7 ms·

Namecheap now accepts Bitcoin with zero confirmations

123 points by ted0 13y ago

dllthomas 13y ago
This certainly seems to make more sense in a case like this - where deployment takes some time and the user is relying on continued service.
- rdl 13y ago
  Plus domain registrars get to roll back transactions over 14 days, I think.
  - duskwuff 13y ago
    I think the limit is shorter these days (more like 2 or 3 days), and there's a penalty for using it too often. Still plenty for these purposes, though.
    - subsystem 13y ago
      Five days as far as I know. http://www.icann.org/en/resources/registries/agp/agp-policy-17dec08-en.htm http://www.icann.org/en/resources/registries/agp/agp-policy-...
sehrope 13y ago
This is a perfect use case for zero confirmation transactions. Less friction for a legit customer and no real loss for the business if they need to roll back the transaction if it doesn't confirm. The only risk[1] I can see for Namecheap is the $.18 ICANN fee and that's assuming they're still on the hook for it if they cancel the registration. [1]: Besides currency conversion risk of Bitcoin -> USD of course.
- larrys 13y ago
  "Namecheap is the $.18 ICANN fee " Competitor to namecheap here. Nope not on the hook for either the ICANN fee or the registry fee if done w/i 5 days. Edit: for .com .org .net .info
gesman 13y ago
This could be done by everyone delivering service, rather than products.
- dllthomas 13y ago
  Not really. If it's a situation where having the service for a brief period of time is valuable, and which can be active before a double-spend would be detected, you'll probably see as much fraud as for a physical good of a similar value. On the flip side, requiring confirmations before physically shipping a product but not before beginning provisioning would likely be doable.
drcode 13y ago
"Explain it like I'm Five" All bitcoin transactions get written to a globally-shared ledger of transactions that is maintained by the bitcoin network. Roughly every ten minutes, a new page is added to the ledger that includes (most of) the latest transactions. When your bitcoin transaction is added to this ledger, it is called a "confirmation". Accepting bitcoins with "zero confirmations" means that namecheap doesn't wait ~10 minutes before accepting your payment. Instead, they accept your transaction as soon as it is widely broadcast over the network, which takes only about a second after you send your money. The danger, of course, is that the payment never makes it into this ledger, which basically means the transaction is invalidated, and the money "was never sent". This only happens in unusual circumstances (can't get into them all in this short explanation) and is only a small risk.
- dllthomas 13y ago
  I don't think many five-year-olds would understand that, but I appreciate the attempt.
- teej 13y ago
  Isn't this exploitable by forging a transaction? The way I thought the ecosystem worked was that bitcoin mining verified the authenticity of transactions of the page, thus creating the "confirmation". Couldn't a malicious party create a fraudulent transaction to namecheap if they aren't verifying that it's real?
  - drcode 13y ago
    This is complicated to answer in detail, but the short answer is "It is easier to make gold out of lead than forge a bitcoin transaction." Not sure where that quote originally came from.
    - brazzy 13y ago
      And of course that's wrong.
      - 13y ago
geuis 13y ago
I'd love to hear more about the decision trade off they made. On the one hand, you want to have a minimum of at least a handful of confirmations to verify that the btc aren't being double-spent. This means a delay of several minutes or longer. Alternatively, you can accept on faith with zero-confirmations that the btc is legit. In this case, it sounds like Namecheap decided the ease of use is economically more valuable than the threat of being cheated. I like this line of thinking. Further, it could be that it's not really a risk for Namecheap, because they can reverse a domain name purchase afterwards if the btc payment is fraudulent.
- drcode 13y ago
  The latest I've heard is that an extremely sophisticated hacker can roll back* a zero confirmation transaction in about one third of attempts... so long term such a hacker could manage a 33% discount on purchases. *Via a double spend attack with careful selection of peer connections and precise timing
  - dllthomas 13y ago
    But even if that's the case, when the double spend is spotted the service can be canceled, which in this case seems likely to be before service is started anyway.
