5 ms·

Generally you can accept transactions with zero confirmations without a huge issue. For someone like Amazon the small loss you might make from a couple of doubl

by nwh 14y ago

Generally you can accept transactions with zero confirmations without a huge issue. For someone like Amazon the small loss you might make from a couple of double-spends is outweighed by the almost instantaneous transaction. In an ideal circumstance, you'd average five minutes for a confirmation anyway. Blocks are usually generated every 10 minutes or so.

betterunix 14y ago
I think you are underestimating the number of double-spend attacks that a business like Amazon would face if they never waited for confirmation. Amazon has plenty of problems with fraud right now; this would just be another way for people to commit fraud. It is not just the losses, either; Amazon could reverse transactions once the double spending is detecting, but they have to worry about their reputation. The last thing they need is to be known as the website for people trying to cheat. Also, "ideal circumstances" do not happen in the real world. IF you want to convince Amazon to adopt Bitcoin, you need to impress them with typical and realistic circumstances.
- ewillbefull 14y ago
  Amazon could always just wait for confirmations if the order is large enough. Double-spends cost a lot to pull off. So if you're doing a large transaction, you're going to want it "settled" in the blockchain for about an hour.
  - betterunix 14y ago
    I think the result of that would be relegating Bitcoin to small orders. Even then, Amazon would probably still face non-trivial problems with double-spending schemes where someone tries to engage in large numbers of very small transactions as part of some larger fraud. The problem here is that neither you nor I can envision every possible way to exploit Amazon failing to confirm transactions of any size.
- nwh 14y ago
  Given that double spends are reasonably expensive, you could just use zero confirmations for anything under 25BTC and the standard six confirmations for the rest. If you double spent a transaction under 25BTC, you would have been better off just mining a block yourself. I'm sure anyone spending more than $750 on amazon is probably happy enough waiting for two or more confirmations.
  - betterunix 14y ago
    "I'm sure anyone spending more than $750 on amazon is probably happy enough waiting for two or more confirmations." Maybe, but if I can do it without waiting by just sticking with credit cards, why wouldn't I? "Given that double spends are reasonably expensive" I see this being tossed around quite a bit. I am not entirely sure where this idea came from. Can you prove it, the way that ECDSA (on which Bitcoin is based) can be proved secure as a signature system? When I hear this sort of statement, it sounds a lot like, "Nobody has published any way to double spend cheaply, and I cannot think of one; therefore it must be an expensive thing to do!" I do not mean to be insulting with that, I really would like to know why people think double spending attacks are necessarily expensive. On top of that, how do we know that a double spending attack would be more expensive than the payoff -- especially when you are dealing with a complex marketplace, where a double spending attack may be just one component of a larger scheme. Maybe the point will just be to deny another person the ability to buy something, by double-spending until the merchant is sold out of the item, or as shills in an auction to try to inflate the price (should Amazon revive its auctions system). This reminds me of the sort of argument I had with Hushmail users back before the infamous DEA incident. Your secret key is sitting there, on their servers; they could read your mail if they wanted to or if someone had a gun to their head. People said it couldn't happen, that the key would only be in RAM for a split second, that using their Java applet solved the problem, etc. Then the DEA turned up in court with a mountain of decrypted email from Hushmail (and then, as if the entire world just wanted to aggravate me, people starting saying that PGP had security problems). Cryptography tends to be black-and-white when it comes to security: you are either secure, or you are not secure, and there is rarely anything in-between (with multiparty computation, that might be changing; people are now talking about the "covert model" and "one-bit leakage" notions of security, which are in that middle area).
- Anderkent 14y ago
  I think you are underestimating the number of double-spend attacks that a business like Amazon would face if they never waited for confirmation A double-spend is costly, a chargeback has no cost. One would think the number of double-spend frauds would be lower than chargeback frauds simply because these are more difficult.
dustcoin 14y ago
Amazon charges customers' credit cards when the item ships, not when the order is placed. There is plenty of time to get a few confirmations in before shipping as Amazon doesn't ship instantly after an order is placed.

by nwh 14y ago

betterunix 14y ago

I think you are underestimating the number of double-spend attacks that a business like Amazon would face if they never waited for confirmation. Amazon has plenty of problems with fraud right now; this would just be another way for people to commit fraud. It is not just the losses, either; Amazon could reverse transactions once the double spending is detecting, but they have to worry about their reputation. The last thing they need is to be known as the website for people trying to cheat. Also, "ideal circumstances" do not happen in the real world. IF you want to convince Amazon to adopt Bitcoin, you need to impress them with typical and realistic circumstances.

ewillbefull 14y ago
Amazon could always just wait for confirmations if the order is large enough. Double-spends cost a lot to pull off. So if you're doing a large transaction, you're going to want it "settled" in the blockchain for about an hour.
- betterunix 14y ago
  I think the result of that would be relegating Bitcoin to small orders. Even then, Amazon would probably still face non-trivial problems with double-spending schemes where someone tries to engage in large numbers of very small transactions as part of some larger fraud. The problem here is that neither you nor I can envision every possible way to exploit Amazon failing to confirm transactions of any size.
nwh 14y ago
Given that double spends are reasonably expensive, you could just use zero confirmations for anything under 25BTC and the standard six confirmations for the rest. If you double spent a transaction under 25BTC, you would have been better off just mining a block yourself. I'm sure anyone spending more than $750 on amazon is probably happy enough waiting for two or more confirmations.
- betterunix 14y ago
  "I'm sure anyone spending more than $750 on amazon is probably happy enough waiting for two or more confirmations." Maybe, but if I can do it without waiting by just sticking with credit cards, why wouldn't I? "Given that double spends are reasonably expensive" I see this being tossed around quite a bit. I am not entirely sure where this idea came from. Can you prove it, the way that ECDSA (on which Bitcoin is based) can be proved secure as a signature system? When I hear this sort of statement, it sounds a lot like, "Nobody has published any way to double spend cheaply, and I cannot think of one; therefore it must be an expensive thing to do!" I do not mean to be insulting with that, I really would like to know why people think double spending attacks are necessarily expensive. On top of that, how do we know that a double spending attack would be more expensive than the payoff -- especially when you are dealing with a complex marketplace, where a double spending attack may be just one component of a larger scheme. Maybe the point will just be to deny another person the ability to buy something, by double-spending until the merchant is sold out of the item, or as shills in an auction to try to inflate the price (should Amazon revive its auctions system). This reminds me of the sort of argument I had with Hushmail users back before the infamous DEA incident. Your secret key is sitting there, on their servers; they could read your mail if they wanted to or if someone had a gun to their head. People said it couldn't happen, that the key would only be in RAM for a split second, that using their Java applet solved the problem, etc. Then the DEA turned up in court with a mountain of decrypted email from Hushmail (and then, as if the entire world just wanted to aggravate me, people starting saying that PGP had security problems). Cryptography tends to be black-and-white when it comes to security: you are either secure, or you are not secure, and there is rarely anything in-between (with multiparty computation, that might be changing; people are now talking about the "covert model" and "one-bit leakage" notions of security, which are in that middle area).
Anderkent 14y ago
I think you are underestimating the number of double-spend attacks that a business like Amazon would face if they never waited for confirmation A double-spend is costly, a chargeback has no cost. One would think the number of double-spend frauds would be lower than chargeback frauds simply because these are more difficult.

dustcoin 14y ago

Amazon charges customers' credit cards when the item ships, not when the order is placed. There is plenty of time to get a few confirmations in before shipping as Amazon doesn't ship instantly after an order is placed.