5 ms·

IANAL but in the United States that would still be wire fraud because you interact with a network to move the bitcoin into a wallet you would control. You can d

IANAL but in the United States that would still be wire fraud because you interact with a network to move the bitcoin into a wallet you would control. You can disprove the other actions by looking at Bitcoin's distributed ledger but for certain transactions if they liquidate the coins it can be a great deal of work to figure out where the money went.

endisneigh 5y ago
How would you distinguish this "bad" behavior from the good? It seems inherently intractable without centralization.
- anamexis 5y ago
  How is it any different than determining if a credit card charge was fraudulent? Either way, someone "figured out a way" to extract funds.
  - endisneigh 5y ago
    Credit cards are centralized and it's trivial because of that.
    - anamexis 5y ago
      How is it trivial to determine if a charge was fraudulent? Fraudulent charges are made in the exact same way as genuine ones.
      - endisneigh 5y ago
        Depends on the nature of it - if the locale is different for example you can immediately reverse it and ask the vendor the fraudulent charge came from for details regarding the transaction and cross reference with the details about the owner of the card. However if you were using stolen cash it wouldn't really be possible. In this scenario the stolen private key and corresponding bitcoin is like stealing the cash. There's not really anyway to determine anything.
        anamexis 5y ago
        Maybe fraudulent wire transfers would be a better analogy, but I don't think this is fundamentally different than traditional banking. You determine if a charge was fraudulent by whether or not you authorized it.
        endisneigh 5y ago
        If you stole the private key how would you be able to determine who the original authorized user is? More simply: how can you distinguish someone who ceded their Bitcoin voluntarily to someone else vs someone who had it stolen from them with no centralized entities involved?
        anamexis 5y ago
        My point is that you distinguish it in the exact same way as you distinguish a charge from a cloned credit card, or a bank transfer with a stolen password, or cash swiped out of a wallet. In all cases, the fraudulent money is used in exactly the same way as genuine use. If you figure out a bitcoin private key, that doesn't give you any more right to the money than figuring out a way to guess someone's bank password. And remediation would be the same.
        endisneigh 5y ago
        You're not really answering the question. It's fundamentally easier to do it with cloned credit cards, or banks because they are centralized entities dealing with individuals with verified identities. Even if you had someone's bank password, what will you do with the money? Transfer it to another bank? If so the wire will be reversed. Why? Because you can call someone and tell them to do so and an investigation will be done, but you will be presumed to be innocent first. So again, with Bitcoin, with no centralized entities involved, how can you distinguish between someone ceding their bitcoin to someone else vs. it being stolen from them?
        anamexis 5y ago
    - zitterbewegung 5y ago
      I went to a presentation where Capital one has an anomaly detection system for credit card fraud that could process a transaction below 1ms or even lower than that. They had a system with around a Terabyte of memory using a streaming data system (I think it was spark). This is a nontrivial system that has false positives and negatives.
      - endisneigh 5y ago
        False positives or negatives don't really matter with credit card systems because you have recourse from the perspective of the end-user. Obviously Capital One incurs costs around such things and so they have complicated infrastructure developed, sure. However from the end user perspective: If you have a credit card and a fraudulent charge appears you call the credit card, they freeze the transaction, contact the vendor who may or may not be able to corroborate the legitimacy of the charge, and it's done. The alternative would be using cash, where it is not possible at all. So in comparison to the alternative, I do believe it's "trivial." That being said I regret using that word, I should've used "straightforward", instead.
        anamexis 5y ago
        The merchant is also an end user, and they lose the money.
- zitterbewegung 5y ago
  How do you think they traced Ross Ulbricht? You do actual detective work to figure out who did the transactions and then you can work backwards to who the coins belong to. Same with MT.Gox the stolen bitcoin is being given to the people who had the original accounts. Bitcoin is largely anonymous not because of its encryption but basically security to obscurity because that since every transaction is on one central ledger.
  - endisneigh 5y ago
    With Ross, he didn't steal private keys, did he? And with Mt.Gox it was only possible due to it involving a centralized entity, which is my point to begin with.
    - zitterbewegung 5y ago
      Yes but Ross had really poor operational security. He reused identities across stack overflow. If you want to prove that someone had a private key stolen and had poor operational security what this hypothetical person could do is as follows. 1. Takes the private key of the person in question. 2. Immediately sends an email to a fence or just sends the BTC to an exchange. 3. Takes the money. In a court case you could claim the following: The user that got their private keys stolen has record of a file containing a private key that they own which is older than the other user and has done at least one purchase with it. If the person who stole your private key has transactions that aren't older than the original owner that's how you could argue the case.

