The Red List

[datz]

Looking for another developer to take on board bitinsure (peercover) for a vital subproject not only for bitinsure but for the entire crypto-currency community

For more on the bitinsure project visit:
https://ripple.com/forum/viewtopic.php?f=1&t=2382

The Red List

The Red List is an anti-fraud/anti-theft subproject which allows us to identify wallet thieves even after money laundering and mixing.

In the case of private key/wallet loss money will never move out of the wallet. If it does we know it is fraud.

In the case of theft money will move out of the wallet. If the pool trusts the person it will approve the claim. We can track that stolen money across the blockchain or ledger, create a public red list of addresses, and flag that money as it is transferred. Basically a public record of theft. If directly used to buy anything or at an exchange, we can actually catch the thief if legal businesses choose to honor The Red List. If the thief uses a mixing service, we will flag that mixing service as a money launderer and will flag wallets the funds ultimately get mixed to, disincentiving users of mixing services (because you could inadvertently receive stolen funds and actually feel the consequences). Even if we are facing a professional money launderer and cannot directly catch a one-time thief, we can establish patterns which will allow us to prevent offenders from conducting transactions with legitimate businesses, forcing them underground.

Eventually we will get more sophisticated and even provide an API with which to check wallets against The Red List. Legal businesses could perform a simple API query to know if the wallet they choose to accept funds from is associated with stolen goods (first degree, second degree, etc). We could even go so far as to allow the legal merchant to send information such as address and name back to the registry after detecting a first or second degree red flag attempted wallet transaction in order to tie identities to The Red List entries.

To sign on PM me and visit https://c9.io/datz/bitinsure to gain project permissions.

[1714920436]

1714920436

[1714920436]

1714920436

[1714920436]

1714920436

[Chet]

This sounds interesting but I would really like a better explanation of exactly what a  mixing service would be.
It seems like if you did something as simple as allow donations to your wallet you might get hit with 'tainted money' - then what?
Next time you go to spend some BTC you find your wallet has been contaminated?
Someone with 'red' BTC could go all over the net and drop fractions and contaminate thousands of addresses?
What am I missing here?

[lexxus]

Thanks but we'll have soon KYC, AML and the rest all over us anyway

[datz]

Thanks but we'll have soon KYC, AML and the rest all over us anyway

This is mainly a "don't fuck with bitinsured wallets" measure so we actually know where tainted money is going and have a chance at IDing individuals. Businesses can choose to participate or not - it's not required regulation.

[datz]

This sounds interesting but I would really like a better explanation of exactly what a  mixing service would be.
It seems like if you did something as simple as allow donations to your wallet you might get hit with 'tainted money' - then what?
Next time you go to spend some BTC you find your wallet has been contaminated?
Someone with 'red' BTC could go all over the net and drop fractions and contaminate thousands of addresses?
What am I missing here?

Red list is not definite unless it is first degree. Second degree and beyond has to match a certain repeat theft threshold. You may get a questionnaire pertaining to what business/service/individual you got the money from when buying from a legitimate business or purchasing a legitimate service - that is all. As to donations and some kind of "robin hood" thievery - that is unlikely.

[datz]

Thanks but we'll have soon KYC, AML and the rest all over us anyway

With The Red List service we may worry less about the regulatory bodies and sanctions stepping in because they will not have a perceived "hole to fill" and we can keep our system controlled by the community, not by governments.

[phantastisch]

See here :

https://bitcointalk.org/index.php?topic=85433.0

Eventually everybody will be flagged. Bad Idea.

[Chet]

Red list is not definite unless it is first degree. Second degree and beyond has to match a certain repeat theft threshold. You may get a questionnaire pertaining to what business/service/individual you got the money from when buying from a legitimate business or purchasing a legitimate service - that is all. As to donations and some kind of "robin hood" thievery - that is unlikely.

I don't see what I described as 'robin hood' at all. I put on my 'pretend I am a thief hat' and cover my tracks by confusing the issue as much as possible.
I spam thousands of addresses with tiny fractions and make a huge mess ...
I am not a thief so I am sure practiced scammers have lots more ideas.
Anyway what is a 'mixing service'? Would something takes btc for things and pays btc for other things wind up 'mixing' by default?
So to avoid getting 'contaminated' you would need more processing and questioning of depositors?  Starting to sound like dealing with paypal.

[lexxus]

Thanks but we'll have soon KYC, AML and the rest all over us anyway

This is mainly a "don't fuck with bitinsured wallets" measure so we actually know where tainted money is going and have a chance at IDing individuals. Businesses can choose to participate or not - it's not required regulation.

I see. Seems like a good project then. Good luck with this.

[datz]

See here :

https://bitcointalk.org/index.php?topic=85433.0

Eventually everybody will be flagged. Bad Idea.

No, the algorithm is based on averages, so not everyone will be flagged - only those closely associated with fraud or theft with repeat offenses. It is an indefinite algorithm. Even if you are flagged, you are put under suspicion or investigation not fully blackballed.  

[datz]

Red list is not definite unless it is first degree. Second degree and beyond has to match a certain repeat theft threshold. You may get a questionnaire pertaining to what business/service/individual you got the money from when buying from a legitimate business or purchasing a legitimate service - that is all. As to donations and some kind of "robin hood" thievery - that is unlikely.

