But I’m seeing less and less a justification for the deliberate lack of security in the bitcoin world. So a hack like this happens. Regardless of how it happened or who’s to blame, why continue to tolerate bitcoin? What is it giving you that’s worth the enormous mountain of precaution that you need to take to secure yourself?
That said, how is this different from having physical cash in a bank, or a digital ledger that pushes money elsewhere and is only caught much later.
The answer is only that it’s an immature global system, there’s no (current) list of black market coins, which is entirely possible to create- meaning hacked bitcoins would not re-enter circulation and the value diminishes wildly.
The effect you’re seeing currently is due to an immature currency market which has never been held to the same standard as our fiat currency market. It also hasn’t been battle tested over hundreds of years. Of course it is deficient.
I’m not excusing them, I wish that people with little to no security chops would not be involved in financial matters, but a lot of these companies sprung up out of hobby projects many years ago and one could argue that the industry they’re in has changed around them. It’s not as big a deal if someone steals 4000 bitcoins if they’re worth 20c each.
Regardless, by law, accepting these coins would already constitute possession of stolen goods, and would therefore be illegal. The "legal fungibility" is already zero.
If you stole a bucket of water and then pour it in to your swimming pool and then distribute the content of your swimming pool to 100 different people, who has the bucket of stolen water?.
Bitcoin also doesn't track the movement of specific coins because they don't exist. Its just a list of transactions. A wallet with $100 in it gets $5 in and then sends out $5. How do you decide if this was the $5 that went in? Is it first in first out?
Even assuming you mean "address" rather than "wallet", you can decide by looking at which UTXO was consumed. This is a drawback of Bitcoin.
If that were happening at any scale, the coins would be essentially worthless as a currency. They only make sense if there's some kind of agreement as to what is an acceptable/valid bitcoin. But then having a blacklist of "stolen coins" requires an authority that curates the list.
A common strategy of hackers seems to be to distribute stolen digital currencies among many addresses of non-participating actors, therefore losing money, but obscuring their own identity.
If a bank robber came to your door and offered you a share of money, you wouldn't take it either, especially if this transaction is public.
Even though several billion dollars of cryptocurrency (compare with hundreds of billions of dollars) have already been stolen, my guess is that taking these coins out of circulation wouldn't affect the system much.
If that doesn't happen, everyone participating in cryptocurrency might become more and more legally liable.
"What color are your bits?": https://ansuz.sooke.bc.ca/entry/23
"Treasury designates [...] digital currency addresses": https://home.treasury.gov/news/press-releases/sm556
Governments could easily mandate such blacklists to be used (in fact, assuming you are a US person, you are already barred from interacting with certain addresses, see the treasury link above), I think it's only a matter of time until this happens. And compared to the fiat currencies, such requirements are much easier to verify, at least in non-private digital currencies.
Bitcoin in its current form can’t have a useful “black market list”, because that list has to be generated somehow. Do you make a central authority in charge of list management? Or do you trust some fraction of the population to “vouch” that coins are bad? All the options would either open the door to immediate abuse or require a central authority that doesn’t exist.
Regarding the immaturity of the projects: your comment isn’t really a response to the parent commenter. I agree that many bitcoin companies today started as hobbits projects. But why should we tolerate that they’re operating in an industry which can so easily lose millions of dollars for users, but operating with the security guarantees of hobbyists running a hobby webpage?
This may seem pedantic, but no! You certainly don't have physical cash at your bank.
Only a miniscule percentage of monetary reserves are in physical form and a bank is not obliged (as a matter of fact it would be rather counter productive) to store physical cash on customer deposits.
But outside of that many things could cause the bank to lose your money. And there wouldn’t be a recourse for it.
The comment I replied to compared bitcoin to cash-in-the-bank, and my point was the same as yours: while I may have handed the bank cash, my ability to get money back isn’t tied to that specific cash, or even to any amount of cash that might be stolen from the bank at all. The money is insured, and so if the bank is robbed, my ability to withdrawal my money is unchanged.
So even if all central bank money would be printed in bills and coins, and would be distributed to banks, that still would be only a small percentage of the numbers on everyone's bank account.