    - drcode 13y ago
      Yes, of course... I was just giving the "maximum ceiling" for the risk. There are many mitigation strategies at several points in the process that can lower this risk significantly.
      - dllthomas 13y ago
        A useful point of reference, to be sure.
  - nadaviv 13y ago
    I wouldn't usually worry about accepting zero confirmation transactions on a website. Most digital orders are reversible and physical orders take some time to process (packaging, shipping, etc). However, with brick and mortar stores, 0-confirmations transactions are much more problematic for the business. The customer could be long gone with your product by the time you notice the double-spend. OTOH, the 10 minutes delay is also much more problematic for the customer with physical stores (imagine a customer having to wait for 10 minutes to buy a pack of gum). One interesting solution for making zero-confirmations safer to accept is fidelity bonds [1], where you would "sacrifice" some Bitcoins from your address, a sort of "safe deposit" that you never get back. From that point on, until that address is seen to commit a double-spend, merchants can accept zero-confirmation payments from it knowing that attempting to double-spend would make the customer's initial deposit invalidated. As long as the deposit is larger than the transaction amount, it'll make double-spending unprofitable. Edit: Another interesting aspect is that fidelity bonds can also be used to make other kinds of fraud unprofitable, not only double-spending. However, while its easy to determine when a user committed a double-spend attack (just show two signed transactions paying the same coins to two different places), its not that straight forward to prove other kinds of fraud. [1] https://en.bitcoin.it/wiki/Fidelity_bonds#Financial_Services https://en.bitcoin.it/wiki/Fidelity_bonds#Financial_Services
mikemoka 13y ago
Could the raise of anonymous and distributed services using bitcoin be the answer of people exasperated by government surveillance?
- drcode 13y ago
  Bitcoin, from its inception, has had deep ties with radical libertarianism. Suspicion of the government is the raison d'être of bitcoin. (though of course the software itself is completely ideologically neutral)
VMG 13y ago
Nice to read this. The experience with paying with BTC last time I tried is was less than pleasant - I had to wait about an hour until the funds appeared.
- drcode 13y ago
  I hate to disappoint you, but the main stream user experience of bitcoin remains a clusterfk. Things are slowly improving though (new payment protocol, hardware wallets, zero-conf transactions, lightweight wallets, deterministic wallets, etc.)
- nrb 13y ago
  This depends on the client. The reference client will not display the funds as available until it reaches 6 confirmations (~60 minutes) but the coins are theoretically available to spend as soon as your client knows about them, it's just a matter of using a client that allows you to do so, and also making sure that the network knows that you have coins in the address you specified as an input before you try to spend them yourself.
jotm 13y ago
Who actually uses bitcoins and what for? Last time I checked, I couldn't buy bitcoins with my Paypal account or credit card. The only way I see it being useful is if I get paid for some hacking job or botnet (then spend the money on Namecheap domain and hosting :-)... What am I missing?
- wmf 13y ago
  If you're a serious speculator then you can figure out how to buy BTC with an ACH or wire transfer. Also, I suspect a lot of miners are looking for ways to spend their BTC.
  - jotm 13y ago
    I just see that more and more people adopt bitcoin, that it's anonymous, distributed and secure, and it's been described as the next best thing since banknotes - I just can't see the usefulness...
    - Amadou 13y ago
      Do you use cash in real life to avoid telling companies what you spend, where you spent and what you spent it on? If your answer is no, then you probably won't find much value in doing the same online with bitcoins.
      - jotm 13y ago
        Nope... but I also never deposited the cash I earned under the table :-)
    - yen223 13y ago
      While most people want Bitcoin to replace the US dollar, I think that as a secure, decentralized payment method, it's more useful as an alternative to Paypal. Like everything else, it's usefulness is tied to the number of people who adopt it.
- drcode 13y ago
plg 13y ago
