Comment by Steko | Hacker News Reader

Comment by Steko | Hacker News Reader

Parent Full thread

A few weeks old but saw this earlier today via Brad DeLong:

Who’d have thought that there might be an incentive for operators in a totally unregulated market to take people’s assets and run? Or that self-regulation would be so lacking in a market that purposefully concocts information asymmetries that benefit money creators/the tech-savvy…. or that the Bitcoin system was only recreating and replicating all the bad incentives we know and love in our current system, which are now being curbed by intensified post-crisis regulation?

Irony of irony, Bitcoin Magazine concludes that since it is unfortunately the case that many bitcoin businesses must use escrow accounts to hold people’s bitcoin, the only solution to the problem is moving towards a quint-party agreement to manage unauthorised liability creation in the system...

But you mustn’t confuse this with some sort of recommendation to forge a Federal Bitcoin Reserve system. It’s a “Five Parties Model” system. Entirely different...

All in all, it would be NOTHING like the Federal Reserve System we have already arrived at thanks to decades of collective trial and error, and acquired wisdom from the countless bank collapses and system crises that have come before us.

Except, of course it would be exactly like the Fed. And where it wasn’t yet exactly like the Fed, it would soon be, because exactly the same human processes, incentives and behaviours would govern its evolution and development.

Proving the point yet again that there is nothing new under the sun, and that bitcoin is more of a replication of the old unregulated past, under a new technological order, which society collectively refined and regulated until it created the system-stabilising framework we know today, than a golden era of finance no-one had yet been smart enough to discover beforehand.

ftalphaville.ft.com/2014/03/03/1787992/magic-the-undercapitalised-gathering-online/

A: We've created a decentralized accounting system and currency that obviates the need for most of the standard accounting controls and fraud prevention measures, so long as you operate within that currency!

B: Oh yeah? Well look at all the shenanigans that happen at the re-entry points to the conventional financial system! Checkmate, hard-moneyists.

What makes you think it's only exchange providers that are incompetent and/or crooked? Exchange providers tend to hold the largest balances, that makes them targets, but anyone else with a big sack of bitcoins and security by "my cousin knows Linux" is vulnerable too.

The analogy I give people is you lock the doors of your house, but it isn't really secure. Anyone can kick down the door or break a window, very easily and very quickly. Your real security for your house comes from the environment which makes it difficult for people to run around ransacking neighborhoods, e.g. your local police force.

With bitcoin, you actually have to use real security to secure your possessions. There is no local police force preventing a break in or a credit card company which will absorb fraudulent charges, or a bank that will flag and freeze questionable withdraws. In a crypto currency world, the wealth will have a tendency to flow not to the most business savy or politically connected but to the most secure (in some dimensions we see that the same thing happens with global wealth, both in terms of countries and currencies.)

The flip side of that is, stolen bitcoins may fall under a legal classification of stolen property and be retrievable through legal systems -- or at the least blacklisted and non spendable through sources that fall under those jurisdictions. That outcome, I think, is the most important thing to watch, above any other hypothetical bitcoin regulation or banning. If I was an active bitcoin startup I would build a system to identify and classify bitcoins as safe, stolen, unknown, or questionable.

Think of the current implementation of bitcoin as crypto currency alpha build 2 or 3. It is slightly amusing that people would risk so much of their own capital to participate in an alpha test, but also necessary in order to truly stress test the system.

> A: We've created a decentralized accounting system and currency that obviates the need for most of the standard accounting controls and fraud prevention measures, so long as you operate within that currency!

I hear this a lot, but I think it's really only true with a massive asterix next to it. Can you explain how bitcoin will work, for instance, in a retail model? It seems like the transactions take a long (relatively) time to verify, which leaves two options:

1. The customer waits (not really a possibility - maybe for bar tabs it's sort of ok?)

2. The vendor purchases some level of security or risk management that allows transactions to occur instantly with a minimum amount of doublespend. And there's your transaction fee. Maybe it will be less than the credit card fee?

Am I wrong? I haven't been able to have anyone explain this to me.

