This is exactly it: dispute resolution is hard, and involves untangling real world facts from distant parties some of whom are motivated fraudsters. Credit cards push the work of verifying that the person making a purchase with an account is the person entitled to do so, onto the merchants. Paypal has followed this; its terrible dispute resolution is a big source of complaints.

Bitcoin has no dispute resolution at all. Once a transaction is confirmed, that's it; you have to use some mechanism outside the system to get your money back. People talk about escrow but it's hardly a magic solution.

A corollary of this is that all software handling bitcoin has to be extremely reliable. Not just the client, but anything built on it, such as the entirety of the exchange. Like a pressurised container full of money; if there is any crack or way a hole can be made, it bursts and the money is gone. Even if all the software you've built is fine, any operating system level 0day (cought Apple) will sink you.

This is mostly irrelevant. Bitcoin "has no" escrow arbitrator in the very same sense that cash (esp physical) has no escrow arbitrator. It's just something you have to layer on top if you want that service, the same way you would for a cash transaction. To the extent that it mimics cash's irreversibility, then of course it inherits the need for third parties when you actually want this kind of reversibility.

(Normally at this point I'm supposed to mention bitcoin's embedded programmable contract system that further facilitates escrow, but I'm worried that bringing it up at the same level would encourage the very same apples-to-oranges comparison I'm trying to get people to stop making!)

In a perfect world, all those problems are solvable with smart contracts, m-of-n transactions, better open-source software and accounting practices, etc.

Of course, we don't live in the perfect world, and all non-trivial software has bugs. Time will tell if "perfect enough" plumbing is achievable, and whether the Bitcoin experiment is sustainable. I think's a worthwhile gamble, on a micro and macro scale, but no one should get involved with Bitcoin without understanding the risks.

People keep saying smart contracts will help. How does this help "item not delivered" and "item not as described" etc?

Chargebacks can occur through m-of-n transactions. Arbitration becomes a service, with more competition and likely a lower a cost than a credit card's 3%. What's more, it can optionally be eliminated for trusted buyers/sellers (particularly vendors who earn good reputations for returns and customer service).

Smart contracts probably make more sense for pure digital transactions that don't involve tangible goods or services.

> Like a pressurised container full of money; if there is any crack or way a hole can be made, it bursts and the money is gone.

That is, far and away, the best description of the problem I've heard. Did you come up with it?

Yes, as I was writing that post.

I'd been considering rocketry analogies, where one software error (Ariane) or bad seal (Challenger) will blow the whole thing up, but I wanted to convey leakiness. Mtgox found a slow puncture and went down like a deflated bouncy castle.

It is also like a bubble. A tiny pin prick, and pop! Which is also doubly apt because some consider the market price of bitcoin a bubble.

>There's no way cryptography and peer-to-peer consensus protocols will provide verification for goods and services

Yes, there is: bit-contract. I forgot where I read about it, but basic idea is very simple: before transaction takes place, both sides make a separate deposit exceeding in size the value of the transaction. After transaction completes, either both sides vote to release the deposits and get their deposit coins back, or one of the parties is so aggrieved, they decide to punish the other party by voting to destroy both deposits. The loser loses twice, but they don't let the perp to get away with it either.

This creates incentive for both sides to strive for mutual satisfaction. Scammers and crazy cranks will run out of money pretty soon. This works really well for small contracts, such as selling an old iPod on Ebay.

For large transactions you could rely on reputation instead - if the value of reputation is $X, you can trade for $X/2 with that person, as it would be silly for them to cash out so cheaply.

> one of the parties is so aggrieved, they decide to punish the other party by voting to destroy both deposits. The loser loses twice, but they don't let the perp to get away with it either.

Honestly, that is wildly impractical and would never account for the requirements of the real world. Want to buy a house for $300000? Well you better put up at least another $300000. Oh, and if the other guy scams you, you're out at least $600000.

Like you said, that scheme might work for microtransactions. For actual business, almost nobody has that kind of money lying around.

> For large transactions you could rely on reputation instead

Isn't that fundamentally what you are trying to avoid?

This is an unreasonable complaint. No one buys houses with piles of cash. Bitcoin is cash. It probably won't replace transactions that are impractical to do using cash today.

I think you're talking about NASHX http://nashx.com/HowItWorks and the trustless version documented by Oleg Andreev http://blog.oleganza.com/post/58240549599/contracts-without-...

(I mentioned the former in my post, but I didn't realize NASHX was acting as a trusted 3rd party)

The bit-contract idea is neat, although it seems like it could be misused. A group of dishonest buyers could gang up on an honest seller and inflict a worst-case N x (penalty + item_cost) damage at a cost to each buyer of (penalty - item_cost). The seller damage is only N x (penalty - item_cost) if the seller waits until they have payment before shipping, though, so I suppose you'd need a very high N to impact a high-volume seller that can verify quickly. Seems reasonable for low-profile or low-volume sellers, though.

