Comment by cgjaro | Hacker News Reader

Comment by cgjaro | Hacker News Reader

Parent Full thread

"But that's rarely good enough"

Yes it is. The vast majority of Bitcoin services and users wait for only 1 confirmation. Waiting for 6 confirmations is "excellent" whereas 1 confirmation is "good enough" (when was the last time we saw a Bitcoin double spend attempt? Never!). But arguing whether 1 confirmation is good enough is a moot point. Bitcoin competes with traditional international payment systems where it is common for transfers to post in 1-3 days especially across weekends or bank holidays ("post" has a specific definition, look it up). So even waiting for 6 confirmations makes Bitcoin faster than traditional systems.

On the other point, true, many people rely on 1 exchange, or place their coins in 1 online wallet service, which makes them vulnerable to incidents typically affecting centralized systems. But this is not a problem inherent to Bitcoin. Not at all. This is solved by educating users, by new services (eg. hardware wallets like Trezor), and by "natural selection" (eg. people who lost coins on MtGox tend to learn their lessons, weak exchanges die, secure ones remain in use, merchants can very easily use multiple Bitcoin processors at once, etc).

> The vast majority of Bitcoin services and users wait for only 1 confirmation.

They do? Before posting that comment I looked up information on transaction confirmations to check that my "1 hour" figure was correct, and the documentation I found stated that the recommendation is still to wait for 6 transactions, and that you may choose to use as little as 1 transaction for low-risk situations where e.g. you're selling cheap easily-replacable items, but that you should use more confirmations for other transactions.

> So even waiting for 6 confirmations makes Bitcoin faster than traditional systems.

But we're not talking about Bitcoin compared to other traditional systems. The context here is in comparison to Stellar, where conformation happens in seconds (worst case would be minutes, if there's network issues).

Correct, best practices and doc says to wait for 6 confirmations. But in practice, very few people do this. For example you can send bitcoins to your Coinbase wallet and sell them without even waiting for 6 confirmations.

Let me explain to you why this is okay in practice. A merchant will in general send something to the customer (a seller would ship an item, Coinbase would send an ACH bank transfer, etc). But because sending the service or product to the customer takes time, this gives time to catch double spend attempts. So a merchant considers 1 confirmation as sufficient, and prepares the shipment right away, or initiates the ACH right away. But if in the next hour the 2nd-6th confirmations never come (eg. the 1st confirmation ends up in an orphaned block) then the merchant can cancel the shipment of the item, or cancel the pending ACH.

But that only works when the merchant's half of the transaction is cancelable/reversible. That would never work in, say, a retail store, because the merchant can't catch the guy an hour after he's walked off with that $2000 computer.

Merchants are ALREADY taking a risk with credit cards if, after walking away with a $2000 computer, the guy issues a fraudulent chargeback.

So if a merchant accepts the (non-negligible) risk of credit cards chargebacks, he will accept the (even smaller) risk of a Bitcoin double spend :)

Yes there's a risk, but it's a relatively small one. There's a chargeback arbitration process, so the guy can't "just issue a chargeback" and be done with it. Also, credit cards are tied to identity, and anyone that issues fraudulent chargebacks may lose their credit card or have other penalties applied. Heck, if it's for a large enough value, maybe they'll get arrested for fraud!

Regarding bitcoin double-spending, FWIW, a few years ago when MyBitcoin.com shut down, they claimed it was due to a series of double-spend attacks that were successful because they were only using 1 confirmation: https://bitcointalk.org/index.php?topic=34770.0. More recently, GHash.IO successfully executed double-spend attacks against BetCoin Dice, although it looks like they may have been using 0 confirmations?

The risk for credit cards is there. And yes it really is as easy as issuing a chargeback and maybe claiming your card was stolen. The only reason it is not occuring more often is because most people are honest, that's all.

I demonstrated to you that accepting bitcoins is safer than accepting CCs in most scenarios like (1) when the merchant's half of the transaction is cancellable, or (2) when the merchant waits for enough confirmations. Now in the last scenario (3) where not only the merchant does not wait for confirmations but the transaction is non-cancellable (eg. guy walking away with laptop), nothing inherent to Bitcoin PREVENTS the merchant from taking all the same precautions he takes for credit cards: for example he could check your ID, check your credit score, verify your presence in his own database of high-risk customers, etc. Bottom line is neither in (1), nor in (2), nor in (3) is Bitcoin inferior/riskier than CCs. In fact it is clearly superior to CCs in 2 out of 3 scenarios. There was a great Mashable article recently explaining merchants love Bitcoin precisely for this reason: http://mashable.com/2014/08/06/bitcoin-retailers/

MyBitcoin claim they were using 0 confirmations, not 1. (But many in the community and myself included think their whole story was a lie and that instead MyBitcoin stole the bitcoins, but I digress...) BetCoin also was using 0 confirmations.