I don't see what I described as 'robin hood' at all. I put on my 'pretend I am a thief hat' and cover my tracks by confusing the issue as much as possible.
I spam thousands of addresses with tiny fractions and make a huge mess ...
I am not a thief so I am sure practiced scammers have lots more ideas.
Anyway what is a 'mixing service'? Would something takes btc for things and pays btc for other things wind up 'mixing' by default?
So to avoid getting 'contaminated' you would need more processing and questioning of depositors?  Starting to sound like dealing with paypal.

Well if you spammed thousands of addresses small transactions to addresses you do not own you will be giving away money pointlessly and will defeat the purpose of the theft. If you own the addresses we will catch you when you spend at a legitimate business by looking at the patterns in the block chain. We can include a transaction threshold if you choose to attempt to intentionally taint many wallets.

A mixing service is a way to launder money which involves mixing BTC up among many wallets. The only reason to use such a service is for anonymity purposes. If we can prove that stolen first degree money enters such a service we can gather evidence to shut them down as money launderers.

There are no regulations or blocked/frozen accounts so it is nothing like PayPal. Solely at legitimate businesses discretion.

[phantastisch]

See here :

https://bitcointalk.org/index.php?topic=85433.0

Eventually everybody will be flagged. Bad Idea.

No, the algorithm is based on averages, so not everyone will be flagged - only those closely associated with fraud or theft with repeat offenses. It is an indefinite algorithm. Even if you are flagged, you are put under suspicion or investigation not fully blackballed.  

Besides that you are practically discouraging my anonymity. May I discourage yours and ask for a passport ? Provide it so i know that you are not a scammer or selling my data to a private company. If you don't you are under suspicion now.

[datz]

See here :

https://bitcointalk.org/index.php?topic=85433.0

Eventually everybody will be flagged. Bad Idea.

No, the algorithm is based on averages, so not everyone will be flagged - only those closely associated with fraud or theft with repeat offenses. It is an indefinite algorithm. Even if you are flagged, you are put under suspicion or investigation not fully blackballed.  

Besides that you are practically discouraging my anonymity. May I discourage yours and ask for a passport ? Provide it so i know that you are not a scammer or selling my data to a private company. If you don't you are under suspicion now.

The Red List in no way asks for personal information or requires that personal information is verified. It simply checks your wallet public address against our database. If your wallet is directly associated with theft, the business or service may report your address or any other information you gave to that service or business. That is all.

[datz]

See here :

https://bitcointalk.org/index.php?topic=85433.0

Eventually everybody will be flagged. Bad Idea.

No, the algorithm is based on averages, so not everyone will be flagged - only those closely associated with fraud or theft with repeat offenses. It is an indefinite algorithm. Even if you are flagged, you are put under suspicion or investigation not fully blackballed.  

Besides that you are practically discouraging my anonymity. May I discourage yours and ask for a passport ? Provide it so i know that you are not a scammer or selling my data to a private company. If you don't you are under suspicion now.

The Red List in no way asks for personal information or requires that personal information is verified. It simply checks your wallet public address against our database. If your wallet is directly associated with theft, the business or service may report your address or any other information you gave to that service or business. That is all.

In this way The Red List retains perfect anonymity - unless your wallet meets the Red List threshold in which case the verifying business may deny you service, issue you a questionnaire as to where you got the money, or in extreme, definite cases send a delivery address or identifying information to Red List servers.

[phantastisch]

See here :

https://bitcointalk.org/index.php?topic=85433.0

Eventually everybody will be flagged. Bad Idea.

No, the algorithm is based on averages, so not everyone will be flagged - only those closely associated with fraud or theft with repeat offenses. It is an indefinite algorithm. Even if you are flagged, you are put under suspicion or investigation not fully blackballed.  

Besides that you are practically discouraging my anonymity. May I discourage yours and ask for a passport ? Provide it so i know that you are not a scammer or selling my data to a private company. If you don't you are under suspicion now.

The Red List in no way asks for personal information or requires that personal information is verified. It simply checks your wallet public address against our database. If your wallet is directly associated with theft, the business or service may report your address or any other information you gave to that service or business. That is all.

In this way The Red List retains perfect anonymity - unless your wallet meets the Red List threshold in which case the verifying business may deny you service, issue you a questionnaire as to where you got the money, or in extreme, definite cases send a delivery address or identifying information to Red List servers.

You introducing a system that imposes a form of taint does nothing to prevent theft but does make using Bitcoin a hassle for those who are innocent.

Therefore I do not support this and will vigorously reject any movement towards this initiative and any like it.

[Chet]

So we are creating our own cops ...
Who watches the watchers?

[datz]

You introducing a system that imposes a form of taint does nothing to prevent theft but does make using Bitcoin a hassle for those who are innocent.

Therefore I do not support this and will vigorously reject any movement towards this initiative and any like it.

It prevents theft by creating a psychological knowledge of accountability on some level and making thieves work harder to launder and spend bitcoin. The innocent might as well not know this system exists because they will never experience it, will never be affected by it, and will never threaten their anonymity.

[nwbitcoin]

This is a nice idea that will possibly serve better as a suggestion that bitcoin is regulated against fraud, rather than be a tool to prevent it.

There are far too many ways that fraud can take place, that I can't see this project being much more than the equivalent to Spamhaus for the Bitcoin community.

