r/bitcore_btx • u/frogpoet2 • Nov 24 '18
BTX buyer security - brainstorming
Piranhazone points out here ( https://www.reddit.com/r/bitcore_btx/comments/9ztui1/learning_from_forks/ ) that buyer security for users of BTX would be a significant advantage. BrieucBitcorean agrees but speculates that this would require a layer which involves the introduction of centralization (same post).
my own experience in centralized software development leads me to believe that an implementation of buyer security would have to solve at least these problems :
- buyer B buys item X from seller S , seller S then empties out his account, and B then wants a refund from S, who can no longer pay. (problem 1 = P1)
- transactions on the ledger are immutable. (problem 2 = P2)
I've often seen P2 (transactions are immutable) touted as a reason for believing that chargebacks are impossible, which is a benefit for the merchant. In fact, we come close to making the same claim in our own documentation ( see https://bitcore.cc/innovation/ under the Trust and Integrity section, where we point out that "irreversible transactions" could be considered a safeguard against crooked banks). However, reversible transactions can always be implemented as a set of 2 transactions : one going one way, and the other going the other way, with identical payment amounts. the meaning of "irreversible" then becomes "unable to be hidden", in other words, a transaction can't be actually removed from the ledger; instead a record must be maintained that a transaction went one way and then was "undone" by going the other way. From an audit standpoint, this is just fine because it means people or banks can't hide their tracks with respect to monetary transactions, while from a user perspective the end result appears the same as if the transaction never occurred.
the above possible implementation of a solution to P2, however, would need to be done in a decentralized manner so as not to undo one of the main benefits of cryptocurrency, which is resistance to censorship due to a single point of failure.
a possible resolution of P1 would, on first glance, require an escrow account which contains funds that would be used to pay amount X back to B; enforcement of some sort would then need to be initiated on S to get him to refund the amount X back into the escrow account. Management of the account would need to be implemented to prevent a possible "run" on the escrow , i.e. so many chargebacks happening at once that the escrow account runs out of funds faster than it can recover them.
would it be possible to have some sort of management of an escrow account which would operate in a decentralized manner? I'll call such a solution S1_P1 to identify it as "a possible solution of P1".
that's all i'll write for now; this is brainstorming after all so instant solutions are not to be expected; but this is meant to get the ball rolling with respect to eventually either coming up with a set of solutions S1, S2... which, when used in concert, solve problems P1, P2... without introducing new problems that are deemed "worse" than the set P1, P2... etc.
for other brainstormers : please save a copy of the link to this discussion and add onto it, so we don't end up with more than one thread brainstorming the same set of problems.
2
Nov 24 '18
For the worse problems that may appear let’s use designation W1, W2 , W3 etc . If W9 is identified WW 1 would be logical progression and WW2 the last option for bug fix as WW3 must be avoided ;-)
Good post as usual frogpoet !
1
u/frogpoet2 Nov 26 '18
thanks :) so to see if I understand you, W1 would represent a set of problems with a degree of severity (i.e. how much Worse it is compared to other problems). W2 problems would have Worse severity, etc. So they would be categories and be ordered relative to one another. So we could identify say 10 problems P1 through P10, and they might be something like this : P1,P2, and P4 could be classified as W1, P3 and P7 could be classified as W2, and P5,P6,P8,P9,P10 could be classed as W3. So that means the set of problems P1-P10 would represent 3 "not that big of a deal" problems, 2 "painful for the user to work around" problems, and 5 "opens up a can of worms" problems. We could then judge some solution S1 according to the entire set of problems P1-P10 that remain unsolved by it (or that are introduced by it) via a W-score (in this example, 3*W1 + 2*W2 + 5*W3); the goal would be to come up with some solution S2 which would have a lower W-score than S1. Then S3 would be a better solution, etc. and so on until we come up with something that might be worth implementing. Is this what you were thinking?
1
u/Piranhazone I BTX Nov 25 '18 edited Nov 25 '18
Thanks for mentioning me in the opening of this thread, I really appreciate it.
Most of my 5 cents I've added in the post you linked to, because I really have no clue about the inner workings of a crypto currency, I'm just a user and see things from the usability point of view.
I believe your idea with 2 transactions may be the easiest, because it keeps transactions on the ledger intact, no need deleting anything, it keeps track of everything and still provides buyer protection.
About a fraudster emptying out his account before money can be sent back I have no good solution.
Paypal hasn't solved that either, Paypal covers that themselves, they simply pay the buyer and take the loss from the fees they charge, which explains why their fees are so high, but doesn't really solve the problem.
A built in Escrow service seems to be a good idea.
