Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

It's interesting to watch actually, submit a transaction to the network at the moment and there's a rogue node that will mess with the padding of the signatures and rebroadcast it faster than the original. It confuses the reference client into duplicate display, which is what Gox is relying on for the failed/success display. That they're winning races over the normal related transactions isn't that unnatural as the transaction processing stuff has a 100ms sleep() in the middle of it.


Also worth noting is the fact that the Bitcoin Price Index has been massively resilient to all the bad "news" thats been pouring in this month. It has been consistently hovering around the 670-700 mark.


I can't find the article now, but there have been several good articles explaining the lack of gravity on bitcoin in general.

Basically, the price goes up quickly when new people are attracted to bitcoin and rush to buy. When the price dips however, because so much is bought for long term speculation, the price doesn't really dip much, as no one is incentivised to sell and hold out for when it gets better.

At some point the nerve of those holding out may crack, but if you read silly saurus2's post, its quite clear that many will hold out indefinitely on the belief or hope it will one day recover. So in this manner the bubble can deflate slowly. (If you call 10% in a day slow).

There are no settlement dates or ways to easily move money out (especially now) so a crash is prevented.

If a crash happens it'll probably happen before people realise it, but suddenly there just won't be anyone wanting to buy coins anymore.

But even that might not happen as people already invested into bitcoin use how wealthy they feel to buy bitcoins from each other. That can cycle for a long time before people realise there isn't new money in bitcoin.

If you had bought coins at 800-1000, why would you sell now? No one likes to cement a loss.

Those with the most reason to sell right now are the early adopters, but it's not actually clear how many of those coins are actually reachable.


The psychology part of this argument seems the same as with any commodity, not just Bitcoin.

Maybe Bitcoin would be different if you could put money in but not take it out. But it's actually the reverse now -- it's harder to get Bitcoin out. So wouldn't that tend to increase the selling pressure?

And if you don't want to sell to a sketchy exchange, you can sell to SecondMarket[0] and get a wire transfer to your bank account the same day.

https://www.secondmarket.com/education/sell-bitcoin-secondma...


Also worth noting: you can't buy bitcoins on margin. So no margin calls to suddenly detonate the market.


Hang on. Isn't that just a matter of someone setting up a market and contracts for it? What you mean is that no one has setup bitcoins margins market yet right? Or am I misunderstanding something fundamental about BTC that prevents margins?


You can trade contracts for difference (CFDs) on Bitcoin with 1:10 leverage, including shorting them, at places like Plus500

Great way of taking the risk created with the volatility of Bitcoin and multiplying up the risk massively so you can lose money even faster...


How are those contracts validated and enforced on sites like that? The SEC used to watch naked shorts relatively closely before 2008 and it's been banned since then; but how is that arranged in practice with a currency whose primary selling point is its anonymity?


I know I'm risk averse, but even still this seems like the basest insanity to me.


Transaction irreversability makes it a lot riskier, combined with the lack of support from the legal system. If you lend bitcoins to someone, and they run off with them, how do you recover your loss?

Conversely, unlike stocks, you don't need a broker, so there's nobody who would take on that dealer role.

Nobody has setup a "buy bitcoin on margin" service yet, and the first person to do so will lose a fortune to nonpayment of margin calls.


Hang on I almost read that as meaning bitcoin has less financial capability as fiat currency, which we all know is patently false because the premise of bitcoin is centered around an increased flexibility compared with fiat currency.


You're quite wrong -- BTC is strictly less flexible than fiat. I have my own opinions, but this is inarguable and is presented as an advantage of Bitcoin, for example Bitcoin cannot be created arbitrarily by a government, Bitcoin transactions cannot be reversed, untraceable transactions cannot occur in Bitcoin, et cetera. All of these are clear restrictions upon existing currency systems.

Some possible ways that it might be interpreted to be more flexible are scripting, n-of-m transactions, and so on.


The reversibility of bitcoin is no different from passing around physical dollar bills. If you want to reverse a transaction involving actual cast, you must convince the other person to give it back, or physically wrest possession of the currency from them.

Reversibility shows up when you do transactions in a bank or other third party that can reverse the transaction on its own accord. There's no theoretical reason why this can't happen with bitcoin instead - you give your BTC to a hypothetical, highly regulated bank or broker or whatever, and then the transaction is exactly as reversible as any electronic transaction using dollars. The confusion sets in when you compare Bitcoin transactions with electronic transactions using fiat currency, when they're closer in many ways to physical cash transactions in nature.


> when they're closer in many ways to physical cash transactions in nature.

