The great thing about this is it that it puts a floor on the bounty on all network bugs. Since we know that lots of national security folks are regularly exploiting various bugs for their own purposes, this means that the internet will be significantly improved. I see it as a bonus.

The unfortunate thing about this is a lot of people are going to lose a lot of money before either 1. Mainstream web security catches up to the cleverness of the bitcoin hackers or 2. People lose faith in bitcoin because the internet is generally not secure enough to support it.

Lots of money has been lost in other security breaches, oftentimes with much worse consequences because the data is centralized. This hasn't stopped people from shopping at Target for instance.

The nice thing is, security breaches in a decentralized network like bitcoin serve to make the entire network anti-fragile. There's a huge incentive for people with bitcoin to secure their own bitcoins against known exploits and hence make that exploit null while inevitably protecting against similar class exploits.

The difference is that with the Target breach, people knew that they would get their credit card $$ back.

But the way this is implemented is "credit card companies will take 3% of every transaction they perform, and then give back a very small portion of that to counteract fraud". The power we give these organizations - basically a 3% tax on every transaction - is mind boggling.

The credit card companies don't actually don't give up part of their 3%. Chargebacks are up to the merchant: http://en.wikipedia.org/wiki/Chargeback_fraud.

Compared to the spread and inconvenience on $ -> bitcoin -> $ transactions, that's quite cheap.

Keeping bitcoin online enough for convenient transactions carries the small but important risk of losing your entire wallet.

True, and there are benefits you get for that 3% (rental car insurance, reduced cost of a mugging, etc. etc.) but I still wonder if cash (not necessarily bitcoin) would be better for the system as a whole for everyday purchases.

Keep in mind that cash has costs too. It has to be counted and secured. You have to hire a security company to pick up deposits and most banks charge for cash deposits over a certain amount.

But then that tax gets selectively reimbursed via dividend to shareholders. Upward redistribution.

There are externalities to this "you don't have to worry at all about the security of your credit card info" feature.

Barely 0.01% of the world population uses Bitcoin and we already see a technology on the market that is expected to significantly improve security, and this was the result of 1+ year of engineering effort from teams of engineers: hardware wallets like http://www.bitcointrezor.com So security isn't great overall right now, but clearly it is improving way ahead of time with respect to a potential mainstream adoption of Bitcoin.

It seems to be a transitional period where people must trade security for freedom, while the industry figures out the security part.

Much like early immigrants to North America who had leaving the stability and safety of UK/European banks for an emerging market and/or the Wild West.

You should not "invest" in bitcoin if you cannot afford losing it. So I would not shed a single tear.

I agree. I actually leverage this by leaving a couple Bitcoins unencrypted in my 1Password file and have setup an alert to let me know if any of those coins ever move. Which would be a good indication that its time to use a new password manager.

Seems like the right kind of way to do a canary.

At the same time, it hugely incentivizes improvements in computer security. After all, it's "our" fault for still using crappy and buggy Linux, Windows and Mac OSes, written in crappy and error-prone languages such as C and C++. Mind you, this crappy software is responsible for a lot more thefts than just bitcoin (e.g. China hacking and stealing trade secrets), but with bitcoin, you can put a definitive (if volatile) dollar price on the hacking.

Sounds like a problem with computers, not Bitcoin.

Yes. I believe the same sophisticated attack could be used to target banking systems. It would just need a few more sophisticated services to be in place or more inside information.

But why bitcoin is targeted?

Because bitcoin is an open protocol, they could target it's root, mining rigs because that's where the value is generated. In banking systems, to generate money you need to have internal access and secure credits .

Bitcoin is targeted because it's a digital asset, true digital cash. Banks don't have that. You can never really own your bank money in digital form, it always stays in the bank's computers.

No I'm not talking about targeting banks directly. What about targeting consumers or ecomm sites? A consumer need to give card information, websites should make vpos operations.

These can be target vectors too.

The same thing can be said about credit cards. If there is a problem with Bitcoin (and I'm not sure that there is) it is that unlike with credit cards there is no possible recovery of stolen coins.

Converting stolen CC numbers to cash actually turns out to be difficult since government and other authorities can revoke the cards, freeze fraudulent merchant accounts, and seize assets once they've hit your bank accounts. You have to mitigate all of these risks and won't always be successful.

If you manage to steal Bitcoin, you can transfer it all to your personal wallet in one transaction in broad daylight and, by design, no one can stop you or reverse the transaction once it's discovered to be fraudulent. Maybe run it through a darknet tumbler for good measure, but you're basically home free the second you get the private keys.

Stealing $100m worth of Bitcoin would be massively more valuable than stealing CC numbers with access to $500m in credit because you can actually cash out all of it. So much larger R&D budgets and more sophisticated attacks make financial sense.

I think this is really the sticking point that makes consumer Bitcoin adoption pretty much impossible, as the level of computer security required to keep Bitcoin safe and easy to use at the same time is just not something available to your average joe.

If your private key is compromised, the thief takes your entire balance, and there's nothing you can do about it. So you really want to keep it safe.

Lose your private key, lose everything it was protecting. So keeping the key in only one place, and one place where only you can access, is a big problem. There is nobody out there to give access to your money if you pass away. A hardware failure can be catastrophic.

The problem is that everything that makes the private key survive accidents makes it easier to hack. The way we treat something like this in a corporation is with things like shared secrets: Need 3 out of 5 people to use their issued keys so that the real private key protecting everything is revealed. And even with that level of effort, getting the key is still possible with enough effort.

Exactly. Nobody is going to want to manage their own bitcoin holdings, much as I don't keep all of my savings in a safe in my house. So that gets out-sourced and insured, and somebody has to pay for that. I expect it's much less than the credit card's take, but when it's paid for by the consumer it's much different psychologically. Consumers are going to have to get a cut of the savings.

There is good research that indicates that the bottleneck in electronic bank theft is finding the endpoints that are irreversible (think ATMs). Doubling the amount of stolen credit cards wouldn't come anywhere close to doubling the amount of money stolen out of the system.

With Bitcoin, every marginal theft adds 100% to the total Bitcoin thefts.

Could you give a citation for that? Not saying I disbelieve you, it sounds plausible, but I'd be interested to read that research.

That's not a problem, it's a feature. It's like saying "the problem with gold is that you can't recover it". But that's precisely what gold holders want: Not letting the government "recover" it (ie. seize/steal it).

Nothing fundamental with bitcoin, same thing happens with online banking. In general, people will try to steal anything of value.