they don't need confirmation, they can find you without it if they need to (and so can the NSA)
kyledrake 13y ago
As an interesting note, I used the free Namecheap domain coupon I got at the Bitcoin conference to register NeoCities.org. Thanks guys! Great service, highly recommended.
- lowglow 13y ago
  Wait! I didn't see this in my bag from the bitcoin conference! Argh...
  - ted0 13y ago
    drop me a line and i'll make sure to hook you up! ted@namecheap.com
untothebreach 13y ago
Funny this got to the front page today - this morning I bought a domain name from namecheap. First I tried to use my credit card. It was denied, for no apparent reason as I keep it paid off. Then I used my debit card, and it went through. However, later today BOTH my cards were temporarily suspended, and I had to wait on hold twice to verify that, yes, I did authorize a payment to namecheap.com. Nothing else in my recent purchase history was out of the ordinary, which makes me think that namecheap.com is just one of those entities that the Cc companies have flagged.
- bdonlan 13y ago
  Sounds like the first denial was due to an automated fraud check with a false positive. When that happens, it's a good idea to call your credit card company right away - if it was such a fraud check, they can usually reactivate it right away and whitelist the merchant you tried to buy from, allowing you to retry the transaction - and more importantly, ensuring that your card isn't suspended and later declined again at an inopportune time.
RKearney 13y ago
After Namecheap shut down imgur by changing their nameservers without the owners consent, I'm wary to give them another shot.
- jafaku 13y ago
  Why did they do that?
  - deleted 13y ago
    [deleted]
  - RKearney 13y ago
    https://news.ycombinator.com/item?id=5276648 https://news.ycombinator.com/item?id=5276648 Long story short it was alleged there was child pornography hosted on imgur. Namecheap took it upon themselves to "Block the domain for abuse" because the owner of the domain didn't reply in a time frame Namecheap deemed appropriate. Since Namecheap neither hosts, nor transmits any of the content on Imgur, it was very troublesome to hear they would shut down someones domain by their own hand, with no involvement, nor request from law enforcement. > I'm the CEO of Namecheap here. Just want to let you all know > that I am personally looking into this. The domain was taken > down by an overzealous abuse team member who had no knowledge > of who imgur was. Although we did send 6 separate emails over > the last week, it should have still been escalated. I am > reviewing our policy to see how we can avoid this type of > situation further in the future. To the folks at IMGUR, I want > to sincerely apologize for this situation and the extreme > inconvenience this has caused you. If you can connect me with > someone in your company. I'd like to give you a personal call > and discuss the matter further. > > -Rick Kirkendall - CEO I just don't feel comfortable leaving my domain name in the hands a lone abuse department team member that can evidentially change any domains nameservers without any approval or oversight. Additionally, the new nameservers Namecheap picked had a 48 hour TTL, meaning the website was potentially down for 2 days for some people.
    - mseebach 13y ago
      You're holding them to an unreasonable standard here, IMO. They've got "cheap" in their name - you can't have your cake (dirt cheap product) and eat it too (perfect service and procedures). The profound apology and promise of fixing the procedure is already above and beyond what anyone (again, IMO) has a right to expect from a vendor of a $4 product.
ticklishconcept 13y ago
Maybe I'm missing something, but I do not believe there is a possibility of a double spend with the way NameCheap has setup their payment. To pay with Bitcoin, you have to send BTC to your Namecheap account (which is done through BitPay), and wait for 6 confirmations (1 hour). They say "Funds will be added to your account within one hour after payment is confirmed. On very rare occasions, it may take up to 24 hours for the funds to be credited." After that point, you can buy domain names with zero confirmations, but there is no risk at this point, because it is Namecheap account credit.
- drcode 13y ago
  If you were right, then that would not be an example of zero confirmations. I suspect you found old text that they need to update.
  - ticklishconcept 13y ago
    I just bought a domain on namecheap.com with Bitcoin to test it out, and I had to wait an hour for the confirmation.

