1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
|
Received: from sog-mx-3.v43.ch3.sourceforge.com ([172.29.43.193]
helo=mx.sourceforge.net)
by sfs-ml-4.v29.ch3.sourceforge.com with esmtp (Exim 4.76)
(envelope-from <cryptocurrencies@quidecco.de>) id 1Wwvmi-0003Mk-Ci
for bitcoin-development@lists.sourceforge.net;
Tue, 17 Jun 2014 15:58:56 +0000
X-ACL-Warn:
Received: from quidecco.de ([81.169.136.15])
by sog-mx-3.v43.ch3.sourceforge.com with esmtps (TLSv1:AES256-SHA:256)
(Exim 4.76) id 1Wwvme-0002cs-Lh
for bitcoin-development@lists.sourceforge.net;
Tue, 17 Jun 2014 15:58:56 +0000
Received: from localhost (localhost [127.0.0.1])
by quidecco.de (Postfix) with SMTP id 8177ADFC55C;
Tue, 17 Jun 2014 17:58:45 +0200 (CEST)
From: Isidor Zeuner <cryptocurrencies@quidecco.de>
To: Paul Goldstein <paul@realfoot.com>
References: <CADE3-jA8LizD8cjdqKm0pFc8OV7JqPBGhs4uvp6=VhEU2emV6w@mail.gmail.com>
<CAKrJrGOBSiY5V59eko6g796j3wh9V9ZLjPbyHeS5=zyX6j3Wdw@mail.gmail.com>
<CANEZrP0Euc1mPhRc9e41tU4zMDrWesvVyiBpAPq6M3m7K=aU=A@mail.gmail.com>
<CAFDyEXgKpbE4WGAqROJ4J1UST=tXWgfn7uKhRO_tngJfVK_Czw@mail.gmail.com>
In-Reply-To: <CADE3-jA8LizD8cjdqKm0pFc8OV7JqPBGhs4uvp6=VhEU2emV6w@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Message-Id: <20140617155845.8177ADFC55C@quidecco.de>
Date: Tue, 17 Jun 2014 17:58:45 +0200 (CEST)
X-Spam-Score: -1.0 (-)
X-Spam-Report: Spam Filtering performed by mx.sourceforge.net.
See http://spamassassin.org/tag/ for more details.
-1.0 RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
X-Headers-End: 1Wwvme-0002cs-Lh
Cc: Bitcoin Dev <bitcoin-development@lists.sourceforge.net>
Subject: Re: [Bitcoin-development] instant confirmation via payment protocol
backwards compatible proto buffer extension
X-BeenThere: bitcoin-development@lists.sourceforge.net
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: <bitcoin-development.lists.sourceforge.net>
List-Unsubscribe: <https://lists.sourceforge.net/lists/listinfo/bitcoin-development>,
<mailto:bitcoin-development-request@lists.sourceforge.net?subject=unsubscribe>
List-Archive: <http://sourceforge.net/mailarchive/forum.php?forum_name=bitcoin-development>
List-Post: <mailto:bitcoin-development@lists.sourceforge.net>
List-Help: <mailto:bitcoin-development-request@lists.sourceforge.net?subject=help>
List-Subscribe: <https://lists.sourceforge.net/lists/listinfo/bitcoin-development>,
<mailto:bitcoin-development-request@lists.sourceforge.net?subject=subscribe>
X-List-Received-Date: Tue, 17 Jun 2014 15:58:56 -0000
quote:
> Mike Hearn, why don't we just have all nodes report attempted double spends
> through the node network. No need to involve the miners at all really, or
> do your suggestion but also report the double spend attempt. By waiting
> maybe 10-60 seconds (instead of 10 minutes for first conf), merchants can
> be more sure that a double spend attack was not tried. Attacker would have
> to hold back second tx by 10-60 seconds and hope that that second tx (with
> higher fee) get's into a solved block before the first one. This forced
> delay time ought to make the attack less successful (but not impossible).
>
What prevents the following steps from happening:
1. attacker sends first transaction, paying to the merchant
2. merchant waits 10-60 seconds
3. merchant confirms the payment as received
4. attacker sees merchant's confirmation
5. attacker sends double spend
The security improvement seems to be pretty much exactly the chance
that during the 10-60 seconds, a block is solved. Am I missing
something?
Regarding "reporting double spends", this would only help if it comes
with some kind of penalty for the double spend. Now what if the double
spend was not done on malicious motives? Maybe someone posted a
transaction which does not confirm for some reason, and wants to
recover his funds? Should we regard transactions which do not confirm
as forever lost, in order to get to an "every double spend is a
misbehaviour" policy?
Best regards,
Isidor
|