endisneigh 5y ago

How would you distinguish this "bad" behavior from the good? It seems inherently intractable without centralization.

anamexis 5y ago
How is it any different than determining if a credit card charge was fraudulent? Either way, someone "figured out a way" to extract funds.
- endisneigh 5y ago
  Credit cards are centralized and it's trivial because of that.
  - anamexis 5y ago
    How is it trivial to determine if a charge was fraudulent? Fraudulent charges are made in the exact same way as genuine ones.
    - endisneigh 5y ago
      Depends on the nature of it - if the locale is different for example you can immediately reverse it and ask the vendor the fraudulent charge came from for details regarding the transaction and cross reference with the details about the owner of the card. However if you were using stolen cash it wouldn't really be possible. In this scenario the stolen private key and corresponding bitcoin is like stealing the cash. There's not really anyway to determine anything.
      - anamexis 5y ago
        Maybe fraudulent wire transfers would be a better analogy, but I don't think this is fundamentally different than traditional banking. You determine if a charge was fraudulent by whether or not you authorized it.
        endisneigh 5y ago
        If you stole the private key how would you be able to determine who the original authorized user is? More simply: how can you distinguish someone who ceded their Bitcoin voluntarily to someone else vs someone who had it stolen from them with no centralized entities involved?
        anamexis 5y ago
        My point is that you distinguish it in the exact same way as you distinguish a charge from a cloned credit card, or a bank transfer with a stolen password, or cash swiped out of a wallet. In all cases, the fraudulent money is used in exactly the same way as genuine use. If you figure out a bitcoin private key, that doesn't give you any more right to the money than figuring out a way to guess someone's bank password. And remediation would be the same.
        endisneigh 5y ago
        You're not really answering the question. It's fundamentally easier to do it with cloned credit cards, or banks because they are centralized entities dealing with individuals with verified identities. Even if you had someone's bank password, what will you do with the money? Transfer it to another bank? If so the wire will be reversed. Why? Because you can call someone and tell them to do so and an investigation will be done, but you will be presumed to be innocent first. So again, with Bitcoin, with no centralized entities involved, how can you distinguish between someone ceding their bitcoin to someone else vs. it being stolen from them?
        anamexis 5y ago
  - zitterbewegung 5y ago
    I went to a presentation where Capital one has an anomaly detection system for credit card fraud that could process a transaction below 1ms or even lower than that. They had a system with around a Terabyte of memory using a streaming data system (I think it was spark). This is a nontrivial system that has false positives and negatives.
    - endisneigh 5y ago
      False positives or negatives don't really matter with credit card systems because you have recourse from the perspective of the end-user. Obviously Capital One incurs costs around such things and so they have complicated infrastructure developed, sure. However from the end user perspective: If you have a credit card and a fraudulent charge appears you call the credit card, they freeze the transaction, contact the vendor who may or may not be able to corroborate the legitimacy of the charge, and it's done. The alternative would be using cash, where it is not possible at all. So in comparison to the alternative, I do believe it's "trivial." That being said I regret using that word, I should've used "straightforward", instead.
      - anamexis 5y ago
        The merchant is also an end user, and they lose the money.
zitterbewegung 5y ago
How do you think they traced Ross Ulbricht? You do actual detective work to figure out who did the transactions and then you can work backwards to who the coins belong to. Same with MT.Gox the stolen bitcoin is being given to the people who had the original accounts. Bitcoin is largely anonymous not because of its encryption but basically security to obscurity because that since every transaction is on one central ledger.
- endisneigh 5y ago
  With Ross, he didn't steal private keys, did he? And with Mt.Gox it was only possible due to it involving a centralized entity, which is my point to begin with.
  - zitterbewegung 5y ago
    Yes but Ross had really poor operational security. He reused identities across stack overflow. If you want to prove that someone had a private key stolen and had poor operational security what this hypothetical person could do is as follows. 1. Takes the private key of the person in question. 2. Immediately sends an email to a fence or just sends the BTC to an exchange. 3. Takes the money. In a court case you could claim the following: The user that got their private keys stolen has record of a file containing a private key that they own which is older than the other user and has done at least one purchase with it. If the person who stole your private key has transactions that aren't older than the original owner that's how you could argue the case.