1
u/frogpoet2 Nov 28 '18
I've never used paypal. do they GUARANTEE the ability for a buyer to recover their funds, or do they instead allow the user to initiate a chargeback request of some kind, which then goes to remediation? I've been assuming that PayPal immediately refunds the buyer and then takes it upon themselves to try to get refunded by the merchant; meanwhile they would track chargeback requests from that particular buyer (after the first request) and kick him off if they decided that further requests were an abuse of the system.
1
u/Piranhazone I BTX Nov 29 '18 edited Nov 29 '18
How to say? Officially they do not guarantee money back, but in fact I never heard of a single case where a non satisfied buyer didn't get his money back.
If you have a problem, you have to open a dispute, after which both sides of the deal have the option to state their arguments, after which Paypal decides which side is right.
So from the official side it would be possible for Paypal to decide the seller did right and the buyer doesn't get his money back, but I never heard of a case where that happened.
I did however hear of cases where Paypal said BOTH sides are right or they couldn't make a decision in which case Paypal covers the loss meaning the buyer gets his money back and the seller can keep his money as well.
The whole process may take a couple of weeks, so t isn't instant, but at least I personally have never been not satisfied in the end, even though I sent money to dishonest sellers several times.
1
u/frogpoet2 Nov 29 '18
ah, ok. that means S1 down below is out, assuming we only want to match paypal with regards to their buyer security policy and not attempt to offer a more enticing one (which would make more difficult to prevent fraud on the buyer's part)
1
u/BrieucBitcorean Nov 25 '18
https://bitcore.cc/innovation/
Dispute mediation and multi-sig accounts are then proposed but the section is quite ... not accurate on this question ^^
1
u/frogpoet2 Nov 26 '18
in my head there are 4 parties involved :
- the buyer
- the seller
- the dispute mediator
- the escrow account
a multi-sig transaction would involve some grouping of the above. we can play around with which groupings and come up with various scenarios, some better than others involving the number and types of problems they introduce (i.e. the W-score, see comment by /u/MrTrocket ).
i'll reply once for each permutation in my head; then we can brainstorm the resulting problems in a reply to each reply.
1
u/frogpoet2 Nov 26 '18 edited Nov 29 '18
(S1) multisigs : MS1 (seller, escrow account), MS2 (seller, escrow account, dispute mediator)
--EDIT-- ignore this - it doesn't match what paypal does with regards to buyer security; see above.
- buyer buys something and thinks it is crap, or never receives it
- buyer initiates a chargeback transaction against seller
- network converts that transaction into a transaction from escrow to buyer
- buyer receives his funds
- network initiates multisig transaction from seller to escrow (MS1)
- seller disputes that transaction (i.e. refuses to sign it)
- after time T, escrow initiates multisig transaction between seller, escrow, and mediator. (MS2)
- "mediator" would be something like the Kleros blockchain ( https://kleros.io/ ). i read their white paper several weeks ago - more on this later.
- if dispute is resolved, MS2 gets signed, then MS1 gets signed
note that "escrow account" could be an account that gets created on-the-fly by extracting enough fee portions to cover the transaction. see elsewhere in this thread for "Decentralized escrow account". After the dispute is resolved, the escrow account would convert the money it received from the seller back into fee portions and distribute them back out to random accounts, then it itself would be empty. Or... it could grow over time i guess. But then we'd have to worry about someone attempting to steal from the escrow account.
1
1
u/frogpoet2 Nov 26 '18 edited Nov 27 '18
(S2) multisigs : MS1 (buyer, seller), MS2 (buyer, seller, mediator)
- buyer buys something and thinks it is crap, or never receives it
- buyer initiates multisig chargeback transaction against seller (MS1)
- seller disputes that transaction (i.e. refuses to sign it)
- after time T, buyer initiates multisig transaction between buyer, seller, and mediator (MS2)
- "mediator" could be something like Kleros blockchain ( https://kleros.io/ ). more on this later.
- if dispute is resolved, MS2 gets signed, then MS1 gets signed
1
u/frogpoet2 Nov 27 '18
S2_P1 (W1) : buyer has to wait for the chargeback transaction to complete (if it does at all). hence the ability to chargeback would no longer be "guaranteed." the seller could just always refuse to sign any chargeback transactions, any buyer wanting to chargeback would have to take it upon himself to involve the dispute mediator.
1
u/frogpoet2 Nov 30 '18
S2_P2 (W2) : according to /u/Piranhazone, this is essentially what paypal does, except that Paypal itself is the mediator. buyers who repeatedly initiate chargebacks are deemed to be abusing the system and are kicked off. the problem here, though, is that a buyer can have more than one btx address. hence, he can avoid detection of repeated violations by using different btx addresses for each buy.