123 points by ted0 13y ago

This certainly seems to make more sense in a case like this - where deployment takes some time and the user is relying on continued service.

rdl 13y ago
Plus domain registrars get to roll back transactions over 14 days, I think.
- duskwuff 13y ago
  I think the limit is shorter these days (more like 2 or 3 days), and there's a penalty for using it too often. Still plenty for these purposes, though.
  - subsystem 13y ago
    Five days as far as I know. http://www.icann.org/en/resources/registries/agp/agp-policy-17dec08-en.htm http://www.icann.org/en/resources/registries/agp/agp-policy-...

sehrope 13y ago

This is a perfect use case for zero confirmation transactions. Less friction for a legit customer and no real loss for the business if they need to roll back the transaction if it doesn't confirm. The only risk[1] I can see for Namecheap is the $.18 ICANN fee and that's assuming they're still on the hook for it if they cancel the registration. [1]: Besides currency conversion risk of Bitcoin -> USD of course.

larrys 13y ago
"Namecheap is the $.18 ICANN fee " Competitor to namecheap here. Nope not on the hook for either the ICANN fee or the registry fee if done w/i 5 days. Edit: for .com .org .net .info

gesman 13y ago

This could be done by everyone delivering service, rather than products.

dllthomas 13y ago
Not really. If it's a situation where having the service for a brief period of time is valuable, and which can be active before a double-spend would be detected, you'll probably see as much fraud as for a physical good of a similar value. On the flip side, requiring confirmations before physically shipping a product but not before beginning provisioning would likely be doable.

drcode 13y ago

"Explain it like I'm Five" All bitcoin transactions get written to a globally-shared ledger of transactions that is maintained by the bitcoin network. Roughly every ten minutes, a new page is added to the ledger that includes (most of) the latest transactions. When your bitcoin transaction is added to this ledger, it is called a "confirmation". Accepting bitcoins with "zero confirmations" means that namecheap doesn't wait ~10 minutes before accepting your payment. Instead, they accept your transaction as soon as it is widely broadcast over the network, which takes only about a second after you send your money. The danger, of course, is that the payment never makes it into this ledger, which basically means the transaction is invalidated, and the money "was never sent". This only happens in unusual circumstances (can't get into them all in this short explanation) and is only a small risk.

dllthomas 13y ago
I don't think many five-year-olds would understand that, but I appreciate the attempt.
teej 13y ago
Isn't this exploitable by forging a transaction? The way I thought the ecosystem worked was that bitcoin mining verified the authenticity of transactions of the page, thus creating the "confirmation". Couldn't a malicious party create a fraudulent transaction to namecheap if they aren't verifying that it's real?
- drcode 13y ago
  This is complicated to answer in detail, but the short answer is "It is easier to make gold out of lead than forge a bitcoin transaction." Not sure where that quote originally came from.
  - brazzy 13y ago
    And of course that's wrong.
    - 13y ago

geuis 13y ago

I'd love to hear more about the decision trade off they made. On the one hand, you want to have a minimum of at least a handful of confirmations to verify that the btc aren't being double-spent. This means a delay of several minutes or longer. Alternatively, you can accept on faith with zero-confirmations that the btc is legit. In this case, it sounds like Namecheap decided the ease of use is economically more valuable than the threat of being cheated. I like this line of thinking. Further, it could be that it's not really a risk for Namecheap, because they can reverse a domain name purchase afterwards if the btc payment is fraudulent.