I'm not convinced many people would volunteer to destroy their deposits just to punish a fraudulent seller.

For reference, say you're trying to buy a widget valued $100. Both the seller and you deposit $150, you pay, the seller never ships. At that point you're out $100. You can punish the seller, at no use to you whatsoever, and increase your losses to $250. Do you opt to double (or more) your losses?

What if the seller were to offer $50 back? I know I'd rather be out $50 than $200.

interesting idea but completely impractical for normal humans. if i want to buy an ipod on ebay for 0.5btc, i'm not going to stage another 0.5btc to protect against fraud where the potential outcome is I lose double, and the fraudulent seller loses 0 or whatever the staged contract amount was.

The fraudster loses more than zero, that the whole point. If you're buying a $200 iPod, both you and counterparty make a $400 deposit. If seller takes your money but never sends you the iPod, you punish him for $400, so he is $200 in the hole.

If the honest people outnumber fraudster, fraudster a lose.

Strictly, there has to be at least as many people willing to punish than there are people unwilling to punish amongst the people the fraudster targets for the fraudster to lose all the gains from their scam. I don't know that this radically changes anything, but it's not quite the same thing as honest people outnumbering fraudsters.

This is silly because $x can mean a whole lot more to one party than the other. A rich and nefarious individual could cause massive harm to others.

Just curious but where do the funds go when the transaction is 'destroyed'?

Presumably they're just unspendable until the parties reach a resolution. If that never happens then everyone else's bitcoins increase in value a tiny bit, in theory.

Try explaining to your local regulators why your bitcoin balance has traces of illegal/laundered money in it...because a drug overlord's purchase was destroyed and the funds were gifted to the community.

I believe the suggestion was to destroy the bitcoins, which implicitly makes everyone else's go up in value, rather than explicitly dividing it up and emailing it to every bitcoin user in the world.

Also, I imagine you'd explain it to regulators with "a drug overlord's purchase was destroyed and the funds were gifted to the community". They're not stupid - if I obtained a "tainted" bitcoin and emailed fractions of it to everyone I didn't like, I doubt the authorities would be naive enough to put all my enemies in jail.

No, not gifted to the community. More like, burned, and thus driving down inflation.

> There's no way cryptography and peer-to-peer consensus protocols will provide verification for goods and services.

Why wouldn't reputation help with this problem? users will have to start small to develop their reputation, but doing so will allow users more trust.

There are ways of doing things that don't involve guns - and that's ultimately what government relies on.

Trust is always gameable; Madoff got billions by getting people to trust him.

(I thought libertarians were in favour of gun-based dispute resolution systems?)

It's interesting you used Madoff as an example, because it's precisely the type of situation gmaxwell's proof-of-reserves scheme is designed to solve.

Every social system is gameable. Trust based upon reputation is far far simpler than government. One thing bitcoin gives the world is the blockchain; there has never been a historical record that is free to access and to add records to, but impossible to modify. That's HUGE.

As for libertarians, you clearly don't understand at all. They want to avoid systems of conflict resolution that depend on violence; that's their whole point. Their obsession with trade, contracts and money arise from their view that those are voluntary ways of interacting.

Reputation-based trust is a great starting point, but one big incentive for merchants/service providers to not scam customers is the threat of lawsuits and prosecution by the government.

If a provider can get away with scamming people, without any sort of true repercussions other than a reputation hit, then the rate of "long cons" will probably increase by a lot.

From an anecdotal perspective, I used to be involved in gray markets like trading and selling MMO accounts. Generally there would be no repercussion for scamming the other party; the MMO companies forbade the trade, payment providers don't care, and the government doesn't really recognize it as a real transaction.

These markets had a deeply ingrained reputation system tied to the message board, but escrow was also very common. Many people would offer their services as middlemen to provide escrow for trades, but over time there became an alarmingly high number of middlemen who would properly handle dozens or even hundreds of trades, then scam both parties simultaneously once they came across the biggest transaction of their life. No repercussions came to them; they just stopped being middlemen and had fun with their treasure.

These kinds of examples show that reputation, cryptographic authentication, proof of payment, payment irrevokability, and plain man-in-the-middle escrow combined are still not enough to actually prevent fraud in many cases.

There are some examples of 2-man escrow systems out there using Bitcoin, though, which is far more promising. That prevents any one party from scamming the other 2. The remaining problem, which I imagine will never be solved, is the vendor proving or the buyer disproving that the vendor gave the goods or services that were asked for.

"Many people would offer their services as middlemen to provide escrow for trades, but over time there became an alarmingly high number of middlemen who would properly handle dozens or even hundreds of trades, then scam both parties simultaneously once they came across the biggest transaction of their life."