However, if it wasn't for the likes of Spamhaus, would email be used as much as it is today?  Would email be subject to far more regulation?

I like the Red List project, but please try to explain to some of the hard of thinking on this forum that its not a way to prevent crime!

[datz]

You introducing a system that imposes a form of taint does nothing to prevent theft but does make using Bitcoin a hassle for those who are innocent.

Therefore I do not support this and will vigorously reject any movement towards this initiative and any like it.

It prevents theft by creating a psychological knowledge of accountability on some level and making thieves work harder to launder and spend bitcoin. The innocent might as well not know this system exists because they will never experience it, will never be affected by it, and will never threaten their anonymity.

The Red List will also hinder more invasive regulation that could come to Bitcoin via governments by filling a perceived gap in fraud/theft prevention.

[datz]

So we are creating our own cops ...
Who watches the watchers?

The algorithms will be open sourced and the database completely open *except for identifying information businesses may submit.

[Chet]

I still don't see how honest business that has btc in and btc out avoids getting contaminated and having to jump thru hoops to clear their 'name'.
It really strikes me much like gun registration, punish the innocent because of a few bad eggs.

Better idea to work on  theft prevention.

[datz]

This is a nice idea that will possibly serve better as a suggestion that bitcoin is regulated against fraud, rather than be a tool to prevent it.

There are far too many ways that fraud can take place, that I can't see this project being much more than the equivalent to Spamhaus for the Bitcoin community.

However, if it wasn't for the likes of Spamhaus, would email be used as much as it is today?  Would email be subject to far more regulation?

I like the Red List project, but please try to explain to some of the hard of thinking on this forum that its not a way to prevent crime!

It prevents crime by creating a psychological deterrent.

Here is a story to clarify:

My friend John insures his wallet in a custom insurance group in Bitinsure.

His wallet is hacked and 20 BTC are stolen and sent to the thief's wallet.

We submit the thief's first degree wallet address to The Red List.

Using the same wallet, the thief attempts to pay for an OKCupid subscription.

OkCupid runs the public address against The Red List using the API and gets a first degree match - a definite redlist.

Since the wallet is first degree, OkCupid decides to send personal information gleaned from the thief's OkCupid profile to The Red List for investigation.

Here is a second story:

My friend John insures his wallet in a custom insurance group in Bitinsure.

His wallet is hacked and 20 BTC are stolen and sent to the thief's wallet.

We submit the thief's first degree wallet address to The Red List.

The thief sends the BTC to two more wallets.

We submit the second degree wallet addresses to The Red List.

The thief uses one wallet to purchase cooking ware on Amazon via BitSpend.

BitSpend checks the wallet address against The Red List, gets a second degree match, and issues the thief a questionnaire asking where he got the money from at the time of purchase. BitSpend may also send minimal identifying information such as a piece of the address back to The Red List for private storage and factoring into the indefinite algorithm which will increase The Red List ranking if the same minimal identification information is flagged/sent again by the same or another business.  

The thief gets his cooking ware from Amazon via BitSpend but after the questionnaire is apprehensive so decides to use a mixing service on the contents of the second wallet.

The thief mixes his BTC and gets BTC transferred into a new wallet.

A different person who used the mixing service spends the BTC on a Gyft gift certificate. Gyft runs the public address against The Red List and issues that second person a questionnaire - that person reveals he recently used a mixing service and names the service. The results of the questionnaire are sent to The Red List.

The Red List now has money laundering evidence against the mixing service and suspicions against/algorithm inputs for an identifying piece of information from the first wallet.

[datz]

I still don't see how honest business that has btc in and btc out avoids getting contaminated and having to jump thru hoops to clear their 'name'.
It really strikes me much like gun registration, punish the innocent because of a few bad eggs.

Better idea to work on  theft prevention.

Their name will never be tainted - only the first degree flagged wallet. A BTC in BTC out business may register with The Red List and even if the business does not register will only ever get flagged as a second degree. If that business never spends BTC out of the receptive wallet, they will never even get a second degree notice. Any information submitted by concerned parties after a second degree spend will validate that business as a BTC in BTC out - so they need not worry. They will never be publicly tainted.

Also, hopefully that business will be screening tainted money anyway by running against The Red List and The Red List will factor in this screening.

[Chet]

I still dont know what you mean by a mixing service.
How about I take some of that stolen btc (from the wallet John should have secured) and make some bets at satoshi dice or play poker or something.
Are all of those gambling sites now 'contaminated'? All the money coming from them is considered 'secondary'?

So another person wins big playing poker and now can't spend the money without jumping thru hoops?

[datz]

I still dont know what you mean by a mixing service.
How about I take some of that stolen btc (from the wallet John should have secured) and make some bets at satoshi dice or play poker or something.
Are all of those gambling sites now 'contaminated'? All the money coming from them is considered 'secondary'?

So another person wins big playing poker and now can't spend the money without jumping thru hoops?

No, no wallets are ever "contaminated" except for the first degree wallet - just under surveillance.

The gambling site would be wise to run the wallet against The Red List before accepting payment.

If the gambling site registered with The Red List, it need not worry.

If not, the site may get prompted with a questionnaire if directly attempting to spend second degree flagged BTC at a legitimate business.