I very much agree with you. This is also the right way to think about BTC exchanges -- an unregulated website that you ship cash to.

There are some subtleties around the specific nonphysical transaction mechanism of BTC that differentiate it from a cash transaction, which are sort of difficult to quantify currently because the technical and legal aspects have not been fully explored... as a hard example, imagine a BTC wallet coupled with a memorizable private key (or an effective substitute). This is essentially a cash store that cannot be confiscated, and which can be communicated verbally, i.e. within a protected (attorney-client) setting. There are some interesting implications there.


You can protect against the risk by only providing the service between wallets held and controlled by you on your own exchange.

There also are brokers providing indirect Bitcoin shorting with 1:10 leverage in the form of CFD's (contracts for difference). Of course they could opt to always or sometimes not actually trade the coins - to their clients it makes no difference, as no actual coins can be moved in/out of the accounts.


You can margin buy/sell on bitfinex.com


You can p2p lend and borrow btc here: https://www.bitbond.net/


This sounds like a general analysis of most bubbles in history - nothing very specific to BTC.


Well I have bitcoin and I'm in no hurry to sell. I bought them at the tip of the previous bubble when they were £150 and was kinda disappointed when it dropped.

Was hoping to have a large amount in bitcoin so i can buy online services relatively anonymously.

Since then I more then recovered my loss even at the price it has now.


> If a crash happens it'll probably happen before people realise it, but suddenly there just won't be anyone wanting to buy coins anymore.

Not sure how true this is. Bitcoin has been going through a few major crashes in the past 3 years, yet the demand was still strong after it went down.


I dont think the person you replied to meant a crash, but rather an implosion. i.e. a massive failure in the bitcoin protocol that renders it useless. This is the only way in which no one will want to buy coins. In that situation your best bet is sending your coins to an exchange and selling them into the listed buy orders which have not been removed because the person who listed them is either asleep or unaware of the news.

However this is incredibly unlikely, bitcoin went though a fork last year that caused some problems but was quickly rectified, this current maleability issue is also being worked on to get a resolution. These sort of network wide problems are problems with the fundamentals of bitcoin and should, by right, affect the price of bitcoin much more than say government regulations in China or India, that they dont is because most holders of bitcoin understand that these problems can be resolved with some dev time and BTC has some great and comitted devs working on it.

Namecoin (NMC) had a similar issue where it meant that web addresses linked to NMC were not secure, that caused a crahs but no where near going to zero and that is a coin with minimal developer support.


Sounds like the reason they gave for why houses always goes up.


You should know bitbugs don't like history.


Nobody likes history in the broad sense. Most people only like history that confirms their existing positions.


Wow this makes a lot of sense. I personally believe that this is yet again another one of BTC's large dips that will eventually recover onto it's upwards path.

But then if people panic and see how hard it is to get back into fiat from BTC won't they just go into relatively stable altcoins instead? For example DOGE is skyrocketing as we speak and it's USD price was totally unaffected by BTC's recent plummet. http://coinmarketcap.com/


If by "stable" you mean "they are so small that no one will even bother attacking them"...

http://imgur.com/0kcORBm


5th largest cryptocurrency with more transations/day than every other one put together isn't exactly small...


More like 4th, given that Ripples can't be mined, is controlled by a single entity, most of the existing coins are not freely circulating, and the transaction volume is consistently so tiny that it looks very much like the price is intentionally manipulated to make the coin look desirable.


More like 3rd. In the 8 hours since vidarh posted this, Dogecoin surpassed the Peercoin market cap. The 24h trading volume of Dogecoin is also nearly 6x that of Peercoin right now.


Really that means nothing though. Neither Peercoin or Dogecoin have merchant or payment processor support. No one is interested in taking dogecoin in payment for goods and services, right now it is just a toy coin that people can use to learn about cryptocurrencies cheaply and that is pretty much what it will always be. If dogecoin had a maleability issue it does not have the dev support to resolve it in a reasonable time frame, a fork like there was in BTC last year would have a similar result. There are lost of transactions because you can send 10 or 100 or 1000 coins to anyone and you still have sent less than a few bucks. Lots of transactions does not equal a big currency it equals a lot of transactions. And in this situation these transactions count for very little economic activity.


Is doge inmmune to this multiple hash malleability feature?

EDIT: "If" -> "Is".


No coin is immune to this.

What, you thought other coins had their own code? Nope, they are all just a copy/paste of Bitcoin's code.

Specifically Dogecoin was "coded" (copy/pasted) in a Friday night, according to it's founder. So I don't know what you were expecting.


