Quote from: SirArthur on May 30, 2010, 08:02:53 PM

As for the attacks on websites with BC addresses, you may deface them, and you may spoof even without the server's Private Key. Normally people don't look to the CA, so as long as the CA is recognized it will ring no bells - and within this "world", specially for Tor users, Verisign Certificates aren't the normal thing, but CACert and other free services alike (means also many users are already used to press "Continue" on invalid certificate flags).

I'm by no means an expert on this, but I think even a free certificate includes a "this is for website www.example.com"-field, and you can only get a certificate if you actually control that domain (can receive email sent to the domain), so I don't think forging that is trivial. Firefox, for example, explicitly pops up a warning if a certificate is for a domain other than the expected one.

The remaining weak link then is DNS, but while possible, it is non-trivial to forge that, especially when you're watching the destination-page, and can't know who is going to want to visit it beforehand. Also, DNSSEC is slowly becoming the norm, so that possibility also goes out of the window within a few years.

The reason why I bring up TOR is that bitcoin complements it very well. TOR preserves anonymity, and bitcoin allows for anonymous transactions.

Quote

Edit:
To not mention the obvious: If you know the destination's IP Address why on Hell you would need to use Tor to pay?? And if the address would be something like .onion then you wouldn't need SSL, because inner Tor data is already crypted.

Suppose someone doesn't want to know the payee who he/she is? Without TOR the IP address is revealed, which, at the very least allows the other party to know the approximate geographical location.