> The only reason it is not occuring more often is because most people are honest, that's all.

Well that, and the fact that it's fraud, which is a crime, and if you get caught then you will get in trouble.

> I demonstrated to you that accepting bitcoins is safer than accepting CCs in most scenarios [...] when the merchant waits for enough confirmations

Even waiting for 1 confirmation can still take 10 minutes, which is a long time to wait for a lot of transactions, especially in-person transactions. That alone makes it extremely difficult to use Bitcoin for "real-world" transactions as opposed to online transactions.

Now, eridius, you are starting to repeat a point you already made and that I already rebuked. This is a sign you have no way to "win" this argument and you are merely trying to have the last word :)

So I will repeat the rebuke I already told you, but I will repeat it only ONCE. After this, if you repeat yourself again, I am done here, since you are wasting our time. You are bringing up scenario (3) and my rebuke was "nothing inherent to Bitcoin PREVENTS the merchant from taking all the same precautions he takes for credit cards: for example he could check your ID (like some supermarkets do in the US), check your credit score, verify your presence in his own database of high-risk customers, etc" Therefore Bitcoin with 0 confirmations is no more risky than credit cards to accept in brick-and-mortar stores where the customer can run away after paying.

How very condescending of you. Feel free to stop talking if you want, but that doesn't mean you have "won".

In any case, your response is completely wrong. I thought we'd discussed this already. Accepting a bitcoin transaction with 0 confirmations is more risky than a credit card, because you have no recourse if you get scammed. With a credit card, the credit card company accepts the fraud risk, not the individual retailers.

Also, credit score? It sounds like you have no idea what you're talking about. You can't check credit score for individual retailer purchases. That's done when applying for a credit card, not using one. Retailers also don't typically maintain databases of high-risk customers, or really do anything at all on the subject of fraud beyond possibly check ID against credit card (which is actually very rarely done unless the retailer has a reason to be suspicious of the card). The only retailers that would ever need to do anything like that are low-volume high-price retailers that can afford the extra effort spend on every customer.

In the end, when you pay with a credit card, the retailer gets confirmation from the CC company effectively instantly that the payment has gone through. It takes just a couple seconds, and at that point the retailer's job is done, they don't carry any fraud risk. If the guy turns out to have been using a stolen card, it's the CC company that pays. But if you pay with bitcoin, and you don't wait for a confirmation, then by definition you have no confirmation that payment has gone through. If you let the customer walk away, and the payment doesn't end up going through, then the retailer is out 100% of the cost, with no recourse.

So yes, retailers that are willing to accept the entirety of the risk may choose to accept bitcoin with 0 confirmations. But not all retailers will do that, and I warrant a majority of retailers won't want to do that. The two classes of retailers that might are 1) the retailers that don't understand the risk they're accepting by doing this, and 2) the retailers that are in a market where their target customers are more likely than most to care about bitcoin and therefore accepting bitcoin will work as a marketing strategy.

You know nothing about credit card fraud. When it happens, the retailer has to pay up, and there is a fine and fees. Don't take my word for it. Listen to the CEO of a merchant who tells you how it works: "As Nichols mentioned, credit card fraud is an impetus. When a transaction is found to be fraudulent, the retailer is forced to pay up. To add insult to injury there's also usually a fine. "It's 90% to 95% of the transaction cost and on top of that they'll hit us with a fee, like $20 on top of a $10 sale," Nichols says." Source: http://mashable.com/2014/08/06/bitcoin-retailers/ (which I already gave you 3 posts above, and you apparently didn't read...)

Bottom line: there is, 99% of the time, no recourse for merchants. That's exactly why merchants are so wary of CC fraud! Or else why would they be wary of it if it was all magically covered by the CC company? Food for your thoughts.

You're quoting an online retailer there, not a brick and mortar retailer, so you're already off to a bad start. Furthermore, what he says only applies to the "card-not-there" scenario, i.e. online retailers accepting credit card payments without the physical card. But brick and mortar retailers do in fact have the physical card. Assuming the brick and mortar retailer complied with the rules of their credit card processing agreement, in the card-present scenario, the retailer is not liable for the fraud, although I believe they may be charged a fee.

Bottom line: you're blindly trusting the word of the operator of a sketchy online retailer and claiming that what he says applies to brick-and-mortar stores when it doesn't.

Reply on news.ycombinator.com