Just curiosity. I thought they copied the code from Litecoin and I was not sure if in any of the intermediate steps someone decided to fix this.

It will be interesting to see how each developer set and community handle this problem (and the future problems).

Disclaimer: I don’t own BTC or DOGE (or LTC or any other virtual currency).


There isn't really any development team comparable to that of Bitcoin in a different coin. Things that get fixed in Bitcoin are not fixed in other coins. But if another coin happens to fix something, it will be fixed in Bitcoin too.

Typically a copycoin will only have the same fixes as Bitcoin depending on when they decided to copy it. But then they will invariably lag behind.


It is quite short sighted to think that all digital currencies are "forked" from bitcoin: see http://www.openudc.org/ for instance:

"The OpenUDC softwares are designed to manage a free money system as described by the TRM (Théorie Relative de la Monnaie), that means a money system where no human has privileges in front of money creation either in time or in space."

The concept is therefore quite different from BTC which clearly gives some people a huge privilege in front of money creation in time


Wasn't it 800 at the start of the month?



You know that it was up above 800 before this started on last Friday, right?


Given all of the historic volatility, a drop from 800 to 600 must not feel abnormal to bitcoin investors. It could have been much, much worse, I guess?


By my rough back-of-the-envelope calculation, something like $50 million dollars changed hands on Monday based on unsubstantiated fear, uncertainty, doubt, and outright lies. Volatility is one thing, market manipulation is another.


I wish I didn't buy at $900 and at least would've sold soon after, otherwise I'd buy some now. These events where some pretty major bug is found in Bitcoin are great opportunities to buy Bitcoin at a "low price" (as low as you can get in that moment in Bitcoin's history). I'm not worried about the bugs themselves because I know they will be fixed.


part of the reason is that bit coin does not depend on any banks

if you have 100 btc in an offline wallet, you will still have it tomorrow, despite whatever bugs/attacks hit the exchanges.

imagine if your bank was hacked, many people would literally be removed of their money.

With cryptocoins, you have the advantages of keeping dollars under your mattress while still bring able to spend them anywhere that accepts them.


In what way is that different from fiat money? You can keep fiat money in your mattress and spend it anywhere that accepts them. If you have $100 in a mattress (offline) then you would still have it tomorrow. The problem is that the moneys value may change tomorrow, especially if we are talking about bitcoin.


You can't secure cash under your mattress with a password, for one thing. That makes cash (and paper wallets) venerable to physical attack, even by vermin: http://metro.co.uk/2007/03/27/mouse-eats-cash-machine-makes-...

There is no problem with value changing tomorrow as this is a potential problem with any new payment methodologies. Adoption does not appear magically overnight. The US Dollar is velocity stable due to its wide spread use and being propped up by the equivalent of a bunch of duct tape and bailing wire.


I've seen more people get jacked of all their cryptocurrency holdings than any significant amount of fiat on their person, due to targeted viruses and backdoored systems. I've also seen numerous occasions where someone sent money to the wrong address and that was it, the money was forever sent into the void.

There was a guy on reddit who had all of his DOGE and BTC lifted right off his computer. He was using strong, auto-generated passwords stored in a password manager, so he was not even typing in passwords that a keylogger could intercept. Presumably the attacker had a backdoor into his system, watched him work, and just transferred out the funds when he wasn't at his desk. Poof - all gone, with more or less proper security measures in place and no clear sign of an intruder other than the missing money. Several other people reported similar events in that thread.

These are still major problems for mass adoption of crypto, completely setting aside the massive cases of fraudulent pools, online wallets, exchanges, etc., etc. There are many subtle problems that are difficult to diagnose and cure that come with a technological solution like bitcoin, that paper money simply does not have.


A true story- My grand-uncle, who had lived through the Great Depression, never trusted banks. So he buried a considerable amount of cash in the forest behind his house in mason jars (seriously!).

When he died, my grand-aunt, who always thought he was being silly, went out in the woods and retrieved all the jars.

The cash had rotted and deteriorated to the point that it was unspendable.

However, she was able to work with the US Treasury to sort through the remains and identify the bills and replace them with new currency.

There's not really a bitcoin lesson here, just some family lore that seemed relevant. :-)


this is why we buy gold and silver.


Isn't the commission too expensive?


No. You can usually buy physical at spot + 1 or 2% max. In the UK, coins like Sovereigns or Britannias are capital gains tax free, so you typically pay a bit more for them, like 4 or 5% above spot. But then you won't have the headache of remembering what you bought them for when you sell them (aside from the pleasure of saving CGT-free).