This is impossible with a Bitcoin escrow contracts since 2 of the 3 parties need to agree to unlock the funds, and where to send them.

And this is a perfect example of something that was literally not possible before Bitcoin (well, I suppose it could be done with some elaborate scheme with physical vaults and keys, but certainly not on the internet)

The Great 420 Scam | All Things VICE http://allthingsvice.com/2012/05/30/the-great-420-scam/

Theoretically people weren't supposed to store their bitcoins in an exchange like MtGox either but here we are today with this mess. The bitcoin protocol and best practices suggest a lot of actions that just don't work due to human nature

It's not quite impossible - to defeat 2 of 3 signatures, you just have to be 2 of the parties to the transaction. In this case, if I've built a massive reputation as a fair escrow agent, I can then pose as a seller of something(s) expensive. Once the money is escrowed, I release the funds and disappear. Having 2 of 3 signatures for escrow is certainly a better situation, though, presuming it doesn't lead to a false sense of security.

It's not free to add to. It's computationally extremely expensive, that's why miners are compensated.

Mining is wasteful but in principle proof of work can be largely replaced by proof of stake, dramatically lowering the energy costs.

proofofexistence.com is free to use; that's what i meant.

Considering that SEC officials sat on their ass likely watching porn on the job while receiving multiple substantial complaints about Madoff indicates your naive asymmetric idealization involved in hypothetical market failure scenarios while excusing very real actual regulatory failures. There is no utopia. Deal with it.

It's the same concept as a credit score, really.

This can be solved, but it will result in an increased transactional cost.

Right now, proponents of bitcoin like to tout the low transactional costs, compared to traditional payment systems, as a predictor of bitcoins's "impending" success.

Disputes, Chargebacks, etc. are handled now by financial institutions, at a cost to overhead. These financial institutions also have insurance to distribute their risk. If your account is hacked, you file some affadavits and you get your money back.

IF bitcoin were mass adopted, you can be sure that financial organizations that deal in bitcoin will tack on transactional costs relative to the risk of loss - almost like an insurance. In the case of Bitcoin - this is VERY high, unless of course the transactions are done with other financially certified organizations.

Aaaaaaaand we are back at a traditional banking system with transactional costs, but for bitcoins.

To clarify, cryptocurrencies such as Bitcoin offer not only low transaction costs but also global reach, far faster settlement at distance, and a public ledger. Some systems offer still more features.

Right, but there is zero risk distribution which contributes to the transaction cost differential with other services.

If bitcoin were to become mainstream, the transactional cost would raise because of the overhead with risk deferment.

Cryptocurrencies will definitely become mainstream because of the international and speed factors, but I don't think it will be bitcoin.

When you say risk deferment, which type of risk are you discussing specifically?

I see cryptocurrency use as being largely automated and transparent to the consumer in future. I think Bitcoin may have a place, but other more popular systems will provide solutions to many of its more gaping issues (rapid local settlement suitable for point of sale, complexity of implementation, lack of chargeback/cancellation channels, initial counterparty trust bootstrap, reputation management, etc.)

I started having a think about how these might come together over here ... comments/thoughts/collaboration welcome. http://ifex-project.org/

> it has pretty good tools of ensuring the expected goods and services flow back to the buyer: chargebacks, courts of law etc.

The existing financial (and legal) system is terrible at enforcing contracts, settling dispute, and establishing credit.

> There's no way cryptography and peer-to-peer consensus protocols will provide verification for goods and services.

Crypto-currency is one of the key pieces needed to build a better system. I strongly believe crypto-contracts are also needed. They give us the instruments to tackle the problems you mentioned. The ethereum white paper (https://github.com/ethereum/wiki/wiki/%5BEnglish%5D-White-Pa...) does a good job at explaining how contract enforcement can be coded into the blockchain.

What? The conventional system is made of contracts, dispute, and credit. We've been doing it for centuries. It's not fraudproof but in western countries is usually very reliable ("high trust society"). Admittedly it's hard to export, or push into areas where the culture is low-trust.

A generous interpretation of the GP's contract is the current system is weighted in favor of the larger players.

> Existing financial system is perhaps suboptimal in terms of transferring money, but it has pretty good tools of ensuring the expected goods and services flow back

In what way is physical money different from bitcoint in this aspect? Is there an implied statement here than for all the ages where we did not have electronic banking, money was inherently insecure and built on crumbling bride pillars?

Treat bitcoin like physical money, and most issues goes away. I don't post thousands of money to a strange in a different country to hold them for me, nor do I give physical money to a store before I have the product in my hand.

I thought this was essentially a solved problem with Bitcoin. The protocol allows for transfers that must be verified by 3 (or more) parties. So all we need is a few trusted third parties to arbitrate transactions.