This means that those numbers on your bank account are not "money you have now", it is "money you will have in some future, when everyone pays back their loans".
So that is what they mean with a "bank run". Everyone wants their money NOW, but that is impossible, since most of the money is lended out.
So to the parent poster, even if there is no robbery, you will have a serious problem when everybody wants their money NOW. See what happened in Greece some years ago, where nobody was able to withdraw more than 50 euro's per day, since the banks had a crisis.
Thinking the money on your bank account is yours NOW is just an illusion.
Fractional-reserve banking is the common practice by commercial banks of accepting deposits, and making loans or investments, while holding reserves at least equal to a fraction of the bank's deposit liabilities.
Let's say we have a 5% reserve, which is realistic if you look at EU and US. Let's say there is a new bank, and you deposit 100 euro's at that bank.
I go there to lend out $95, which is allowed because the bank keeps $5. You have a nice shop, and I buy something for $95.
You deposit this $95 at the bank, which they can lend out again keeping a 5% fraction. I go there and lend out $90, buy something at your shop, and you again deposit this at the bank. We do the same with $85 and $80.
So you now have an account with 100 + 95 + 90 + 85 + 80 = $450. Nice! Now you go to that bank and request that money in cash.... oops.
Seems weird, but this is actually how it works. Look it up if you don't believe me: fractional reserve banking!!!
Think about it: if commercial banks wouldn't handle finance in the way you describe, it would be virtually impossible that they go bust.
They could still be drowned by dodgy loans. But let's just say that the risk profile would be rather different.
Not necessarily. Each person could create their own blacklist, and just not trade with anyone who is using coins on it. Granted, that requires personal integrity. But it's a bit like saying "I don't do business with Iran." Some countries do, others don't.
If you are skeptical of the personal integrity component (on the part of others) you could make it more useful by saying "I don't trade with anyone who doesn't also share my same blacklist"
Almost all countries follow the US imposed sanctions against Iran. If you don't it will be very hard to do business with anyone in the US. Here is an example of a bank from my country being fined by US regulators for allowing transactions to Iran (and Cuba):
https://www.reuters.com/article/us-ing-sanctions-idUSBRE85B1...
> A two-year criminal probe was conducted jointly between the U.S. Department of Justice and the office of Manhattan District Attorney Cyrus Vance. The Treasury Department’s Office of Foreign Assets Control conducted its own investigation.
Companies follow those sanctions because they don't want to be slapped by US regulators (they don't have to pay the fine, but that means losing access to the US banking system). Not many western countries besides the US have problems with Iran (as opposed to other middle eastern countries).
-----
As to your point: everyone creating a blacklist is a big hot potato game. If you're not on top of the latest hacks and get some bitcoin that were stolen you'll be at a loss. This would defeat Bitcoin's fungability and defeat it's purpose as a currency.
And in my second paragraph, I make exactly that point:
make it more useful by saying "I don't trade with anyone who doesn't also share my same blacklist"
A blacklist like you suggest has been tried and shot down many times, for example: https://bitcointalk.org/index.php?topic=333824.0
The same happen with counterfeit money, yet here we are, still using it everywhere.
In most case, if it's physical, you can catch it before it get send. If it's digital, you can cut access. No big deal.
Go see any big Ebay seller and find one that didn't lost any money from a scammer.
We are talking about blacklist that would make a stolen bitcoin, no longer a real bitcoin and thus be at lost. If you consider it still a real bitcoin, how can you consider it a loss? If it looks like a duck, swims like a duck, and quacks like a duck, then it probably is a duck. If it doesn't... it's probably not...
You talk about being on top of the latest hacks... isn't the same as being on top of the latest counterfeited money?
People are pwned every day. Leaked passwords, leaked photos, leaked sensitive information, trivial fraud, identity theft, social engineering so easy that you can get into a website's AWS account with its WHOIS information. No need to focus on hobby projects: the government and mature corporations get pwned and leak your data, too. It's a massive clusterfuck.
Our security models are still so fledgling and so bad that last week I watched my girlfriend download and execute a binary from a fake download button served by Google Adsense.