drcode 13y ago
The latest I've heard is that an extremely sophisticated hacker can roll back* a zero confirmation transaction in about one third of attempts... so long term such a hacker could manage a 33% discount on purchases. *Via a double spend attack with careful selection of peer connections and precise timing
- dllthomas 13y ago
  But even if that's the case, when the double spend is spotted the service can be canceled, which in this case seems likely to be before service is started anyway.
  - drcode 13y ago
    Yes, of course... I was just giving the "maximum ceiling" for the risk. There are many mitigation strategies at several points in the process that can lower this risk significantly.
    - dllthomas 13y ago
      A useful point of reference, to be sure.
- nadaviv 13y ago
  I wouldn't usually worry about accepting zero confirmation transactions on a website. Most digital orders are reversible and physical orders take some time to process (packaging, shipping, etc). However, with brick and mortar stores, 0-confirmations transactions are much more problematic for the business. The customer could be long gone with your product by the time you notice the double-spend. OTOH, the 10 minutes delay is also much more problematic for the customer with physical stores (imagine a customer having to wait for 10 minutes to buy a pack of gum). One interesting solution for making zero-confirmations safer to accept is fidelity bonds [1], where you would "sacrifice" some Bitcoins from your address, a sort of "safe deposit" that you never get back. From that point on, until that address is seen to commit a double-spend, merchants can accept zero-confirmation payments from it knowing that attempting to double-spend would make the customer's initial deposit invalidated. As long as the deposit is larger than the transaction amount, it'll make double-spending unprofitable. Edit: Another interesting aspect is that fidelity bonds can also be used to make other kinds of fraud unprofitable, not only double-spending. However, while its easy to determine when a user committed a double-spend attack (just show two signed transactions paying the same coins to two different places), its not that straight forward to prove other kinds of fraud. [1] https://en.bitcoin.it/wiki/Fidelity_bonds#Financial_Services https://en.bitcoin.it/wiki/Fidelity_bonds#Financial_Services

mikemoka 13y ago

Could the raise of anonymous and distributed services using bitcoin be the answer of people exasperated by government surveillance?

drcode 13y ago
Bitcoin, from its inception, has had deep ties with radical libertarianism. Suspicion of the government is the raison d'être of bitcoin. (though of course the software itself is completely ideologically neutral)

VMG 13y ago

Nice to read this. The experience with paying with BTC last time I tried is was less than pleasant - I had to wait about an hour until the funds appeared.

drcode 13y ago
I hate to disappoint you, but the main stream user experience of bitcoin remains a clusterfk. Things are slowly improving though (new payment protocol, hardware wallets, zero-conf transactions, lightweight wallets, deterministic wallets, etc.)
nrb 13y ago
This depends on the client. The reference client will not display the funds as available until it reaches 6 confirmations (~60 minutes) but the coins are theoretically available to spend as soon as your client knows about them, it's just a matter of using a client that allows you to do so, and also making sure that the network knows that you have coins in the address you specified as an input before you try to spend them yourself.

jotm 13y ago

Who actually uses bitcoins and what for? Last time I checked, I couldn't buy bitcoins with my Paypal account or credit card. The only way I see it being useful is if I get paid for some hacking job or botnet (then spend the money on Namecheap domain and hosting :-)... What am I missing?

wmf 13y ago
If you're a serious speculator then you can figure out how to buy BTC with an ACH or wire transfer. Also, I suspect a lot of miners are looking for ways to spend their BTC.
- jotm 13y ago
  I just see that more and more people adopt bitcoin, that it's anonymous, distributed and secure, and it's been described as the next best thing since banknotes - I just can't see the usefulness...
  - Amadou 13y ago
    Do you use cash in real life to avoid telling companies what you spend, where you spent and what you spent it on? If your answer is no, then you probably won't find much value in doing the same online with bitcoins.
    - jotm 13y ago
      Nope... but I also never deposited the cash I earned under the table :-)
  - yen223 13y ago
    While most people want Bitcoin to replace the US dollar, I think that as a secure, decentralized payment method, it's more useful as an alternative to Paypal. Like everything else, it's usefulness is tied to the number of people who adopt it.
drcode 13y ago

plg 13y ago

they don't need confirmation, they can find you without it if they need to (and so can the NSA)

kyledrake 13y ago

As an interesting note, I used the free Namecheap domain coupon I got at the Bitcoin conference to register NeoCities.org. Thanks guys! Great service, highly recommended.

