3 ms·

Given that double spends are reasonably expensive, you could just use zero confirmations for anything under 25BTC and the standard six confirmations for the res

by nwh 14y ago

Given that double spends are reasonably expensive, you could just use zero confirmations for anything under 25BTC and the standard six confirmations for the rest. If you double spent a transaction under 25BTC, you would have been better off just mining a block yourself. I'm sure anyone spending more than $750 on amazon is probably happy enough waiting for two or more confirmations.

betterunix 14y ago
"I'm sure anyone spending more than $750 on amazon is probably happy enough waiting for two or more confirmations." Maybe, but if I can do it without waiting by just sticking with credit cards, why wouldn't I? "Given that double spends are reasonably expensive" I see this being tossed around quite a bit. I am not entirely sure where this idea came from. Can you prove it, the way that ECDSA (on which Bitcoin is based) can be proved secure as a signature system? When I hear this sort of statement, it sounds a lot like, "Nobody has published any way to double spend cheaply, and I cannot think of one; therefore it must be an expensive thing to do!" I do not mean to be insulting with that, I really would like to know why people think double spending attacks are necessarily expensive. On top of that, how do we know that a double spending attack would be more expensive than the payoff -- especially when you are dealing with a complex marketplace, where a double spending attack may be just one component of a larger scheme. Maybe the point will just be to deny another person the ability to buy something, by double-spending until the merchant is sold out of the item, or as shills in an auction to try to inflate the price (should Amazon revive its auctions system). This reminds me of the sort of argument I had with Hushmail users back before the infamous DEA incident. Your secret key is sitting there, on their servers; they could read your mail if they wanted to or if someone had a gun to their head. People said it couldn't happen, that the key would only be in RAM for a split second, that using their Java applet solved the problem, etc. Then the DEA turned up in court with a mountain of decrypted email from Hushmail (and then, as if the entire world just wanted to aggravate me, people starting saying that PGP had security problems). Cryptography tends to be black-and-white when it comes to security: you are either secure, or you are not secure, and there is rarely anything in-between (with multiparty computation, that might be changing; people are now talking about the "covert model" and "one-bit leakage" notions of security, which are in that middle area).
- nwh 14y ago
  As dustcoin pointed out, credit cards are charged when the item shipped. Waiting for confirmations isn't an issue. > Can you prove it, the way that ECDSA (on which Bitcoin is based) can be proved secure as a signature system? I'm not experienced in any form of crypto, so not personally, no.
- Anderkent 14y ago
  Maybe, but if I can do it without waiting by just sticking with credit cards, why wouldn't I? How can you? If a credit card transaction can be charged back, it effectively never clears (or doesn't clear as long as the chargeback is possible, if there's a time limit on chargeback). So in any situation where you would be willing to take a possibly chargeback-able, you should be willing to take an unconfirmed bitcoin. "Nobody has published any way to double spend cheaply, and I cannot think of one; therefore it must be an expensive thing to do!" The fact that nobody published a cheap way to double spend is strong evidence that it's difficult and expensive to double spend. Also it doesn't really matter if there is some obscure method to cheaply double spend, since because of its obscurity it would only affect a small number of transactions (and presumably once it is used it will be detected and made public, at which point it can be fixed).
  - betterunix 14y ago
    "The fact that nobody published a cheap way to double spend is strong evidence that it's difficult and expensive to double spend." Nonsense. Bitcoin is only a few years old. It is not nearly well-studied enough to claim that there is any good evidence that double spending is costly. Keep in mind that in the first few years of RSA, people thought that 128 bit public keys would be sufficient for centuries. Bitcoin has not received anything close to the attention RSA received from the research community, or even that attention given newer ciphers like AES. "Also it doesn't really matter if there is some obscure method to cheaply double spend" That is kind of like saying, "It does not really matter if there is some obscure method to crack RSA quickly." "since because of its obscurity it would only affect a small number of transactions (and presumably once it is used it will be detected and made public, at which point it can be fixed)." Or it might turn out that there is no fix and that the attack would work no matter what you did to Bitcoin. Maybe not confirming transactions is an inherently insecure way to do business. It is equally possible that cheap double spending attacks are impossible due to some property of Bitcoin. Right now there is no clear answer; you just have to shrug and hope for the best if you neglect to wait for confirmations.

