Quote from: VTC on November 28, 2013, 04:36:10 PM

I took a quick look. Users that have a single address (web wallet usually) will get an error message if they try to do a repeated escrow transaction with the same buyer/seller pair because you will generate the same escrow address. Good thing you have an error for this , otherwise the release code would already be known to one party. Notify users to use a fresh address when doing escrow with the same buyer/seller.

Ooh, possibility to notice. Though I'm actually planning on having the server generate a fresh address and private key for the arbitrator to use, so there wouldn't be a chance of a multsig address repeats. (I have the server generate the arbitrator's key and give it to him so that the server can immediately sign the failsafe transaction with the arbitrator's signature. Then the seller would have no reason not to sign the failsafe transaction, so his signature is guaranteed. This means that the failsafe transaction will work even if the buyer and arbitrator refuse to sign any further transactions. It does mean that a malicious server could act as the arbitrator, but I think that's a small acceptable amount of risk. If enough people found this too debatable, I could add an option to allow the arbitrator to provide his own address, and I'll make sure that the arbitrator's address isn't already in the system in order to address the possibility you bring up.)

Quote from: qwk on November 28, 2013, 10:27:35 PM

Couldn't you have developed that a few days earlier?
I had set up a bounty for something like this Roll Eyes

https://bitcointalk.org/index.php?topic=294606

Ha, funny thing is I've been implementing this on a coincidentally similar (even to the price) bounty given by someone else.
(Bit of criticism of knowitnothing's solution: in his, the server generates the private key that the payment goes to. It's just a regular single-key address, not a multisig address. The users have to trust the site to not run away with the funds. The server then splits the private key that it knows with a secret-splitting algorithm allowing any two users to create a copy of the private key. There's no way for the users to verify that the split-key values that they get from the server are valid until after the funds have been sent and they attempt to recombine the key to claim its funds.)