Message-ID: <52F92CE3.7080105@olivere.de>
Date: Mon, 10 Feb 2014 20:47:47 +0100
From: Oliver Egginger <bitcoin@olivere.de>
User-Agent: Mozilla/5.0 (X11; Linux x86_64;
	rv:24.0) Gecko/20100101 Thunderbird/24.2.0
MIME-Version: 1.0
To: Bitcoin Development <bitcoin-development@lists.sourceforge.net>
References: <CAPg+sBi-phaw3hDgguk-LYrPsKX4M5snTJBv_NsQML1M=XgZEw@mail.gmail.com>
In-Reply-To: <CAPg+sBi-phaw3hDgguk-LYrPsKX4M5snTJBv_NsQML1M=XgZEw@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Subject: Re: [Bitcoin-development] Malleability and MtGox's announcement
Precedence: list

Am 10.02.2014 13:28, schrieb Pieter Wuille:
> Hi all,
> 
> I was a bit surprised to see MtGox's announcement. The malleability of
> transactions was known for years already (see for example the wiki
> article on it, https://en.bitcoin.it/wiki/Transaction_Malleability it,
> or mails on this list from 2012 and 2013). I don't consider it a very
> big problem, but it does make it harder for infrastructure to interact
> with Bitcoin. If we'd design Bitcoin today, I'm sure we would try to
> avoid it altogether to make life easier for everyone.

Sorry, I'm not a developer, but I have got a question. It's a little bit
off-topic and can't maybe answered easy.

As I understand this attack someone renames the transaction ID before
being confirmed in the blockchain. Not easy but if he is fast enough it
should be possible. With a bit of luck for the attacker the new
transaction is added to the block chain and the original transaction is
discarded as double-spend. Right?

Up to this point the attacker has nothing gained. But next the attacker
stressed the Gox support and refers to the original transaction ID. Gox
was then probably fooled in such cases and has refunded already paid
Bitcoins to the attackers (virtual) Gox-wallet.

So far everything is clear. But what I do not understand: Why apparently
had so many customers of Gox payment defaults or severely delayed
payments? I would imagine that the attacker may have doubled not only
his own transaction (maybe for obfuscating the fraud). But then all
transfers would still have go through anyway. And a normal customers
would have been satisfied. Most people observe only their wallets, I
think. What am I missing here?

Sorry, is perhaps a silly question. But maybe you can put me on the
right track.

regards
Oliver