The person winning at poker would be third degree at most and if repeatedly spends surveilled BTC may have to answer a questionnaire or may make The Red List after repeated low degree BTC flagged purchases at legitimate businesses if statistically determined he is in possession of stolen funds at a statistically significant rate much higher (alpha of 0.02) than average possession of stolen funds.  

[Chet]

Well I am convinced now earlier poster here that said all btc would wind up flagged is pretty much right.
And you will be asking people to do stuff for you, check the list, answer questions etc.
That sort of thing is already rampant enough with places like paypal freezing accounts and making people jump thru hoops because they set off some 'alarm' in a perfectly innocent way.

I think companies have it bad enough being forced to perform as agents of the government (collect taxes) for free and now you want all BTC companies to work for your insurance program for free.

[datz]

Really the point is to establish a psychological deterrent against theft - The Red List will not violate anyone's privacy or peg anyone's wallet as "contaminated" unless it is first degree. The Red List will not publicly shame or incriminate anyone - it will act to promote awareness. At any time you may check your wallet to see if the BTC you just received or accepted was directly stolen. You can better establish networks of trust. It is really a public service.

The Red List is not a requirement and is not a regulation.

[datz]

Well I am convinced now earlier poster here that said all btc would wind up flagged is pretty much right.
And you will be asking people to do stuff for you, check the list, answer questions etc.
That sort of thing is already rampant enough with places like paypal freezing accounts and making people jump thru hoops because they set off some 'alarm' in a perfectly innocent way.

I think companies have it bad enough being forced to perform as agents of the government (collect taxes) for free and now you want all BTC companies to work for your insurance program for free.

No one will be flagged except for definite thieves.

There are no hoops to jump through unless you are attempting to spend directly stolen BTC. Even then it is maximum a click through one field form.

The companies are actually working for themselves. By including one line of code to check public addresses, they are deterring expensive regulation, performing a public service, and preventing expensive government suits.

[datz]

Well I am convinced now earlier poster here that said all btc would wind up flagged is pretty much right.
And you will be asking people to do stuff for you, check the list, answer questions etc.
That sort of thing is already rampant enough with places like paypal freezing accounts and making people jump thru hoops because they set off some 'alarm' in a perfectly innocent way.

I think companies have it bad enough being forced to perform as agents of the government (collect taxes) for free and now you want all BTC companies to work for your insurance program for free.

Companies may chose to ignore The Red List - but they will only end up paying more later down the line when world governments step in with more expensive regulation and stricter standards. I suspect more companies would rather choose to embrace an open-sourced community-driven project that actually does this right.

[Chet]

Sounds like TSA.
Its for your own good, we are helping protect you.

[datz]

Sounds like TSA.
Its for your own good, we are helping protect you.

Well TSA does not protect you from government regulation, they are government regulation. The Red List is controlled by you, so you are essentially regulating yourself in a way that deters regulation you do not control and in a way that honestly protects people and deters theft.

[Chet]

No
The red list is controlled by you. By whatever rules (regulations) you chose to make.
TSA  just wanted me to go thru metal detectors
then they wanted shoes off
now they practically rape 

You want 1 line of code and a questionnaire and some companies to register.
Whats next?

[datz]

No
The red list is controlled by you. By whatever rules (regulations) you chose to make.
TSA  just wanted me to go thru metal detectors
then they wanted shoes off
now they practically rape 

You want 1 line of code and a questionnaire and some companies to register.
Whats next?

No if it is open-sourced it really is not controlled by me. All the algorithms will be public information. It is not up to me whether companies choose to run public addresses by the register. Some of the private identifying information might be privy to my organization but that is all.

The Red List is not under my control. Sure it will help bitinsure deter theft against insured wallets, but that is only the tip of the iceberg in terms of public benefits.

The list is simply information companies may choose to add to or run queries against. Key word choose.

The Red List is a deterrent against regulation that is on the horizon. Without a preemptive response, a preemptive strike, the Bitcoin community will get hid hard by upcoming, fee imposing regulation. I have never been wrong and never will be.

We need a way to maintain anonymity and satisfy government agencies - we see what is happening with U.S. homeland security vs Mt. Gox.

It's better that we control our own economy and our own theft/fraud prevention measures than government agencies.

We need The Red List. 

[datz]

The U.S. government could start a fraud/theft reporting service right now and fine/audit all companies which accept payments from wallets receiving stolen funds. The block chain is public information. Everyone could get shut down in the next month. Would you rather take preventative measures or sit on your arse and watch Bitcoin burn?

[Chet]

Let it burn
What you say makes no sense
1) US gov  can't control the whole world
2) TSA is still there, airlines are not 'trusted' to police themselves

[datz]

Let it burn
What you say makes no sense
1) US gov  can't control the whole world
2) TSA is still there, airlines are not 'trusted' to police themselves

1) Any company registered in any country is subject to that country's regulations and laws

2) If the airlines had done a good job of policing themselves the TSA would be unnecessary and would not exist.

[Chet]

Let it burn
What you say makes no sense
1) US gov  can't control the whole world
2) TSA is still there, airlines are not 'trusted' to police themselves

2) If the airlines had done a good job of policing themselves the TSA would be unnecessary and would not exist.

I got some nice coastal property in Arizona, cheap.
 