Worth it for long term storage like that.

These days spending old banknotes is problematic, even if they're in perfect condition.

Some people love gold, some people hate it, but everyone agrees it's the only thing that really has zero counterparty risk.


I wouldn't say zero! Also, moving forward things like planetary resources could challenge the stability of gold, but it's still pretty good and fairly liquid. For me, it proved more liquid than bitcoin; Exchanging bitcoin took 3 days coinbase + ACH; I liquidated a gold piece in an afternoon, could have gotten cash, but mailed a check into my bank and had the funds in 2 days (still faster than bitcoin, even with the USPS in the way)


let's say the trade commission was a horrifying 50%, and in the best case scenario for the other direction the treasury exchanged those bills exactly one for one. Would you rather have $1000 or gold from 50 years ago valued at $500 from 50 years ago? Even if you think gold is in a bubble, and, say worth $200/oz instead of $1600/oz, you would have far more than 5 oz worth from 500 1963 dollars.


If someone is going to physically break into your house and access your money what's to stop them from physically assaulting you until you give them the password? Or just taking the computer that stores the "offline" wallet?


Unless someone has some kind of insider information, no burglar is going to assume that you have a stash of bitcoins.


Until now!


There are these things called safes...


Are you going to put the safe under your mattress? Or do you think a secure encrypted and password protected wallet stored on a tiny USB drive or SD card might be more secure?


You're right, all solid savings plans must fit comfortably beneath a mattress. Reminds me of the old saying "If I can't lie down and sleep on top of it comfortably, it's not an investment"


Embed it in the floor, since you ask.

Not that I think this is the ne plus ultra of security, but since having a digital wallet doesn't obviate the existence of valuable physical documents (eg passports, title deeds) you might still want to use a safe to protect against fire, burglary, and so on.

One distinct benefit of a physical store is that removal or tampering are more obvious.


If you burn your cash there's zero risk of it being stolen. But what matters is that you have access to it in the future, and I'm a lot more confident of that with a safe than with a complicated piece of electronics that can only be used by connecting it to an even more complicated piece of electronics.


I've had a significant number of USB drives, (and SD drives) get corrupted and simply stop working. This seems to happen with heavy use, but it also happens just sitting in a drawer untouched - for quite a bit of time. I'm not trust these suckers as the sole repository of things as valuable as my pictures, much less cash.


USB drives have the advantage of small. There's literally a hundred places I could hide one in my house. Hell, I could hide 20 fake ones haphazardly and one legit one really well.

The chances of everyone doing this and being comfortable with it is pretty low though. We need brain storage medium.


I'm not sure that's an apples-to-apples comparison.

In both cases, there is one physical good which, when stolen, deprives you off the money. With cash, it's the physical notes. With Bitcoin, it's the private keys in the wallet (or private key to unlock the wallet's private keys). Making backups of the keys can protect against accidental data loss, but not against theft, as it increases attack surface (i.e. number of locations where the same money can be stolen from).

There is still an advantage here favoring Bitcoin, though: if the key is stolen and you know this, you still have a chance to preserve the wallet's holdings: just generate new keys (addresses) and broadcast a transaction of all the wallet's money to those addresses. If you can get the message to the network's nodes faster than the attacker, the money will be "signed away" before they can use it, and such attempts will be rejected as double-spends.

There is no corresponding feature for physical cash.


You need to physically be somewhere to spend cash, with BTC, you don't need a presence.

While you could construct a procedure to spend cash remotely without one powerful intermediate, this property is just built into to *coins, and it is simply how they work.


A huge difference is fractional banking, which deserves a good read. http://en.wikipedia.org/wiki/Fractional_reserve_banking


I'd argue that fractional reserve banking is still better than having a "currency" that is backed by absolutely nothing and may lose up to 90% of its value on a moment's notice.


> imagine if your bank was hacked, many people would literally be removed of their money.

Are you sure about that? For the most part those transactions would simply be reversed. Bitcoin exchanges seem a lot more exposed to computer security breaches to me.

> With cryptocoins, you have the advantages of keeping dollars under your mattress while still bring able to spend them anywhere that accepts them.

Paper currency is a bearer instrument. It can be used for offline payments. Cryptocoin can't be. Both parties need to be connected to the rest of the coin network so the transfer can confirmed by other nodes.

Not to say that cryptocoins have no under-the-matress advantages. They are a lot easier to hide than cash and you can make backup copies of them, which obviously can't be done with cash.


You need to be connected to send them but not receive them.