And I'd agree. But I don't think we should revert back to papyrus.
I think tolerance is a weird way to discuss this issue. I don't think it's the right word nor concept. But to continue the theme, there are things I don't tolerate about, say, the banking and credit card system either.
Like how, by default, if I type my credit/debit card number into a <form>, anyone can use that data any time in the future to spend my money, and I have to remain eternally vigilant each time my transaction statement comes. Or how annoying or impossible it is to send/receive money between random people just using our bank accounts, usually having to rope in yet another party/service. Or how hard it is to juggle bank accounts in multiple countries as a traveler.
I suppose you're asking why someone would use bitcoin despite news like this? Sure, I like using bitcoin for online payments and money transfers.
If you're asking why anyone should tolerate the risk of keeping your bitcoin in somebody else's pocket, like Binance's pocket, then I agree. They shouldn't, but they don't necessarily understand that.
So you'd be okay with a bitcoin that didn't have require power consumption and scales? Because they exist you know.
https://web.archive.org/web/20100701145902/https://blog.magi...
Bitcoin has sender based transactions. All I (the possessor of black market coins) needs to do is to send a small number of coins to a large number of addresses (exchange hot wallets, exchange cold wallets, random people's addresses) and now the taint is spread so wide that in order to enforce the blacklist you need a positive declaration from each of the destination addresses that they are not the thief.
How would that be possible? Isn't the value based off of wallets, so what you need are blacklisted wallets, and trading with a blacklisted wallet blacklists your own wallet. This would also mean all coin mixers are nearly guaranteed to become blacklisted. At such a point, people will just choose to do business with blacklisted wallets instead.
We can already trace coin flows between wallets involved in far worse crimes than theft, yet the entire bitcoin community considers allowing them to operate as a cost of doing business. I don't see why millions of dollars worth of stolen coins would prompt a black list system when child abuse sites using bitcoins didn't prompt a black list system.
I don't think immature is the right word even though you're right about other point. The regular system has a lot of regulations, security, and so on to reduce repeating and some big risks. The cryptocurrency community lacks most of that. The reason they do is philosophical: they believe their own decentralized protocols and individual activities are better than [de-]centralized, government-regulated, traditional activities. The hacks are a logical consequence of people with that false belief doing things that logically follow from it. And don't work.
They'd have been better off making a multinational, public-benefit corps with charters and contracts having tons of protections built in.
Worse, they are trying to protect that cash from everyone on the internet. If you want to steal actual cash from a bank, you need to walk into it and threaten a teller, and you're probably going to jail. If someone hacks into BofA and drains a bunch of accounts, the losses will be covered by the bank or the FDIC.
If a bunch of people put cash in one place, then trust an immature company with no insurance to keep it safe, this will happen again and again. It's like a data breach, except easier money.
Bank deposits are insured by the FDIC, and ACH transactions are reversible. Bitcoin is neither insured by the federal government or reversible...
It's giving you precisely the opportunity the Binance hackers seized: doing transactions that no one else wants done. You don't have to ask permission nor trust anyone but Bitcoin itself.
Mt.Gox should have been a general warning, which, apparently wasn't heeded too much.
I expect to lose more from btc's value crashing than some elite conspiracy of hackers having sabotaged my hardware & somehow working out my private key which isn't stored in plaintext
If I was holding a really great worth of btc, going the full mile of cold storage would make sense. At that point you're invested, quit kidding around
Semi-related, it’s wild to me that the best practice for a digital currency is the functional equivalent of keeping your money in your mattress.
Unless you’re talking about something else.
The difference is what happens when it doesn't. What happens when Venmo decides you cannot buy porn or marijuana or whatever, you simply can't.
Or what happens when you can't get a bank account? You're locked out of the ecosystem.
This is one of the reasons why cryptocurrencies exists. To provide a system for when nothing else works.
Cryptocurrency is totally impractical without a bank account. Meeting random people in the street to trade cash for bitcoins is about the shittiest and most dangerous UX I've ever heard of.
you aren't obliged to use it, are you?