Quote from: zellfaze on August 14, 2011, 05:08:09 PM

So is there actually no one on these forums that can and is willing to explain in great detail how to go about one of these attacks?

Even if his intentions were not sincere, security through obscurity is a terrible terrible practice. Despicable.

macintosh264: For every confirmation it gets that much harder for an attacker to (temporarily) create fake bitcoins. 1 Confirmation means that the transaction is in 1 block in the block chain, 2 confirmations means it is in 2 blocks, 3 means 3, etc. In a nutshell what happened with MyBitCoin is that an attacker was able to mine a invalid block, then before the block was thrown out for being invalid mine another invalid block. In these invalid blocks it showed him depositing bitcoins to MyBitCoin. Because MyBitCoin only waited for 1 confirmation, it assumed that these were valid transactions and allowed him to withdraw the bitcoins. The withdrawn bitcoins were included in the actual real block-chain and therefore remained valid even after the deposits from the fake blocks were thrown out.

If you wait for 1 confirmation an attacker has to mine 2 fake blocks in a row to trick you. If you wait for 2 confirmations, they have to mine 3. If you wait for 3 confirmations, they have to mine 4. Etc.

Every confirmation you wait for makes it exponentially more unlikely that you are being tricked. Remember that a block is mined about once every 10 minutes, so it would take a great deal of computing power (and luck) to successfully stay ahead of the network for a significant amount of time to pull one of these attacks off.

With that in mind, 4 confirmations should be plenty. 3 would probably be plenty even.

I think it might be more complicated then it looks on the surface because then it would take only 4.8 hours on average for a big pool such as deep-bit to plant invalid transactions and hack system with 3 confirmations, 11 hours to hack 4 confirmations, 26 to hack 5 and 60 hours to hack MtGox with 6 confirmations.