[Peter Todd]

If the thief uses a mixing service, we will flag that mixing service as a money launderer and will flag wallets the funds ultimately get mixed to, disincentiving users of mixing services

As for those Bitcoin users who like their coins to be fungible, I'm one of a few people looking into how to create a mixing capability within Bitcoin itself that will let you automatically mix your coins with others, potentially as often as every transaction you make. This mixing is done in a trust-free manner; you're coins can-not be stolen by mixing them. This will increase financial privacy for all Bitcoin users, and as a nice side-effect reduce transaction costs by about %10 (large transactions are more efficient than multiple small ones)

[datz]

If the thief uses a mixing service, we will flag that mixing service as a money launderer and will flag wallets the funds ultimately get mixed to, disincentiving users of mixing services

As for those Bitcoin users who like their coins to be fungible, I'm one of a few people looking into how to create a mixing capability within Bitcoin itself that will let you automatically mix your coins with others, potentially as often as every transaction you make. This mixing is done in a trust-free manner; you're coins can-not be stolen by mixing them. This will increase financial privacy for all Bitcoin users, and as a nice side-effect reduce transaction costs by about %10 (large transactions are more efficient than multiple small ones)

Sounds great for anonymity as long as it does not bog down transactions. Scalability is already an issue.

[datz]

If the thief uses a mixing service, we will flag that mixing service as a money launderer and will flag wallets the funds ultimately get mixed to, disincentiving users of mixing services

As for those Bitcoin users who like their coins to be fungible, I'm one of a few people looking into how to create a mixing capability within Bitcoin itself that will let you automatically mix your coins with others, potentially as often as every transaction you make. This mixing is done in a trust-free manner; you're coins can-not be stolen by mixing them. This will increase financial privacy for all Bitcoin users, and as a nice side-effect reduce transaction costs by about %10 (large transactions are more efficient than multiple small ones)

Also, with built in mixing governments cannot impose regulation and cannot track transfers - sort of like the whole legalities of the Mega in-browser encryption bit. But, for the time being, without built in mixing, we still need The Red List or Bitcoin companies will be taken down like Mega (for accepting stolen funds rather than hosting copyrighten content).

[Cryptoman]

As for those Bitcoin users who like their coins to be fungible, I'm one of a few people looking into how to create a mixing capability within Bitcoin itself that will let you automatically mix your coins with others, potentially as often as every transaction you make.

You're not alone.  Fungibility is an important property of money, and I'd be opposed to anything which reduces Bitcoin's fungibility and therefore value.

I think the OP's proposal does not take into account how the Satoshi client/server works.  Accounts are not equivalent to addresses.  If bitcoind is used to operate an online wallet, then a withdrawal from any given account will not necessarily use the same coins that were deposited.  It all depends on how many other transactions have occurred and in what amounts.  So, a thief could deposit his booty in an online wallet, and some innocent person will very likely receive the tainted coins.

[bytemaster]

The problem is how to define a 'guilty' party?   I could send you money, then claim you stole it.   How would you *prove* you didn't steal my money?   I suppose you could 'send it back'... But I already consumed what ever good/service you gave me 'under the table' for that money.   Thus to protect myself we would need to have receipts for every transaction.   Then we have the race condition on the receipts... if I give you the receipt before you give me the coin... opps..  if I give you the coin before you give me the receipt... screwed again.

End result is that you would need even more infrastructure along the lines of Open Transactions as well as custom block-chain support for 'conditional exchanges of information for coins'.

The result of this is that bitcoin could no longer be used for any transaction that you would want 'kept private'.  Ie:  I purchased sex then claim the prostitute 'stole' my money.   The prostitute would then have to 'prove' she gave me sex in exchange for that money AND what the agreed price was.  The mere existence of such proof would threaten her liberty in todays society.

Otherwise the red list can be abused like the no-fly list or any other 'list'.  What is the burden of proof for 'stolen' money?

[David Rabahy]

A case for multisig?  A mutually agreeable, er, discrete 3rd party is designated as the arbiter.  The Bitcoin transaction requires only 2 of 3 signatures.  If the original parties are, er, mutually satisfied then both sign and the arbiter is not engaged.  If there is a dispute then each makes their case and then the arbiter signs or not accordingly.

[franky1]

so let me get this right. an insurance company for bitcoins lol

what is the point. how about a few basic lessons in not trusting strangers that dont want to give out personal info, dont want to use escrow and don't have proof they have the product they wish to sell.

i see many people sending coins to a address owned by themselves and then claim that the funds are stolen or the recipient (nonexistant in reality) did not forfill their contract, thus doubling their coins.

bitcoin does not need insurance. what it needs is to teach the sheeple the proper etiquette and money management skills that they never learned as kids because they relied on the trust of banks so much.

basic lesson one.
legitimate and regulated insurance companies will NEVER get involved with a contract/payment transaction involving illegal products or services. so anyone wishing to claim a loss due to a dodgy deal for illegal goods (the only reason not to reveal true identity), the insurance company will not pay out, due to the funds being linked to funding drugs/weapons purchases ETC.

basic lesson two.
if your handing out coins to a legitimate business, then do some due diligence checks and gather intel about the company. EG there is enough information about bitcoinstore.com mtgox.com to trust them enough to do transactions with, without the need for insurance.

basic lesson three.
a 'person' saying they are an insurance company and promises to reimburse losses no matter what product/service/contract type was not forfilled obviously does not have an insurance license, so you are more then likey to get burnt twice, once for the so called loss and secondly from the premium costs that will never pay out.