You certainly need to be connected to confirm that you have received them!


No you don't, blockchain.info would tell you.


Is that really true? Could a botnet not conceivably make transactions out of your wallet? Doesn't the distributed ledger have tentacles reaching under your mattress?


A valid digital signature gives a recipient reason to believe that the message was created by a known sender, such that the sender cannot deny having sent the message (authentication and non-repudiation) and that the message was not altered in transit (integrity).

http://en.wikipedia.org/wiki/Digital_signature

The purpose of the blockchain is to establish an ordered sequence of transactions.


Sure, but no-one calculates digital signatures in their head. Your bitcoins are worthless without computer systems, and those computer systems are the subject of attack by thieves.


Sure, but this attack is not about that.

This is a DDOS attack on the integrity on the distributed database, which is very bad, but not able to spend Bitcoin that isn't yours.


http://learncryptography.com/51-attack/

I guess it would be possible.


No, even if you successfully achieve a 51% attack, you can't spend coins from arbitrary wallets.


Well, you could control the blockchain, wouldn't that include spending coins from any wallet?


You don't "control" the blockchain in the strict sense. To generate a transaction from one address to another, you must know the private key corresponding to the sender's address. Without that, the transaction is invalid, and no sane node will accept block containing such transaction.

When you have 51% of mining power, you can do a lot of nasty things(like stopping confirming transaction at all), but not spend someone else's bitcoins.


No. Transactions have to be signed by a private key matching the from address.

The double spend attack works by convincing the other party that the transaction has completed (so they release whatever escrow is in place) and then replacing the blockchain.

(But a botnet infection could watch for wallets on a computer and cause the coins in the wallet to be spent)


No. The wallets are protected with public/private key cryptography. Controlling the block-chain simply lets you control whose transactions get processed, and hence potentially allow someone to attempt to double spend their money. You could also prevent other people from spending their money entirely.


No, a botnet can't ever achieve 51%. One modern ASIC rig is equivalent to a few thousand average CPU+GPU computers that make up a botnet.


What about a botnet of modern ASIC rigs?


How would you get one?

ASIC owners are paranoid about their earnings. They would notice they are getting less than they usually do the next day after the infection.


There's also a story here about responsible disclosure.

People are making the case (and I tend to agree) that Gox should have contacted the other exchanges in private to discuss this problem before going public with it.

There's a very good chance this widespread attack is a direct result of Gox's announcement.


So first gox is criticised for blaming an old bug and now they are criticised for irresponsible disclosure. Funny old world.


What needed responsible disclosure was the fact that Gox was clueless.


It contains multitudes.


A+


It seems the general consensus believes it was MtGox's fault that they didn't handle the protocol correctly. The only way to spin this on MtGox is to blame their protocol problems on BitCoin itself.


Right, the main argument for that was 'look, no other exchange is having problems!'. Then someone actually started using the bug against other exchanges, and suddenly other exchanges are having problems. But that's mtgox's fault too!


The attack started prior to the disclosure.


No, someone intentionally or accidentally used gox's poor handling of mutant transactions to extract double-payment from their customer support team. Gox blamed the bitcoin protocol for their own stupidity. Then after the press release, someone started a massive DoS attack against the bitcoin network. What happened to gox over the last couple of months is totally different from what what is going on right now.


No, you are wrong, sir. There are many who are recording all Bitcoin network traffic, myself included. I can see that Gox had all their outbound transactions slightly changed and rebroadcast. After that went public, being now outed and in the open, having nothing to gain from stealth the attacker moved to attacking everyone they could.


I actually removed the 100ms sleep.

I believe the change was made in release 0.8.6



Not exactly. The buggy wallet software, used by these exchanges, identifies transactions by their hash. Even if one of the duplicates is confirmed, the buggy wallet still thinks the other is a new transaction, because it has a different hash.

The fix is checking all inputs/outputs rather than relying on the transaction hash.


MtGox is the only one using the TXID hash to track unconfirmed transactions. The problem with the other wallets is that if you try and spend a change address from a rewritten transaction before it is confirmed then that transaction involving the change is then invalid.

Edit: Here is a good explanation of what this latest problem is which is different than the problem MtGox is struggling with http://www.reddit.com/r/Bitcoin/comments/1xm49o/due_to_activ...


You're right, I altered my response to remove the incorrect bit.


I don't understand how there can be any faith in the system if this is possible.


Seems like someone is definitely trying to cause panic by trying to do "btc withdrawal dos" on exchanges maybe in the hopes of driving the price of bitcoin down.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: