific transaction, it requires other parties to "witness" it but not to approve it.
  - pbreit 11y ago
    OK. I guess I don't understand then what multisig is all about. My impression was that it could be set up to require 2 parties to authorize a transaction.
    - dogma1138 11y ago
      It can require more than 1 "key holder" to initiate a transaction, Bitcoin supports M of N it's just like splinting the private key between a number of people. Once it's out its out, with normal transactions both parties can hold, revoke, and reverse a transaction this doesn't work with Bitcoin. It doesn't matter into how many keys you split your private key it's still a single entity even if within the organization there will be more than 1 person needed to authorize it.
  - adrianmacneil 11y ago
    http://bitcoin.stackexchange.com/questions/3718/what-are-multi-signature-transactions http://bitcoin.stackexchange.com/questions/3718/what-are-mul...
dogma1138 11y ago
It is but most financial organizations are under quite allot of regulation which means that they have internal and external processes to prevent these types of transactions from happening. You'll find it's very hard to fool a bank or a financial institution to authorize a transaction in this manner, it's still is possible under some cases but then you'll need much more information to do it to the point of it being an "insider fraud" than just phishing. Companies are still vulnerable to this sort of phishing you'll be surprised how many fake invoices are sent to large organizations and just how many of them end up being actually paid out. In most cases those invoices tend to fall under the "petty cash" category so they are often not very well checked and if you send out 500,000 invoices a year to companies even a small percentage of those being paid is still a nice take. Now back to financial organizations, you can't just make a transfer from bank a to bank b and expect it to work there will be huge scrutiny on even fairly small sums, yet alone millions, the funds will also be frozen for a quite long period of time (2-3 business days at the least) and in many cases will not be liquid for at least another such period. And most importantly regular bank transactions can be reversed and those which can't are insured. Bitcoin exchanges seem to be too cool to adopt the same level of regulatory mandated processes that even the smallest financial institution has to adopt. And the fact that pretty much not a single Bitcoin exchange is insured against fraud and the fact that bitcoin transactions are for the most part "anonymous" and there is no way to revoke, or reverse them means that even the smallest case of fraud can bring down the entire exchange.

pbreit 11y ago

Bitcoin itself does have a mechanism to mitigate the risk: "2 of 3". As in, transfers require 2 out of 3 parties (or any n/n+m) to approve.

dogma1138 11y ago
No it doesn't you can't choose not to "mine" a specific transaction, it requires other parties to "witness" it but not to approve it.
- pbreit 11y ago
  OK. I guess I don't understand then what multisig is all about. My impression was that it could be set up to require 2 parties to authorize a transaction.
  - dogma1138 11y ago
    It can require more than 1 "key holder" to initiate a transaction, Bitcoin supports M of N it's just like splinting the private key between a number of people. Once it's out its out, with normal transactions both parties can hold, revoke, and reverse a transaction this doesn't work with Bitcoin. It doesn't matter into how many keys you split your private key it's still a single entity even if within the organization there will be more than 1 person needed to authorize it.
- adrianmacneil 11y ago
  http://bitcoin.stackexchange.com/questions/3718/what-are-multi-signature-transactions http://bitcoin.stackexchange.com/questions/3718/what-are-mul...

dogma1138 11y ago

It is but most financial organizations are under quite allot of regulation which means that they have internal and external processes to prevent these types of transactions from happening. You'll find it's very hard to fool a bank or a financial institution to authorize a transaction in this manner, it's still is possible under some cases but then you'll need much more information to do it to the point of it being an "insider fraud" than just phishing. Companies are still vulnerable to this sort of phishing you'll be surprised how many fake invoices are sent to large organizations and just how many of them end up being actually paid out. In most cases those invoices tend to fall under the "petty cash" category so they are often not very well checked and if you send out 500,000 invoices a year to companies even a small percentage of those being paid is still a nice take. Now back to financial organizations, you can't just make a transfer from bank a to bank b and expect it to work there will be huge scrutiny on even fairly small sums, yet alone millions, the funds will also be frozen for a quite long period of time (2-3 business days at the least) and in many cases will not be liquid for at least another such period. And most importantly regular bank transactions can be reversed and those which can't are insured. Bitcoin exchanges seem to be too cool to adopt the same level of regulatory mandated processes that even the smallest financial institution has to adopt. And the fact that pretty much not a single Bitcoin exchange is insured against fraud and the fact that bitcoin transactions are for the most part "anonymous" and there is no way to revoke, or reverse them means that even the smallest case of fraud can bring down the entire exchange.