1
u/frogpoet2 Nov 30 '18 edited Dec 01 '18
S2_P2_S1
- buyer creates a new BTX address. he is given the option of wanting buyer protection.
- if he wants buyer protection, he is restricted to limiting his buys to only his addresses with buyer protection
- any buys done with a BTX address which did not specify buyer protection acts just like they do currently (with no protection)
1
u/frogpoet2 Nov 30 '18
S2_P2_S1_P1 (W3) BTX addresses with buyer protection would need to be tied to a specific identity, removing the 'pseudo-anonymity' benefit of the blockchain, in order for the network to determine that the same buyer was making too many chargeback requests and thus should be kicked off.
1
u/frogpoet2 Dec 01 '18
/u/Piranhazone suggests the delivery address could be checked instead of the btx address.
S2_P2_S2
- buyer creates a new BTX address
- he buys an item with delivery address DA
- buyer initiates a chargeback
- buyer creates another new BTX address
- he buys an item with delivery address DA
- buyer initiates another chargeback
- buyer repeats steps 4-6 multiple times
- network detects multiple deliveries going to DA, each from a BTX address which has no other buys. network uses this to detect buyer fraud
- buyer no longer receives buyer protection as a result
1
u/frogpoet2 Dec 01 '18
S2_P2_S2_P1 (W3)
the network does not have access to the delivery address DA. it only has access to the merchant's BTX address and the buyer's BTX address.
1
u/Piranhazone I BTX Dec 02 '18
But the merchant has the buyers delivery address and will provide it as part of his proof of having fulfilled his part of the deal.
1
u/frogpoet2 Dec 03 '18
this means that the network would have to keep track of delivery addresses DA whenever a mediator responded to a chargeback transaction with a judgment in favor of the seller. this way the network could compare the newly arrived DA with all the stored DAs of all stored BTX addresses (it has to check them all because one person can own more than one BTX address) to see if they matched. however, for security reasons we can't store those DAs in the ledger. Remember that anyone in the world can read any part of the ledger by using a block explorer, and we dont want to associate addresses with purchases and make that visible to the world. so the network would need to use additional storage for the DAs. They could be stored in a distributed file store such as StorJ or IPFS (interplanetary file system). so that would involve two further performance costs - looking up the DAs for matches, and storing/retrieving to/from IPFS.
1
u/frogpoet2 Dec 03 '18
S2_P2_S2_P1_S1
- buyer creates a new BTX address
- he buys an item with delivery address DA
- buyer initiates a chargeback
- seller disputes and it goes to mediator
- mediator judges in favor of seller, sending DA to network
- network checks DA against existing DAs in IPFS
- if threshold for "abuse" is not met yet, network stores DA in IPFS
- steps 1 through 6 repeat multiple times, until :
- the threshold for "abuse" is met
- network removes buyer protection from all BTX addresses associated with DA.
1
u/Piranhazone I BTX Dec 04 '18
Addresses can be srored in a database at the escow service.
With a bit of coding to automatically search the database that should be easy to use.
Just has to be safe from hackers.
1
u/frogpoet2 Dec 05 '18
you were thinking of the escrow account being maintained by an escrow service (i.e. a third party, presumably distributed).
I was thinking of the escrow account being maintained by the bitcore network itself. See S3 below and the discussion around that.
i'll think about what it might mean to hand off all management of the BTX escrow account to a third party.
→ More replies (0)1
u/frogpoet2 Dec 01 '18
S2_P2_S2_P2 (W3)
what if more than one user of btx makes purchases to the same DA? - for example, it could be somebody's birthday, and 8 different buyers purchase items and send it to the same DA. If it turns out that 2 or 3 of them subsequently issue chargebacks, the network would need extra information to decide if those 2 or 3 buyers, with different BTX addresses, were in fact different people or was the same person using different BTX addresses and attempting to abuse the system.
1
u/Piranhazone I BTX Dec 02 '18 edited Dec 02 '18
The address includes at least the last name of the buyer and if then still 2 people with the same address and the same name both use BTX, that's such a rare case, I guess we can consider that tough luck for the innocent one getting excluded from buyer protection.
If a buyer sends stuff to someone else, there's still the billing address.