[nwbitcoin]

This is a nice idea that will possibly serve better as a suggestion that bitcoin is regulated against fraud, rather than be a tool to prevent it.

There are far too many ways that fraud can take place, that I can't see this project being much more than the equivalent to Spamhaus for the Bitcoin community.

However, if it wasn't for the likes of Spamhaus, would email be used as much as it is today?  Would email be subject to far more regulation?

I like the Red List project, but please try to explain to some of the hard of thinking on this forum that its not a way to prevent crime!

It prevents crime by creating a psychological deterrent.

Here is a story to clarify:

My friend John insures his wallet in a custom insurance group in Bitinsure.

His wallet is hacked and 20 BTC are stolen and sent to the thief's wallet.

We submit the thief's first degree wallet address to The Red List.

Using the same wallet, the thief attempts to pay for an OKCupid subscription.

OkCupid runs the public address against The Red List using the API and gets a first degree match - a definite redlist.

Since the wallet is first degree, OkCupid decides to send personal information gleaned from the thief's OkCupid profile to The Red List for investigation.

Here is a second story:

My friend John insures his wallet in a custom insurance group in Bitinsure.

His wallet is hacked and 20 BTC are stolen and sent to the thief's wallet.

We submit the thief's first degree wallet address to The Red List.

The thief sends the BTC to two more wallets.

We submit the second degree wallet addresses to The Red List.

The thief uses one wallet to purchase cooking ware on Amazon via BitSpend.

BitSpend checks the wallet address against The Red List, gets a second degree match, and issues the thief a questionnaire asking where he got the money from at the time of purchase. BitSpend may also send minimal identifying information such as a piece of the address back to The Red List for private storage and factoring into the indefinite algorithm which will increase The Red List ranking if the same minimal identification information is flagged/sent again by the same or another business.  

The thief gets his cooking ware from Amazon via BitSpend but after the questionnaire is apprehensive so decides to use a mixing service on the contents of the second wallet.

The thief mixes his BTC and gets BTC transferred into a new wallet.

A different person who used the mixing service spends the BTC on a Gyft gift certificate. Gyft runs the public address against The Red List and issues that second person a questionnaire - that person reveals he recently used a mixing service and names the service. The results of the questionnaire are sent to The Red List.

The Red List now has money laundering evidence against the mixing service and suspicions against/algorithm inputs for an identifying piece of information from the first wallet.

What if John was lying and he did all the spending himself and just claimed, and even did the hacking himself - how does this prevent that?

[Aswan]

A Thief could just sent a few satoshis to the 1000 richest bitcoin adresses. That way either coins related to his adress will be accepted or most bitcoins wont be able to be used at places which use the red list.

The red list therefore would cause its users to lose a majority of their customers which would make them abandon the list asap.

[franky1]

so to add a insurance company think that a dating website and amazon would breach their data protection and privacy terms to hand out customer information and payment details without a court order??

goodluck

[datz]

so let me get this right. an insurance company for bitcoins lol

what is the point. how about a few basic lessons in not trusting strangers that dont want to give out personal info, dont want to use escrow and don't have proof they have the product they wish to sell.

i see many people sending coins to a address owned by themselves and then claim that the funds are stolen or the recipient (nonexistant in reality) did not forfill their contract, thus doubling their coins.

bitcoin does not need insurance. what it needs is to teach the sheeple the proper etiquette and money management skills that they never learned as kids because they relied on the trust of banks so much.

basic lesson one.
legitimate and regulated insurance companies will NEVER get involved with a contract/payment transaction involving illegal products or services. so anyone wishing to claim a loss due to a dodgy deal for illegal goods (the only reason not to reveal true identity), the insurance company will not pay out, due to the funds being linked to funding drugs/weapons purchases ETC.

basic lesson two.
if your handing out coins to a legitimate business, then do some due diligence checks and gather intel about the company. EG there is enough information about bitcoinstore.com mtgox.com to trust them enough to do transactions with, without the need for insurance.

basic lesson three.
a 'person' saying they are an insurance company and promises to reimburse losses no matter what product/service/contract type was not forfilled obviously does not have an insurance license, so you are more then likey to get burnt twice, once for the so called loss and secondly from the premium costs that will never pay out.

We have worked out a series of checks and balances. Bitinsure is not a typical insurance company like you assume. We have worked out a new schema only possible via the Bitcoin or Ripple protocols which avoids all regulation.  See the thread linked to on post #1.

[datz]

so to add a insurance company think that a dating website and amazon would breach their data protection and privacy terms to hand out customer information and payment details without a court order??

goodluck

They will not breach their privacy terms if asked to accept primary stolen funds. World governments may easily level regulation forcing them to do this or fining them for accepting stolen funds as payment. It is in their best interests to check addresses against the list at a bare minimum.   

[datz]

A Thief could just sent a few satoshis to the 1000 richest bitcoin adresses. That way either coins related to his adress will be accepted or most bitcoins wont be able to be used at places which use the red list.

The red list therefore would cause its users to lose a majority of their customers which would make them abandon the list asap.

We have a minimum threshold for taint unless those satoshis are eventually conglomerated into the same wallet again.

