Any idea what proportion of merchants using Stripe's bitcoin handling actually do this automatic refunding?
You only need to find one. Or sign up as a Stripe customer yourself -- they'd have a hard time proving that it was you who made the overpayment rather than one of your customers.
I think an overpayment and refund request weeks after the initial payment (when coincidentally the BTC value has reduced) would definitely ring some alarm bells
Maybe... but "oops I sent the coins to the wrong address" is a pretty plausible story. If there's one thing I've learned from accepting bitcoin payments at Tarsnap, it's that poor bitcoin client UIs seem to be responsible for a very large number of mistakes. (The most common one I see is failing to adjust for the miner fee.)
I don't know the proportion, but coincidentally enough, I work at a startup that uses Stripe and we used to support bitcoin transactions (and thus refunds). I just asked a friend who's been here longer why we're not supporting bitcoins anymore and his response was "exchange rates were a huge pain" haha so yeah it is indeed convoluted to do refunds with bitcoins, but if we are to attempt to use them as regular currency for goods and services, we can't not support refunds. so we dropped bitcoin support altogether.
Was that bitcoin support manual, or through stripe? I would never want to deal with bitcoin payments manually due to the exchange rate issue; but taking them through stripe works wonderfully.
Hmm digging through our old code looks like we never tried to use Stripe, for reasons unknown to me (maybe their support/requirements were different back then, maybe it didn't work for our product, idk). But yeah, especially after reading this article, handling bitcoin payments and dealing with the exchange rate sounds unfavorable lol :) glad we're not doing that.
That's my point - with stripe, you don't have to deal with the exchange rate. You say "I want $X" and magic happens. Stripe takes care of the messy details of fluctuating exchange rates.
So that's not entirely true depending on how you use the product. We were attempting to use Stripe for a contract-like setup, e.g. person A pays person B, but person B doesn't get paid until some event occurs, and we hold on to the funds until that happens since that expiration of that event isn't guaranteed to be under 10 min.
Any idea what proportion of merchants using Stripe's bitcoin handling actually do this automatic refunding?
It's a very interesting vulnerability and I enjoyed reading the write-up and thought process, but I'm not sure how practical it is if it requires interaction from the merchant to perform the refund. I think an overpayment and refund request weeks after the initial payment (when coincidentally the BTC value has reduced) would definitely ring some alarm bells - hopefully with both the merchant and the team at Stripe.
I guess you could spread out your overpayments amongst different merchants and try and limit the time between the initial purchase and the refund requests but the entire thing seems a bit convoluted to pull off.
In any case, kudos to the author for the responsible disclosure and for Stripe for handling this professionally.