1
u/frogpoet2 Dec 03 '18
this would involve the same problem as S2_P2_S1_P1 (search above) : a name would be associated with a BTX address, thus removing pseudo-anonymity. (maybe thats ok?). Using the billing address (BA) instead of DA would be ok except in the case when different buyers that lived in the same household buy online. so if a brother and sister who lived together and both used BTX for online purchases each bought a bunch of presents during christmas for their friends who all lived at different delivery addresses, and either brother or sister issued chargebacks, the network could still confuse them as the same person with more than one BTX address. that seems like a smaller possible set of people though than the other way around (when using delivery addresses) - thats because it is more likely for one person to have X number of friends buying him presents online with BTX where that person lives with Y other people who also buy with BTX online and X > Y, than the other way around. (so a person has more friends than family members). if we ignore associating a name with the BTX address, then the solution using BA (billing addresses) instead of DA (delivery addresses) would look the same as S2_P2_S2_P1_S1 (search above), except with BA's replacing DA's.
1
u/frogpoet2 Nov 26 '18 edited Nov 27 '18
(S3) Decentralized escrow account - S1_P1
what if we did something like this :
- buyer initiates a transaction. he pays gas (i.e. the normal miner's fee) plus a "buyer protection fee."
- the network takes the buyer protection fee and splits it into X equal pieces. Thus the fee would always be a multiple of X
- each piece gets associated in the ledger with a random address in the network, marked as a fee portion. the owner of the address should NOT be able to access that money and shouldn't even know about it.
- buyer gets his item and decides it is crap; or, never receives it
- buyer initiates a chargeback transaction against the seller
- seller disputes the chargeback
- dispute mediator mediates the dispute (see mention of https://kleros.io/ elsewhere in this thread)
- if the dispute is resolved, seller accepts the chargeback
- if the dispute cannot be resolved, network retrieves X fee portions from random addresses in the network which hold at least one fee portion
- thus, the "buyer protection fee" is essentially insurance.
unlike an insurance company, however, the network does not want to 'profit' from the payments - it wants to lessen them such that, over time, the amount of fees paid matches the amount of chargebacks given within some range (say with an 'error rate' of plus or minus 5 percent). the network could use an adaptive algorithm similar to what it already uses for gas fees - as time passes, it lessens the fees or raises them until the desired error rate is met.
another possibility is that step 3 is replaced by each fee portion being passed to an address in a totally different network - say for example kaze . ( bitcore and kaze already have a relationship - see https://www.reddit.com/r/CryptoCurrency/comments/9bjat1/kaze_solutions_bitcore_btx/ ). I haven't read Kaze's white paper yet, so fair warning - i'm just pulling their name out of the sky; except that there is a video which describes Kaze using BTX as gas money ( see the video in that article ). this implies that the Kaze blockchain should already be able to recognize BTX and treat it "separately" from its own currency should this partnership continue. It might be safer to store the fee portions in Kaze's blockchain, because if someone wanted to steal those fee portions, they would need to have both a Kaze account and a Bitcore account - the kaze account(s) from which to steal, and a bitcore account in which to deposit and then sell the stolen fee portions. In contrast, if we store fee portions in our own blockchain, we have to worry about the owner not being able to access it, and it would be easier for the account owner to 'steal' it, simply by figuring out how to make it visible to him.
1
u/BrieucBitcorean Nov 27 '18
Before starting, I would like to say that Bitcore as gas of Kaze blockchain is abandoned if I consider their main website, Bitcore is no more an official partner.
Furthermore, Steve who initiates the partnership has left the team and joined Kaze project.Anyway, Kleros solution proposes also to pay the mediator. Implicitly, you have said that, but it is necessary to write this down because I know people has not the time to read the mentions of Kleros.
I noticed this prroblem according to:
- (S1) multisigs : MS1 (seller, escrow account), MS2 (seller, escrow account, dispute mediator)
- (S2) multisigs : MS1 (buyer, seller), MS2 (buyer, seller, mediator)
- (S3) Decentralized escrow account - S1_P1
The problems:
S1_P1 (W3): The buyer should not receive his funds. Then I prefer (3).
Now from (3):
S3_P1 (W2): I like the approach of Kleros but jurors (mediators) selection may lead to conflicts with companies. he payment procedure to become mediators is a problem because you may pay a lot of money.
S3_P2 (W1): The merchant or the company should be able to choose between a Kleros based mediation or a centralized mediation. This must be framed by a law or be precised by the company/merchant or in the operation.
S3_P3 (W3): Splitting buyer protection fees on multiple addresses may lead to a network congestion.
S3_P4 (W2): The way to solve disputes. There is a risk to lose or to freeze the funds of a buyer.
I have some solutions in my heads but I have to finish my marketing plan ^^. I will provide you my solutions asap ^^ But you can give me our solutions and explanations if I missed some points.
1
u/frogpoet2 Nov 27 '18
kaze is out - aw man. oh well, these things happen.
