Double Spending - How To?

[achow101]

The merchant, in this case, is hoping to just use an Android smartphone/tablet with say the Bitcoin Wallet ap installed to accept bitcoin payments. At the end of the day (or week) the merchant would use a Philippines bitcoin exchange to convert the received bitcoin into PHP and have it deposited directly into his bank account.

Initially, bitcoin sales are likely to be only one or two a month so capital outlay has to be kept very low. I can not see him investing even one centavo in anything more complicated.

From the replies that I have received in this thread, it looks like my response to the merchant's "double spend" concerns will be:

There is a very slight risk of a double spend, however you have a greater risk of one of your staff giving free food/coffee to their friend than you have of experiencing a double spend.

A double spend generally requires a customer to spend the exact same amount of bitcoin again within seconds of the first transaction and that second transaction must be confirmed on the blockchain ledger before the first transaction. None of this is easy to do in the current environment.

I need to keep my response fairly simple. Would this response be reasonable?

A made a correction to that (bolded)

[CIYAM]

If he isn't using a payment merchant then he is actually going to leave himself wide open to people paying without correct fees and this is a "double spend" attack that requires virtually no skill and does not require sending the second tx within seconds (such a tx can be sent anytime later).

Assuming only a few BTC txs are expected in a week then maybe as long as he does check how many txs have confirmed at the end of the week he can decide whether or not it is worthwhile to continue taking the risk.

[Kakmakr]

You could implement something that might give instant payments without fee's. Hand out pamphlets to regular customers and encourage them to use a wallet with off-chain support. <Example = Xapo> If they transfer money from their Xapo account to his account, they pay zero fee's and the transaction is instant.

Xapo clients will like this, because there is no waiting time, and the merchant will be happy, because there is no risk of the transaction not getting confirmed.

It's just a temporary alternative to make up for the slower on-chain transactions in Bitcoin.  

[Mickeyb]

If he isn't using a payment merchant then he is actually going to leave himself wide open to people paying without correct fees and this is a "double spend" attack that requires virtually no skill and does not require sending the second tx within seconds (such a tx can be sent anytime later).

Assuming only a few BTC txs are expected in a week then maybe as long as he does check how many txs have confirmed at the end of the week he can decide whether or not it is worthwhile to continue taking the risk.

Aren't there some third party applications being developed that are dealing with this exact problematic? I remember reading about this, that there will be applications that will give you 99.9% ease of mind that the transaction is actually legit.

[CIYAM]

Aren't there some third party applications being developed that are dealing with this exact problematic? I remember reading about this, that there will be applications that will give you 99.9% ease of mind that the transaction is actually legit.

A transaction can still be "legit" but never get confirmed - if a tx has less fees than required then it won't be propagated at all (so the merchant wouldn't see it in the first place) but if the fee is exactly the bare minimum and the size of the tx is large then it is entirely possible the tx won't get confirmed (a situation that was occurring during the so called stress testing).

[Mickeyb]

Aren't there some third party applications being developed that are dealing with this exact problematic? I remember reading about this, that there will be applications that will give you 99.9% ease of mind that the transaction is actually legit.

A transaction can still be "legit" but never get confirmed - if a tx has less fees than required then it won't be propagated at all (so the merchant wouldn't see it in the first place) but if the fee is exactly the bare minimum and the size of the tx is large then it is entirely possible the tx won't get confirmed (a situation that was occurring during the so called stress testing).

Yes, yes I understand this. Once I have sent a transaction without the fee at all and it was stuck out there until I haven't double spend it. Well I guess that against this low or none tx fee problem there is no solution at all then.

[iram66680]

Aren't there some third party applications being developed that are dealing with this exact problematic? I remember reading about this, that there will be applications that will give you 99.9% ease of mind that the transaction is actually legit.

A transaction can still be "legit" but never get confirmed - if a tx has less fees than required then it won't be propagated at all (so the merchant wouldn't see it in the first place) but if the fee is exactly the bare minimum and the size of the tx is large then it is entirely possible the tx won't get confirmed (a situation that was occurring during the so called stress testing).

Yes, yes I understand this. Once I have sent a transaction without the fee at all and it was stuck out there until I haven't double spend it. Well I guess that against this low or none tx fee problem there is no solution at all then.

Double spending can be successful if the merchant is not aware that the mining pool have different policy from their client. example, if majority of the mining pool does not accept outputs with dust below 1000 satoshi, they will not mine it and the merchant's tablet will state that the invoice is paid.

