"enough time has passed that if banks were remotely receptive to the idea of digital cash, it would have caught on somewhere." Again, the way I understand it,

"enough time has passed that if banks were remotely receptive to the idea of digital cash, it would have caught on somewhere." Again, the way I understand it, the problem is not a lack of benefit but that the benefit is not sufficient to convince any bank to switch. Banks are very concerned about fraud; the problem is that they do not get enough fraud protection from digital cash to outweigh the cost, because they already have good fraud mitigation methods. Why switch to a car that gets one more mile per gallon of fuel, when the cost of doing so would not be recouperated for decades? "Offline transactions are vulnerable to double spends, but this is the case with every digital cash system." The difference is that a person can double-spend in Bitcoin over and over again, even if the double spending is detected at some point. In Chaum's design, a person who double-spends is eventually ejected from the system, and so a person can only double spend until the double-spent money makes its way back to the bank. A legal system is not strictly needed here; all it takes is the bank blacklisting cheaters. "this is what the SHA2/DSA parts of Bitcoin do. Nobody can forge transactions" One does not follow from the other. SHA2 is a (hopefully) secure hash function. DSA is a secure signature system. People might still be able to forge transactions, due to some other property of the Bitcoin protocol that composes poorly with DSA/SHA2. A transaction in Bitcoin is not merely a signed message; there is a protocol that is used to decide the validity of the transaction, and that protocol might be vulnerable to attack (and maybe vulnerable to attack as a result of using DSA, as opposed to some other signature system). Without a formal proof of security for the entire transaction protocol, it is hard to say. A simpler example might help to illustrate the point. Imagine a system for telling employees that they have been fired that works as follows: the boss signs and encrypts the letter "F" using his signing key and the target's encryption key. It may appear that forging a firing notification is hard, because the signature marks it as authentic and the encryption designates the target (i.e. if you cannot open the message, then you were not fired). However, it is possible for an employee who is fired to turn around and fire others by re-encrypting the message and signature -- which works even if the signature and encryption systems used are secure. (This issue has been studied in the past; see e.g. http://world.std.com/~dtd/sign_encrypt/sign_encrypt7.html http://world.std.com/~dtd/sign_encrypt/sign_encrypt7.html or http://eprint.iacr.org/2008/440 http://eprint.iacr.org/2008/440) "This is essentially a coordination problem (which database copy is authoritative?)," What does "authoritative" actually mean in the absence of an authority? Without a good definition, it is hard to actually say what a solution would have to look like. "the novel problem that Bitcoin solved." The fact that Tuesday's fork could happen is pretty strong evidence that Bitcoin is not really a solution to the problem (assuming we even know what the problem actually is). The fact that a double spending attack was made possible by the fork is a sign that Bitcoin is either (a) solving the wrong problem or (b) not solving the problem at all. Even if we limit ourselves to considering only Sybil attacks, Bitcoin does not truly solve the problem. Sybil attacks are still possible; the only difference is that now the attacker will need more CPU power (maybe; more sophisticated attacks are certainly conceivable). "Bitcoin went for something that can be algorithmically enforced" Except that it is not enforced (at least not under any well-understood definition of that word), it is based on this sort of thing: "staking its outcome on the belief that NSA-level computing would both not dwarf the rest of the network" In other words, it is assumed that the adversary could never accumulate as much computing power as all the Bitcoin users combined have accumulated. This is a pretty bad assumption to make, since it fails under any number of entirely plausible circumstances. NSA-level computing is a complete mystery to the outside world; maybe they are using computing technology nobody else has, that works substantially more efficiently. How do you know your adversary does not have such systems? Every so often, Bitcoin "miners" switch to some faster technology for that task; is an adversary who invents a new technology for this really so hard to believe? "double spends would be detected and could be somehow mitigated down the line" What exactly can be done to "mitigate" double spending in Bitcoin? There is no system for denying access to the network. An attacker who double-spends Bitcoin could keep coming back and could keep double-spending. In Chaum's system, double-spending carries the cost of losing one's access to the system; with Bitcoin, it carries no cost at all (one might just sell the equipment used for the attack, and so one only really needs sufficient capital or credit to procure the equipment in the first place).