5 ms·
> they merely need to find a merchant which uses Stripe for bitcoin payments [...] > or even better, set up to automatically refund bitcoin overpayments Any i
by lol768 10y ago
> they merely need to find a merchant which uses Stripe for bitcoin payments [...]
> or even better, set up to automatically refund bitcoin overpayments
Any idea what proportion of merchants using Stripe's bitcoin handling actually do this automatic refunding?
It's a very interesting vulnerability and I enjoyed reading the write-up and thought process, but I'm not sure how practical it is if it requires interaction from the merchant to perform the refund. I think an overpayment and refund request weeks after the initial payment (when coincidentally the BTC value has reduced) would definitely ring some alarm bells - hopefully with both the merchant and the team at Stripe.
I guess you could spread out your overpayments amongst different merchants and try and limit the time between the initial purchase and the refund requests but the entire thing seems a bit convoluted to pull off.
In any case, kudos to the author for the responsible disclosure and for Stripe for handling this professionally.
- cperciva 10y agoAny idea what proportion of merchants using Stripe's bitcoin handling actually do this automatic refunding? You only need to find one. Or sign up as a Stripe customer yourself -- they'd have a hard time proving that it was you who made the overpayment rather than one of your customers. I think an overpayment and refund request weeks after the initial payment (when coincidentally the BTC value has reduced) would definitely ring some alarm bells Maybe... but "oops I sent the coins to the wrong address" is a pretty plausible story. If there's one thing I've learned from accepting bitcoin payments at Tarsnap, it's that poor bitcoin client UIs seem to be responsible for a very large number of mistakes. (The most common one I see is failing to adjust for the miner fee.)
- elnado 10y agoI don't know the proportion, but coincidentally enough, I work at a startup that uses Stripe and we used to support bitcoin transactions (and thus refunds). I just asked a friend who's been here longer why we're not supporting bitcoins anymore and his response was "exchange rates were a huge pain" haha so yeah it is indeed convoluted to do refunds with bitcoins, but if we are to attempt to use them as regular currency for goods and services, we can't not support refunds. so we dropped bitcoin support altogether.
- cperciva 10y agoWas that bitcoin support manual, or through stripe? I would never want to deal with bitcoin payments manually due to the exchange rate issue; but taking them through stripe works wonderfully.
- elnado 10y agoHmm digging through our old code looks like we never tried to use Stripe, for reasons unknown to me (maybe their support/requirements were different back then, maybe it didn't work for our product, idk). But yeah, especially after reading this article, handling bitcoin payments and dealing with the exchange rate sounds unfavorable lol :) glad we're not doing that.
- cperciva 10y agoThat's my point - with stripe, you don't have to deal with the exchange rate. You say "I want $X" and magic happens. Stripe takes care of the messy details of fluctuating exchange rates.
- elnado 10y agoSo that's not entirely true depending on how you use the product. We were attempting to use Stripe for a contract-like setup, e.g. person A pays person B, but person B doesn't get paid until some event occurs, and we hold on to the funds until that happens since that expiration of that event isn't guaranteed to be under 10 min.
- deleted 10y ago[deleted]
- homero 10y agoStripe and Bitpay handle everything, there is no huge pain