Perhaps you are not aware that actually settling credit card payments, i.e. the time it takes for the money to actually end up in the merchant's bank account may take several days, even weeks.

As for bitcoin, to my knowledge this is pretty much analoguous to "transaction confirmation", which typically happens in 10 minutes. So it's actually much much faster than credit card payments.

You just hand-waved away the fact that the trust necessary for an independent retailer to accept an "untrusted" credit-card has been aggregated in Visa and MasterCard and codified through tort law and agreements with the aforementioned credit-card companies.

What are you going to do, provide a detailed transaction history to the retailer proving that "your bitcoin transactions always are legit?" Kind of removes the last of the "anonymity" afforded by Bitcoin.

It's normally a matter of seconds until other clients can see a bitcoin transaction that you've posted for the network. The only way that will end up not being legit is if you've double-spent the funds - that won't happen if you're a legit user using a regular client, and for the most part even for a nefarious user it would require significant computing resources (e.g. you've already mined a block spending those coins but won't release it until you walk out of the store).

So the idea is that if you're a regular retail store, accepting unconfirmed transactions is fine. Unless a big exploit becomes known, any fraud you might happen to see certianly won't any higher than the credit card chargebacks you're getting now. If you're selling your house, you probably want to wait for a few block confirmations.

Not to mention there are other crypto-currencies with significantly faster block clearing times, and cryptocoin to cryptocoin exchanges are significantly easier to run than bitcoin to fiat exchanges.

So it really seems like all of this is only a minor inconvenience for bitcoin if anything. And there's certainly no reason to ever have to trust someone because "they've been legit in the past", that's an approximation of trust that previous systems have had to rely on but exactly what bitcoin avoids.

You outlined a couple of scenarios where a transaction can be fraudulent, which is more than the 0 acceptable to a small business where margins are razor-thin already.

You really expect every mom and pop store to accept Bitcoins when they have to be as technically literate as the posters of HN?

that won't happen if you're a legit user using a regular client, and for the most part even for a nefarious user it would require significant computing resources (e.g. you've already mined a block spending those coins but won't release it until you walk out of the store).

Just in case he's not making it clear from the description of what actually doing that would involve, mining a block is a big deal. You're talking about winning the lottery in competition with 35 million other gigahash/sec worth of mining power. If the worst you want to do with that block is defraud a mom and pop store that accepts bitcoin you're positing a scenario something on the order of a multimillion dollar operation in order to undertake such an attempt. If you're going to do that, you're not going to try to defraud the corner store for a snickers bar.

Also, if that's genuinely not enough;

Not to mention there are other crypto-currencies with significantly faster block clearing times, and cryptocoin to cryptocoin exchanges are significantly easier to run than bitcoin to fiat exchanges.

Plenty of 60 second block confirm altcoin chains out there, no reason to use bitcoin if you absolutely insist on some way to address the double spend "problem".

So having a miner in your pocket is certainly one way to execute a double spend. That's a Finney attack.[0]

The other and less costly way is all about node connectivity.[1] If you are going to execute a double spend all you 'need' to do is broadcast two txs spending the same output at the same time--one going to the merchant the other spending it back to yourself--and cross your fingers and hope the double spend gets put in a block. Now, you can increase the probability (e.g. shielding the merchant's node from your double spend) of success but it's not a sure bet. And the higher the node connectivity of the network (i.e. how many nodes are each node connected to) the harder this attack becomes.

There has been some work in this area, especially in pursuit of the efficacy of double spend attacks in light of some minor changes to the protocol which (I think) were rolled into core with the most release 0.9.0.[2] It's about .09% probability of success.

[0]https://en.bitcoin.it/wiki/Weaknesses#The_Finney_attack

[1]http://www.tik.ee.ethz.ch/file/49318d3f56c1d525aabf7fda78b23...

[2]http://www.tik.ee.ethz.ch/file/848064fa2e80f88a57aef43d7d595...

