4 ms·
1. Go on Microsoft Store 2. Select Bitcoin as payment method 3. Pay with legitimate Bitcoins 4. Later on, send a tainted post-mixer Satoshi to wherever addre
by desdiv 9y ago
1. Go on Microsoft Store
2. Select Bitcoin as payment method
3. Pay with legitimate Bitcoins
4. Later on, send a tainted post-mixer Satoshi to wherever address your legitimate Bitcoins ended up at
5. You just made a portion of Microsoft Corporation's Bitcoin holdings worthless
Actually, come to think of it, big companies don't actually handle the Bitcoins directly. They have a payment processor that handles the dirty work for them and just receive fiat on their end. So that means this trivially executable attack not only fucks up some of Microsoft's accounts, it also fucks over everyone who uses the same payment processor as well as the payment processor itself.
- sillysaurus3 9y agoThat would be an extremely expensive attack. You'd need tens of thousands to make a dent in a business account, and a business account would simply call up the exchange and tell them what happened.
- desdiv 9y ago>You'd need tens of thousands to make a dent in a business account I already made clear that the cost per attack per address is 1 Satoshi + transaction fees, which is around $1.5USD in today's network conditions. You only need to pull off one successful attack to taint an entire business account. >a business account would simply call up the exchange and tell them what happened And a drug dealer on a Silk Road clone can just call up the exchange and tell them that some strange bitcoins landed in their account and that they have no idea how it got there, but they sincerely hope that it won't affect the withdrawal of their other completely legitimate bitcoins.
- sillysaurus3 9y agoI thought it was pretty clear, but the proposal is to close accounts that receive a significant number of mixed coins. That "significant" part is important -- it varies per account. Obviously it needs to be high enough to fend off trolling, but low enough to fend off laundering. That's not a difficult proposition; it's equivalent to fraud detection that credit card companies employ.
- deleted 9y ago[deleted]
- patrickg_zill 9y agoActually I think that a tale from antiquity,covers what you want quite well. However, just who, exactly, will put the bell on the cat?