lowglow 13y ago
Wait! I didn't see this in my bag from the bitcoin conference! Argh...
- ted0 13y ago
  drop me a line and i'll make sure to hook you up! ted@namecheap.com

untothebreach 13y ago

Funny this got to the front page today - this morning I bought a domain name from namecheap. First I tried to use my credit card. It was denied, for no apparent reason as I keep it paid off. Then I used my debit card, and it went through. However, later today BOTH my cards were temporarily suspended, and I had to wait on hold twice to verify that, yes, I did authorize a payment to namecheap.com. Nothing else in my recent purchase history was out of the ordinary, which makes me think that namecheap.com is just one of those entities that the Cc companies have flagged.

bdonlan 13y ago
Sounds like the first denial was due to an automated fraud check with a false positive. When that happens, it's a good idea to call your credit card company right away - if it was such a fraud check, they can usually reactivate it right away and whitelist the merchant you tried to buy from, allowing you to retry the transaction - and more importantly, ensuring that your card isn't suspended and later declined again at an inopportune time.

RKearney 13y ago

After Namecheap shut down imgur by changing their nameservers without the owners consent, I'm wary to give them another shot.

jafaku 13y ago
Why did they do that?
- deleted 13y ago
  [deleted]
- RKearney 13y ago
  https://news.ycombinator.com/item?id=5276648 https://news.ycombinator.com/item?id=5276648 Long story short it was alleged there was child pornography hosted on imgur. Namecheap took it upon themselves to "Block the domain for abuse" because the owner of the domain didn't reply in a time frame Namecheap deemed appropriate. Since Namecheap neither hosts, nor transmits any of the content on Imgur, it was very troublesome to hear they would shut down someones domain by their own hand, with no involvement, nor request from law enforcement. > I'm the CEO of Namecheap here. Just want to let you all know > that I am personally looking into this. The domain was taken > down by an overzealous abuse team member who had no knowledge > of who imgur was. Although we did send 6 separate emails over > the last week, it should have still been escalated. I am > reviewing our policy to see how we can avoid this type of > situation further in the future. To the folks at IMGUR, I want > to sincerely apologize for this situation and the extreme > inconvenience this has caused you. If you can connect me with > someone in your company. I'd like to give you a personal call > and discuss the matter further. > > -Rick Kirkendall - CEO I just don't feel comfortable leaving my domain name in the hands a lone abuse department team member that can evidentially change any domains nameservers without any approval or oversight. Additionally, the new nameservers Namecheap picked had a 48 hour TTL, meaning the website was potentially down for 2 days for some people.
  - mseebach 13y ago
    You're holding them to an unreasonable standard here, IMO. They've got "cheap" in their name - you can't have your cake (dirt cheap product) and eat it too (perfect service and procedures). The profound apology and promise of fixing the procedure is already above and beyond what anyone (again, IMO) has a right to expect from a vendor of a $4 product.

ticklishconcept 13y ago

Maybe I'm missing something, but I do not believe there is a possibility of a double spend with the way NameCheap has setup their payment. To pay with Bitcoin, you have to send BTC to your Namecheap account (which is done through BitPay), and wait for 6 confirmations (1 hour). They say "Funds will be added to your account within one hour after payment is confirmed. On very rare occasions, it may take up to 24 hours for the funds to be credited." After that point, you can buy domain names with zero confirmations, but there is no risk at this point, because it is Namecheap account credit.

drcode 13y ago
If you were right, then that would not be an example of zero confirmations. I suspect you found old text that they need to update.
- ticklishconcept 13y ago
  I just bought a domain on namecheap.com with Bitcoin to test it out, and I had to wait an hour for the confirmation.