by nwh 14y ago

betterunix 14y ago

"I'm sure anyone spending more than $750 on amazon is probably happy enough waiting for two or more confirmations." Maybe, but if I can do it without waiting by just sticking with credit cards, why wouldn't I? "Given that double spends are reasonably expensive" I see this being tossed around quite a bit. I am not entirely sure where this idea came from. Can you prove it, the way that ECDSA (on which Bitcoin is based) can be proved secure as a signature system? When I hear this sort of statement, it sounds a lot like, "Nobody has published any way to double spend cheaply, and I cannot think of one; therefore it must be an expensive thing to do!" I do not mean to be insulting with that, I really would like to know why people think double spending attacks are necessarily expensive. On top of that, how do we know that a double spending attack would be more expensive than the payoff -- especially when you are dealing with a complex marketplace, where a double spending attack may be just one component of a larger scheme. Maybe the point will just be to deny another person the ability to buy something, by double-spending until the merchant is sold out of the item, or as shills in an auction to try to inflate the price (should Amazon revive its auctions system). This reminds me of the sort of argument I had with Hushmail users back before the infamous DEA incident. Your secret key is sitting there, on their servers; they could read your mail if they wanted to or if someone had a gun to their head. People said it couldn't happen, that the key would only be in RAM for a split second, that using their Java applet solved the problem, etc. Then the DEA turned up in court with a mountain of decrypted email from Hushmail (and then, as if the entire world just wanted to aggravate me, people starting saying that PGP had security problems). Cryptography tends to be black-and-white when it comes to security: you are either secure, or you are not secure, and there is rarely anything in-between (with multiparty computation, that might be changing; people are now talking about the "covert model" and "one-bit leakage" notions of security, which are in that middle area).

nwh 14y ago
As dustcoin pointed out, credit cards are charged when the item shipped. Waiting for confirmations isn't an issue. > Can you prove it, the way that ECDSA (on which Bitcoin is based) can be proved secure as a signature system? I'm not experienced in any form of crypto, so not personally, no.
Anderkent 14y ago
Maybe, but if I can do it without waiting by just sticking with credit cards, why wouldn't I? How can you? If a credit card transaction can be charged back, it effectively never clears (or doesn't clear as long as the chargeback is possible, if there's a time limit on chargeback). So in any situation where you would be willing to take a possibly chargeback-able, you should be willing to take an unconfirmed bitcoin. "Nobody has published any way to double spend cheaply, and I cannot think of one; therefore it must be an expensive thing to do!" The fact that nobody published a cheap way to double spend is strong evidence that it's difficult and expensive to double spend. Also it doesn't really matter if there is some obscure method to cheaply double spend, since because of its obscurity it would only affect a small number of transactions (and presumably once it is used it will be detected and made public, at which point it can be fixed).
- betterunix 14y ago
  "The fact that nobody published a cheap way to double spend is strong evidence that it's difficult and expensive to double spend." Nonsense. Bitcoin is only a few years old. It is not nearly well-studied enough to claim that there is any good evidence that double spending is costly. Keep in mind that in the first few years of RSA, people thought that 128 bit public keys would be sufficient for centuries. Bitcoin has not received anything close to the attention RSA received from the research community, or even that attention given newer ciphers like AES. "Also it doesn't really matter if there is some obscure method to cheaply double spend" That is kind of like saying, "It does not really matter if there is some obscure method to crack RSA quickly." "since because of its obscurity it would only affect a small number of transactions (and presumably once it is used it will be detected and made public, at which point it can be fixed)." Or it might turn out that there is no fix and that the attack would work no matter what you did to Bitcoin. Maybe not confirming transactions is an inherently insecure way to do business. It is equally possible that cheap double spending attacks are impossible due to some property of Bitcoin. Right now there is no clear answer; you just have to shrug and hope for the best if you neglect to wait for confirmations.