Reference:https://www.mail-archive.com/bitcoin-dev@lists.linuxfoundation.org/msg00500.html

[rbscebu]

I hope my merchant doesn't see this topic. I can guess his response, "It looks to difficult and risky, I'll stick with cash only".

I have a meeting with his later next week.

[Possum577]

To keep this simple, let's assume I am using a wallet like Bitcoin Wallet by Bitcoin Wallet developers on an Android smartphone. I go into a coffee shop and buy using my bitcoin wallet. I understand that it is going to take about 5 to 10 minutes before the transaction is first registered on the Blockchain.

How can I then "double spend" my bitcoin?

Ha, you want to cheat and spend money you've already spent? What an ass! Why do you want to be a cheat? A fraud?

[Mickeyb]

I hope my merchant doesn't see this topic. I can guess his response, "It looks to difficult and risky, I'll stick with cash only".

I have a meeting with his later next week.

Well look, there is a risk everywhere. I think that the credit card chargeback rate is about 20-25% and merchants take this risk on themselves. But you are also using a logic that person that paid $3 for a cup of coffee won't be doing a chargeback. It's not worth a risk.

We can use the same logic about the Bitcoin double spend. But if you are looking for a 100% solution, I guess that Bitcoin is not ready for paying a coffee like Ciyam has said above. Honestly I am not sure that this will be ever necessary in order for Bitcoin to succeed.

[rbscebu]

Well look, there is a risk everywhere. I think that the credit card chargeback rate is about 20-25% and merchants take this risk on themselves. But you are also using a logic that person that paid $3 for a cup of coffee won't be doing a chargeback. It's not worth a risk.

We can use the same logic about the Bitcoin double spend. But if you are looking for a 100% solution, I guess that Bitcoin is not ready for paying a coffee like Ciyam has said above. Honestly I am not sure that this will be ever necessary in order for Bitcoin to succeed.

Mickeyb, you are thinking "western" here. The Philippines is not western. It is an under-developed third-world country. Less than 20% of adults (those 18yo and over) have a bank account. Less than 5% of all shop purchases are made with a credit/debit card.

Yes, a cup of coffee costs about USD2 to USD3 in the Philippines, but that is almost half a day's salary for most workers. A graduate engineer in the Philippines earns about USD15 per day. A shop salesperson earns about USD6.50 per 10 hour day.

[lemipawa]

I hope my merchant doesn't see this topic. I can guess his response, "It looks to difficult and risky, I'll stick with cash only".

I have a meeting with his later next week.

Philippines is not ready for Bitcoin transaction, the Philippine Government should work on the very slow internet service first before Philippine merchants can start using them. I know there are a few merchats out there who accepts bitcoin but still internet will play a big role in accepting this service.

[ranochigo]

I hope my merchant doesn't see this topic. I can guess his response, "It looks to difficult and risky, I'll stick with cash only".

I have a meeting with his later next week.

Philippines is not ready for Bitcoin transaction, the Philippine Government should work on the very slow internet service first before Philippine merchants can start using them. I know there are a few merchats out there who accepts bitcoin but still internet will play a big role in accepting this service.

Fast internet isn't required to accept Bitcoin at all. A slowish internet is fine for using POS systems like Bitpay with minimal delay. Transaction wise, it takes less than 3kb on average to send a transaction, no need for fast internet at all.

[Mickeyb]

Well look, there is a risk everywhere. I think that the credit card chargeback rate is about 20-25% and merchants take this risk on themselves. But you are also using a logic that person that paid $3 for a cup of coffee won't be doing a chargeback. It's not worth a risk.

We can use the same logic about the Bitcoin double spend. But if you are looking for a 100% solution, I guess that Bitcoin is not ready for paying a coffee like Ciyam has said above. Honestly I am not sure that this will be ever necessary in order for Bitcoin to succeed.

Mickeyb, you are thinking "western" here. The Philippines is not western. It is an under-developed third-world country. Less than 20% of adults (those 18yo and over) have a bank account. Less than 5% of all shop purchases are made with a credit/debit card.

Yes, a cup of coffee costs about USD2 to USD3 in the Philippines, but that is almost half a day's salary for most workers. A graduate engineer in the Philippines earns about USD15 per day. A shop salesperson earns about USD6.50 per 10 hour day.

Sorry mate, I wasn't aware of this. In this case if having few cups of coffee double spent would really hurt your friend salesman, you better think twice about doing it and accepting Bitcoin for such payments. It's all about that risk/reward ratio and if the risk is high for you guys than you better stay away from it.