>You outlined a couple of scenarios where a transaction can be fraudulent, which is more than the 0 acceptable to a small business where margins are razor-thin already

What? You really think a small business has zero credit card fraud? You're wrong. Not to mention when you get hit with a chargeback, you get charged a fee that is usually higher than the amount stolen from you to begin with.

The credit card companies push fraud liability down to the merchant in the current system.

Bitcoin probably is less susceptible to PoS fraud than credit cards are, from a merchant standpoint. Consumer of course is a different story.

> which is more than the 0 acceptable to a small business where margins are razor-thin already.

I see you've never run a small business that accepts credit cards before. They are far more than 0 risk.

I am well aware of the risks, and it was some hyperbole. Why would a small business adopt a new revenue stream that is riskier than credit cards?

It's not riskier first off, it's less risky, by far. Bitcoin is cash, it can't be charged back and it doesn't incur the fees cards do. To say it's riskier shows you don't know what you're talking about.

Secondly, why would a business turn down any means by which a customer wants to pay? Have you ever run a business? Do you typically turn down cash payments? Bitcoin is cash.

>settling credit card payments ... may take several days, even weeks.

But there is a trusted 3rd party (the issuing bank) that gives an instant reply as to whether the purchaser's account has enough funds (or credit) to make the purchase, and assumes much of the risk if they are wrong and the purchaser is uncollectible.

Maybe they don't need to take 2-5% of each transaction to provide this service, but it does seem like a pure, anonymous bitcoin transaction can not provide this service to a retailer.

There is no need for this service with Bitcoin - the balance controlled by every address in the network is known to everyone.

I was referring to the fact that credit card companies prevent (or at least take responsibility for) double-spending.

> "...which typically happens in 10 minutes..."

Which is too long when waiting at a counter in a retail scenario. Imagine if every customer had to wait around for 10 minutes to verify the transaction, it would be chaos in a busy retail situation (even 1 minute is way too long), which is the point being raised by the GP comment.

The merchant might have to wait weeks to actually receive payment from a credit card company, but at least they know they will eventually get paid, as Visa or whoever is a trusted entity. Bitcoin is 'trustless', so if the customer can leave as soon as they like, the merchant might confirm the transaction in 10 minutes, or they might not get paid at all.

Try buying something with bitcoin. The first confirmation is all that is needed and it happens in a matter of seconds. It won't be fully confirmed for ~10 minutes but that is fine for the vast majority of cases.

the wont get paid by Visa if there is a chargeback, indeed they will owe some percentage extra as a processing fee.

It's been covered lots of times, but essentially, for all transactions whose value is an order of magnitude less than the current block reward, it is considered safe to complete the physical transaction as soon as the Bitcoin transaction arrives at the retailer's system through the Bitcoin network. This usually takes 5-15 seconds, so about the same amount of time as most credit card approvals take now.

This is considered safe because even though there are various tricks you can pull with no confirmations, the hashpower needed to do any of them is so great that you would make far more money turning that hashpower towards legitimate mining than by scamming retailers.

With Bitcoin value, block rewards, and hashrates as they are now, this means that anything less expensive then a car or a boat is okay to complete immediately. Waiting up to an hour for a couple of confirmations for a purchase of $10k or higher doesn't sound like too big of a deal.

Why does the order of magnitude/size of transaction matter in terms of knowing if a transaction is safe? Do larger transactions take more time to verify?

Thanks for answering, appreciate it - stuff like this is surprisingly difficult to google for.

All transactions take basically the same time to verify. The trick is more in the motivations of any potential attackers.

The heart of the Bitcoin system is the block confirmation system. Once a transaction has been accepted into a block and that block becomes part of the official blockchain, it becomes essentially impossible to perform any kind of scam or attack on that transaction, such as spending those coins somewhere else. Only one spend of a particular quantity of bitcoins can be in the blockchain at once, so any attempt to spend them again will be rejected.

The trouble is that this is relatively slow. Getting one confirmation on a transaction takes probably like 5 minutes on average, and could vary depending essentially on the luck of the mining network at that moment. Using 6 confirmation is the official recommendation, and this may be expected to take about 1hr.

