Post
Topic
Board Development & Technical Discussion
Re: Fake Bitcoins?
by
zellfaze
on 14/08/2011, 17:08:09 UTC
So is there actually no one on these forums that can and is willing to explain in great detail how to go about one of these attacks?

Even if his intentions were not sincere, security through obscurity is a terrible terrible practice.  Despicable.

macintosh264: For every confirmation it gets that much harder for an attacker to (temporarily) create fake bitcoins.  1 Confirmation means that the transaction is in 1 block in the block chain, 2 confirmations means it is in 2 blocks, 3 means 3, etc.  In a nutshell what happened with MyBitCoin is that an attacker was able to mine a invalid block, then before the block was thrown out for being invalid mine another invalid block.  In these invalid blocks it showed him depositing bitcoins to MyBitCoin.   Because MyBitCoin only waited for 1 confirmation, it assumed that these were valid transactions and allowed him to withdraw the bitcoins.  The withdrawn bitcoins were included in the actual real block-chain and therefore remained valid even after the deposits from the fake blocks were thrown out.

If you wait for 1 confirmation an attacker has to mine 2 fake blocks in a row to trick you.  If you wait for 2 confirmations, they have to mine 3.  If you wait for 3 confirmations, they have to mine 4. Etc.

Every confirmation you wait for makes it exponentially more unlikely that you are being tricked.  Remember that a block is mined about once every 10 minutes, so it would take a great deal of computing power (and luck) to successfully stay ahead of the network for a significant amount of time to pull one of these attacks off.

With that in mind, 4 confirmations should be plenty.  3 would probably be plenty even.