[datz]

This is a nice idea that will possibly serve better as a suggestion that bitcoin is regulated against fraud, rather than be a tool to prevent it.

There are far too many ways that fraud can take place, that I can't see this project being much more than the equivalent to Spamhaus for the Bitcoin community.

However, if it wasn't for the likes of Spamhaus, would email be used as much as it is today?  Would email be subject to far more regulation?

I like the Red List project, but please try to explain to some of the hard of thinking on this forum that its not a way to prevent crime!

It prevents crime by creating a psychological deterrent.

Here is a story to clarify:

My friend John insures his wallet in a custom insurance group in Bitinsure.

His wallet is hacked and 20 BTC are stolen and sent to the thief's wallet.

We submit the thief's first degree wallet address to The Red List.

Using the same wallet, the thief attempts to pay for an OKCupid subscription.

OkCupid runs the public address against The Red List using the API and gets a first degree match - a definite redlist.

Since the wallet is first degree, OkCupid decides to send personal information gleaned from the thief's OkCupid profile to The Red List for investigation.

Here is a second story:

My friend John insures his wallet in a custom insurance group in Bitinsure.

His wallet is hacked and 20 BTC are stolen and sent to the thief's wallet.

We submit the thief's first degree wallet address to The Red List.

The thief sends the BTC to two more wallets.

We submit the second degree wallet addresses to The Red List.

The thief uses one wallet to purchase cooking ware on Amazon via BitSpend.

BitSpend checks the wallet address against The Red List, gets a second degree match, and issues the thief a questionnaire asking where he got the money from at the time of purchase. BitSpend may also send minimal identifying information such as a piece of the address back to The Red List for private storage and factoring into the indefinite algorithm which will increase The Red List ranking if the same minimal identification information is flagged/sent again by the same or another business.  

The thief gets his cooking ware from Amazon via BitSpend but after the questionnaire is apprehensive so decides to use a mixing service on the contents of the second wallet.

The thief mixes his BTC and gets BTC transferred into a new wallet.

A different person who used the mixing service spends the BTC on a Gyft gift certificate. Gyft runs the public address against The Red List and issues that second person a questionnaire - that person reveals he recently used a mixing service and names the service. The results of the questionnaire are sent to The Red List.

The Red List now has money laundering evidence against the mixing service and suspicions against/algorithm inputs for an identifying piece of information from the first wallet.

What if John was lying and he did all the spending himself and just claimed, and even did the hacking himself - how does this prevent that?

If he used any personal information to do the spending and if he released any personal information on Bitinsure to increase his credibility we would detect the scam via The Red List. If his insurance pool decided to approve his claim that means they trusted him and the group is partially responsible for the loss. 

[datz]

The problem is how to define a 'guilty' party?   I could send you money, then claim you stole it.   How would you *prove* you didn't steal my money?   I suppose you could 'send it back'... But I already consumed what ever good/service you gave me 'under the table' for that money.   Thus to protect myself we would need to have receipts for every transaction.   Then we have the race condition on the receipts... if I give you the receipt before you give me the coin... opps..  if I give you the coin before you give me the receipt... screwed again.

End result is that you would need even more infrastructure along the lines of Open Transactions as well as custom block-chain support for 'conditional exchanges of information for coins'.

The result of this is that bitcoin could no longer be used for any transaction that you would want 'kept private'.  Ie:  I purchased sex then claim the prostitute 'stole' my money.   The prostitute would then have to 'prove' she gave me sex in exchange for that money AND what the agreed price was.  The mere existence of such proof would threaten her liberty in todays society.

Otherwise the red list can be abused like the no-fly list or any other 'list'.  What is the burden of proof for 'stolen' money?

There is no incentive to report money stolen unless it was actually stolen and you actually expect to get the money back. In order to get the money back you would have to prove via authorities you did not receive a given good or service. If you are Bitinsured, you simply have to convince your pool and establish trust so pool members will approve your claim. If you simply reported someone out of spite, the authorities would figure this out and prosecute you instead. The Red List does not necessarily limit red listed addresses in any way - just provides a mean of tracking suspected individuals - if the data matches up then The Red List produces evidence against individuals. 

I could go up to a homeless person and drop $20 cash in his hat and then claim he "stole" the money. The system of trust and persecution is actually the same.

[datz]

As for those Bitcoin users who like their coins to be fungible, I'm one of a few people looking into how to create a mixing capability within Bitcoin itself that will let you automatically mix your coins with others, potentially as often as every transaction you make.

You're not alone.  Fungibility is an important property of money, and I'd be opposed to anything which reduces Bitcoin's fungibility and therefore value.

I think the OP's proposal does not take into account how the Satoshi client/server works.  Accounts are not equivalent to addresses.  If bitcoind is used to operate an online wallet, then a withdrawal from any given account will not necessarily use the same coins that were deposited.  It all depends on how many other transactions have occurred and in what amounts.  So, a thief could deposit his booty in an online wallet, and some innocent person will very likely receive the tainted coins.

The Satoshi client/server system is common knowledge.

Most "online wallet" services do not automatically mix coins or spend coins from a mixed/common pool.

It's not really a "same coins" thing - but a "same address" thing.

We can still track most transactions.

If coins are mixed they become second degree, third degree, etc. and may prompt a one field form but that is all.