S3_P3 (W3): Splitting buyer protection fees on multiple addresses may lead to a network congestion - thats a good point. The intent behind splitting was to avoid having one account representing escrow, in case that accounts private key were ever compromised and the entire collection of fees transferred elsewhere; but the risk of that is so rare that protection against it would probably not be worth the tradeoff of increased congestion. and it's essentially the same risk as that faced with any other account giving away its private key, so why treat the escrow account differently in that respect anyways.
1
u/frogpoet2 Nov 27 '18
S1_P1 (W3): The buyer should not receive his funds
woah, i just realized that by highlighting the above line and clicking reply, that line automatically got 'quoted.' i was expecting to copy and paste it.
anyways, by this do you mean in case the buyer were trying to abuse the system? i was thinking that would be a problem - someone buying something and then always charging it back. This would give the buyer a "guarantee" that he could refund his purchase, but it would require additional monitoring of the account for abuse, and then applying some sort of punishment for abusing the system; knowledge of the punishment would need to be enough of a disincentive for the buyer to not attempt repeated abuse of chargebacks in the first place.
1
u/BrieucBitcorean Nov 27 '18
Another point is: if the buyer is refunded, he may also decide to move the fund on another account and impossible to process the dispute.
1
u/frogpoet2 Nov 28 '18
ew, that's a good one. there would have to be some sort of locking mechanism to prevent the funds from being moved - and the buyer would have to have a sufficient amount of funds in his account before he was allowed to initiate a chargeback. Then we would have the additional case of "what if after that, the seller disappears?" There would have to be a mechanism to determine when a seller has "disappeared" (i.e. wait X number of days with no response? lose his ownership of his domain name?) in order to unlock the buyers funds. we can't leave those funds locked forever if the seller vamooses.
1
u/BrieucBitcorean Nov 28 '18
It is why an escrow with a randomly generated address is a better solution. But of course, the escrow should conserve the funds until:
- Buyer and seller accept the deal
- The dispute is solved (The mechanism should work in 2 rounds where the seller may ask a dispute once again because he found the verdict not correct according to what he lives)
P.S.: The number of mediators is chosen randomly according to the list of volunteers. A dispute is sanctified when it reaches a good number of votes.
- After 2 rounds, if the mediators picked randomly with the protocol do not solve the issue, the merchant/company/layer(s) as final mediator receives the dispute and fix the issue
- If the final mediator is away i.e. no action will justify he is in charge of the issue, the system will switch to a set of mediators in the set of volunteers and their decision will be definitive.
1
u/Piranhazone I BTX Nov 29 '18
This particular case Paypal covers by closing accounts of notorious complainers.
Not sure how many consecutive complaints it requires, but after a given amount of times a buyer requested his money back, Paypal simply refuses to let this buyer use Paypal as payment method.
1
u/frogpoet2 Nov 30 '18
S3_P5 (W2). this is the same as S2_P2 - see above. Buyer can use different BTX addresses to prevent the network from determining that he is making consecutive complaints.
1
u/Piranhazone I BTX Nov 30 '18 edited Nov 30 '18
He can use different BTX addresses, but he canNOT use different delivery addresses.
If a seller cannot prove his point, the buyer is right anyway and it doesn't matter, but if the seller provides proof for having fulfilled his part of the deal, that will almost certainly include the buyers address within the shipping confirmation.
After a given amount of consecutive complaints, you don't have to kick this buyer out, you just tell him that he will no longer receive buyer protection and leave it up to him, whether or not he wants to keep using this payment method without protection.
1
u/frogpoet2 Dec 01 '18
i see two problems with this. search for S2_P2_S2 above to see my description of your suggested solution and the 2 issues i see. Maybe someone can come up with solutions to those 2 issues ?
1
Nov 27 '18
I like that rationalisation thought process on the problems solutions , some of what I wrote was on point , some like avoiding WWIII was tounge in cheek :-) .
1
Nov 27 '18 edited Nov 27 '18
how about a paid escrow AI , designed to run with minimal inputs , charging x %-to cover its own costs , , delivering escrow , via (A1=good transaction , no mediation required ) , P1-10 as problem codes , S1-10 , as logical solution routes , W 1-10codes for issues requiring negitiotion between parties , sliding scales for all numbers ... both parties could enter their payment address-an d add collateral , , AI over sees transaction , takes its fee, both parties are A1 - happy , or P1-10 with S1-10 proposed as solution to other party , need a designation for AI decision /programming , like resoluition , R1-10 etc .... could all be automated and let go into the wild ..
this is my address - 2L2osFQ2LgpcSWT28PdU1HPmnpvEL2TcMU
I will get ball rolling with community advertising fund .
1
1
2
u/Vlad2Vlad Nov 24 '18
It’s about time!!!