It isn't necessary to use the official recommendation, though. It's always hard to attack the system, and the 6 confirmation point is where it becomes essentially impossible for even major governments to attack the system, but such strong security is not necessary on all transactions. So the question becomes, how hard do we need to make it for a particular transaction?

To guess at that, we have to look at attacks. I mentioned earlier completing the physical transaction after the initial arrival of a Bitcoin transaction through the P2P Bitcoin network, before any blocks confirming it come in. To do a double-spend in that scenario, you would put 2 transactions spending the same coins on the network, and arrange for one to hit the vendor's system, while the other went out to the rest of the network and would be included in the next block. That's tough to arrange though - who knows what nodes the vendor is connected to, and it's impossible to know which miner will produce the next block. To have a solid chance at pulling this attack off, you would have to run a very powerful miner yourself, solve a block with a transaction spending some of your coins before another miner solved a block, then hold back that block, and perform your transaction at the target vendor between when you solved that block that you are holding and when another miner does.

That's a window of a could of minutes, maybe, and it could take days or weeks or longer for your miner to solve a block that puts you in the position to do this. The timing is very tough to pull off at a physical store, then. And to do all of this, you have to be running your own independent miner, which is powerful enough to have a reasonable chance at solving a block in the next couple of weeks. But just running that miner as a normal miner means you're likely to get the mined block reward, currently 25 bitcoins, currently worth $12,500, just for solving that block. Why pull the funny business with transactions for, say, a $10 sandwich when you just made over 1000 times that money by doing nothing?

So because of this, completing physical transactions after only a receipt of the Bitcoin transaction is a risk, but given the high difficulty and low reward to the attacker, and low loss amount to the business, it seems like a very acceptable risk to make the purchase process more convenient to the normal customers.

Thanks, that was a really clear and helpful explanation!

Thanks! I've made enough posts like this that I was thinking of writing up some 'bitcoin nuts and bolts for coders' blog posts.

A's premise is faulty. The accounting/fraud measures are not obviated. You have slow cash with a transaction log, that's it.

shenanigans that happen at the re-entry points to the conventional financial system

Those shenanigans aren't exclusive to exchanges. Exchanges are currently the epicenter of shenanigans because they're just high volume and operate on bitcoin as if it wasn't just a different asset in the conventional financial system.

People that are neither true believers nor in a specifically bitcoin focused business operate as normal. Bitcoin is just internet fun bucks that have to be liquidated. So the Bitcoin transactions get treated the same as any other transaction, as a result they carry the benefits of the processes created around conventional transactions.

Tell me again how either of these arguments help the folks who lost their money to MtGox's sloppiness? How is the MtGox debacle (or the other recent BitCoin exchange failures) an example of the lack of need for "standard accounting controls" or "fraud prevention measures"? They are the opposite.

The e-mail I just sent to the author of that post:

"Ms. Kaminska,

In your recent post (http://ftalphaville.ft.com/2014/03/03/1787992/magic-the-unde...), which I found via Brad DeLong’s web site, you described Bitcoin as "totally unregulated" and "completely unregulated" a number of times. Such characterizations are completely erroneous, and you should probably correct your post.

Unfortunately, many people are under the impression that Bitcoin is unregulated because its various proponents (such as Marc Andreessen, the Bitcoin Foundation, etc.) have done an excellent job convincing the world that it’s so new and supposedly novel that no regulations could possibly apply. That’s not even close to true. In the United States, numerous Bank Secrecy Act statutes, 18 U.S.C. § 1960, and a state money transmission framework involving 47 different state laws all apply. The problem is that the state laws are hugely problematic, the regulators are bumbling fools, the entrepreneurs and their venture capitalist backers are exceptionally cunning in their efforts to evade regulatory scrutiny, while the press utterly refuses to write about what is actually going on. My company is the plaintiff in two federal lawsuits over the issue, one of which has set the record for the most-delayed, non-stayed motion to dismiss in California federal judicial history (764 days and counting):

http://www.plainsite.org/dockets/index.html?id=716056

http://www.plainsite.org/dockets/index.html?id=2434524

If you’re interested in the issues, I would suggest that you read my recent comment letter to the Consumer Financial Protection Bureau, which can be found here:

http://www.thinkcomputer.com/20140214.cfpbcomment.pdf

You may also find this article on my personal web site about Mt. Gox specifically and the role of Iowa’s state regulators of interest:

http://www.aarongreenspan.com/writing/essay.html?id=101

Feel free to let me know if you have any questions.