If an "online wallet" system mixes coins and is associated with first degree theft, it may be classified as a money launderer.

[smoothie]

Is this directly involved with ripple development?

[datz]

Is this directly involved with ripple development?

We are making suggestions for the Ripple API, but no, are not directly associated with the Ripple project.

We are fully interfacing with the Ripple protocol because of speed, reliability, connections to gateways, and the ability to transact with debt among trusted individuals, allowing for the complex social constructs and structures vital to the workings of the first "distributed" insurance platform and real time distributed claim payments.

[luv2drnkbr]

As long as this is a separate voluntary thing and not a protocol change (which looks to be true), I'm good with it.

[Littleshop]

I still dont know what you mean by a mixing service.
How about I take some of that stolen btc (from the wallet John should have secured) and make some bets at satoshi dice or play poker or something.
Are all of those gambling sites now 'contaminated'? All the money coming from them is considered 'secondary'?

So another person wins big playing poker and now can't spend the money without jumping thru hoops?

No, no wallets are ever "contaminated" except for the first degree wallet - just under surveillance.

The gambling site would be wise to run the wallet against The Red List before accepting payment.

If the gambling site registered with The Red List, it need not worry.

If not, the site may get prompted with a questionnaire if directly attempting to spend second degree flagged BTC at a legitimate business.

The person winning at poker would be third degree at most and if repeatedly spends surveilled BTC may have to answer a questionnaire or may make The Red List after repeated low degree BTC flagged purchases at legitimate businesses if statistically determined he is in possession of stolen funds at a statistically significant rate much higher (alpha of 0.02) than average possession of stolen funds.  

There would be almost no advantage and huge disadvantages for a poker (or any gambling) site dealing with something like the red list.  First of all there are many transactions and even a low percentage being flagged would be a huge increase in the labor for the site.  The poker site would then be asking power players where they got their BTC from?  Most gambling sites collect little or no data on a customer and the customers like it like that.  With no participation from gambling sites, especially ones like SD that are fully automated, gambling sites would act as complex mixers and render the red list useless.

[datz]

I still dont know what you mean by a mixing service.
How about I take some of that stolen btc (from the wallet John should have secured) and make some bets at satoshi dice or play poker or something.
Are all of those gambling sites now 'contaminated'? All the money coming from them is considered 'secondary'?

So another person wins big playing poker and now can't spend the money without jumping thru hoops?

No, no wallets are ever "contaminated" except for the first degree wallet - just under surveillance.

The gambling site would be wise to run the wallet against The Red List before accepting payment.

If the gambling site registered with The Red List, it need not worry.

If not, the site may get prompted with a questionnaire if directly attempting to spend second degree flagged BTC at a legitimate business.

The person winning at poker would be third degree at most and if repeatedly spends surveilled BTC may have to answer a questionnaire or may make The Red List after repeated low degree BTC flagged purchases at legitimate businesses if statistically determined he is in possession of stolen funds at a statistically significant rate much higher (alpha of 0.02) than average possession of stolen funds.  

There would be almost no advantage and huge disadvantages for a poker (or any gambling) site dealing with something like the red list.  First of all there are many transactions and even a low percentage being flagged would be a huge increase in the labor for the site.  The poker site would then be asking power players where they got their BTC from?  Most gambling sites collect little or no data on a customer and the customers like it like that.  With no participation from gambling sites, especially ones like SD that are fully automated, gambling sites would act as complex mixers and render the red list useless.

Gambling sites would probably not use The Red List and would not need to since they are illegal in many countries anyway.

Gambling sites are not a good way to mix funds/wash BTC since you have a potential to lose money.

[datz]

If the thief uses a mixing service, we will flag that mixing service as a money launderer and will flag wallets the funds ultimately get mixed to, disincentiving users of mixing services

As for those Bitcoin users who like their coins to be fungible, I'm one of a few people looking into how to create a mixing capability within Bitcoin itself that will let you automatically mix your coins with others, potentially as often as every transaction you make. This mixing is done in a trust-free manner; you're coins can-not be stolen by mixing them. This will increase financial privacy for all Bitcoin users, and as a nice side-effect reduce transaction costs by about %10 (large transactions are more efficient than multiple small ones)

I highly support this effort and I know many others do as well! Please keep working on it  

I support this effort as well but believe there will be scalability issues.

[datz]

As long as this is a separate voluntary thing and not a protocol change (which looks to be true), I'm good with it.

Yes, it is voluntary, outside the protocol, and does deter future regulation/allow compliance with anti-theft/anti-fraud laws already in place in many countries.

[cointoss]

This idea of contaminating coins should DIAF.

[datz]

This idea of contaminating coins should DIAF.

Coins would not be contaminated, only first degree theft wallet addresses.

I can't say this enough: addresses not wallets.

[hathmill]

A friend of mine exchanged some coins for stuff and know the stuffs broke and I want too red list the money and apparently he already gave it to his mother but now its on the red list anyway and to hell with the broke innocent mother. How did I get it red listed? The thing is I gave some clean coins to the red list operators they took the bribe even though the excuse was lame. So, in my opinion coins are never dirty. Red list not for me. I guess the state gonna love it though: all spends without outs to tax address will be tainted. No need to control bitcoin just leverage the traceability and bust those who break the law. No thanks to these tainted coins.