3 ms·

I think your premise is fundamentally wrong there. Say I buy something my credit card but it's never delivered. My bank will reverse that transaction - exactly

I think your premise is fundamentally wrong there. Say I buy something my credit card but it's never delivered. My bank will reverse that transaction - exactly because half of the transaction never occurred. The way that the credit card system works in the US is fundamentally biased towards consumer protection, because that's an explicit policy objective. The same with the Direct Debit guarantee in the UK, or the various laws which limit the maximum exposure due to fraudulent use of payment cards. And when exchanges break trades, they undo the entire transaction - you don't end up with one party out cash or shares.

__MatrixMan__ 5y ago
The lack of agility shows up when I buy something with your credit card number. It gets delivered, and then the bank reverses the transaction because they later learn that I'm not you. Now I get a bank-subsidized thing and you're not missing any money. It creates a drag on the whole economy, because instead of doing productive work to get the thing, it's often easier to play games with the system. The fact that credit cards use a symmetric key to authorize spend is a glaring flaw. The technology to fix it (asymmetric key cryptography) has been around for decades. But instead of fixing it, the credit card companies just keep writing off the instances of fraud.
- NovemberWhiskey 5y ago
  In the situation you describe, the one who is "out" is the merchant. In the card-not-present situation, the merchant has the option to use tools like CVV and address validation to reduce the risk in the transaction, and always has the option to decline a transaction that seems risky. That seems, to me, like a sensible risk balancing approach. In the cryptocurrency "all sales are final" world - you're the loser. I don't really see that the economic drag is larger one way or the other. AFAIK the use of symmetric key cryptography in card capture and payment processing is not in any way a significant factor in payment card fraud - where do you get that information from?
  - __MatrixMan__ 5y ago
    Whether it's the merchant or the bank that's left holding the bag often depends on the particulars like whether it was a chip or a magstripe transaction, but the larger point is that in card-not-present scenarios you can't pay once without also exposing secrets that allow whoever gets them to make subsequent transactions without your permission. Better would be to have whatever secret authorizes spend (private key) be separate from the account identifier (public key) and to push money, rather than sharing a symmetric secret which authorizes whoever has it to pull money.

__MatrixMan__ 5y ago

The lack of agility shows up when I buy something with your credit card number. It gets delivered, and then the bank reverses the transaction because they later learn that I'm not you. Now I get a bank-subsidized thing and you're not missing any money. It creates a drag on the whole economy, because instead of doing productive work to get the thing, it's often easier to play games with the system. The fact that credit cards use a symmetric key to authorize spend is a glaring flaw. The technology to fix it (asymmetric key cryptography) has been around for decades. But instead of fixing it, the credit card companies just keep writing off the instances of fraud.

NovemberWhiskey 5y ago
In the situation you describe, the one who is "out" is the merchant. In the card-not-present situation, the merchant has the option to use tools like CVV and address validation to reduce the risk in the transaction, and always has the option to decline a transaction that seems risky. That seems, to me, like a sensible risk balancing approach. In the cryptocurrency "all sales are final" world - you're the loser. I don't really see that the economic drag is larger one way or the other. AFAIK the use of symmetric key cryptography in card capture and payment processing is not in any way a significant factor in payment card fraud - where do you get that information from?
- __MatrixMan__ 5y ago
  Whether it's the merchant or the bank that's left holding the bag often depends on the particulars like whether it was a chip or a magstripe transaction, but the larger point is that in card-not-present scenarios you can't pay once without also exposing secrets that allow whoever gets them to make subsequent transactions without your permission. Better would be to have whatever secret authorizes spend (private key) be separate from the account identifier (public key) and to push money, rather than sharing a symmetric secret which authorizes whoever has it to pull money.