Aaron"

While you may take issue with coinbase, or MtGox, can you accept that a cryptographic proof-of-work solution to the byzantine general's problem, that implements a general consensus ledger of forth-like script applications, is not a "currency" per se, but a mechanism in which currencies can be implemented upon?

I.E. Regulate the companies that are engaging in currency like transactions on top of the bitcoin ledger, but don't be too quick to attempt to regulate bitcoin itself.

No.

Aaron you come across so angry and prickly that even people that may agree with you do so begrudgingly. In this case you're simply wrong to not even agree and cannot expound beyond a simple "No", like a 2 year old that doesn't want to share their drink box. The fact is he's right, there's nothing about bitcoin and the technology itself that should fall under scrutiny until it's used in monetary transactions. It's almost as if you didn't even read that questions because your answer is just flat wrong. I respect what you've done to disseminate the information regarding the complete failure of government to clarify and enforce laws around finance but you may want to reconsider your tone because it's not going to help you to further that cause.

He's a legal troll a parasite on innovation not to different from patent trolls, don't entertain him.

You have it backwards.

>because your answer is just flat wrong

His answer to "Can we agree?" is wrong?

So first of all, you have to keep in mind that I'm in the middle of litigation related to these issues. I am careful about what I say.

Second of all, the question posed here was both presumptuous and awfully vague. I'm not about to go on the record in response to that kind of question other than to reject it. I'm sorry if that makes me come off as prickly--I have to put other considerations ahead of public perception.

I have to agree with kovacs. Simply saying "No" does not count as a reasonable answer to a reasonable question (and I agree in the fact that it sounds petulant).

If you disagree with the points put forth disemminate them and offer a rebuttal. Do you think that the presented cryptographic solution is one that is equivalent to money? if so why? I'm sure if I wanted to argue so I could think of some parallels or arguments to illustrate the point (possibly using the example of the current credit or financial systems, though I think I would personally disagree with those arguments). If not and you take exception to some other point raised state what that is.

Your response as it is provides 1 bit of information and that is only as to your opinion on a matter and is thus semantically useless.

can you accept that a cryptographic proof-of-work solution to the byzantine general's problem, that implements a general consensus ledger of forth-like script applications, is not a "currency" per se, but a mechanism in which currencies can be implemented upon?

bitcoin

As far as regulation goes what does one have to do with the other? I would answer yes to your question and also answer yes if someone asked if I could accept that a printing press that could be used to print currency should not be regulated as a currency. However as soon as you use the currency making tools to make currency then that currency should be regulated as a currency.

You can, provided you can convince the judge.

no one wants your regulation. people took a risk with their money and they lost. they were affected, i wasnt. good for me, time to move on. no need to waste everyone's time and tax dollars coming up with regulations, etc.

please don't rebut with a public good argument.

>please don't rebut with a public good argument.

Since you anticipate one, why not preemptively respond to the best examples of one that you can think of rather than begging internet strangers to be nice to you?

You're correct; "a cryptographic proof-of-work solution to the byzantine general's problem, that implements a general consensus ledger of forth-like script applications" becomes of legal interest when people start founding legal contracts upon the basis of "as consideration for X, party Y will ensure that a specifically crafted entry is created in this particular general consensus ledger of forth-like script applications based upon cryptographic proofs-of-work". Contracts are always going to be regulated.

Is this a good synopsis of your lawsuits?

http://thenextweb.com/insider/2013/05/07/zuckerberg-nemesis-...

How does the suit relate to your experience with FaceCash?

Reply on news.ycombinator.com