The Bitcoin Fluid Dispenser II [video] | Hacker News Reader

The Bitcoin Fluid Dispenser II [video]

andyschroder.com

15 pointspmorici29 comments

I can't wait until people start setting up fakes that simply take your money, or figure out how to hack these machines into displaying the hacker's wallet instead of the gas station's. Wanna see a magic trick? Avada Kedavra, poof! Your money's gone, and there's no way to get it back.

On the other hand, this _adds_ protection against certain attacks. For example, it is common for criminals to put up fake ATMs, or surreptitiously add hardware to existing ones, so that when you use them they steal your card number and PIN. One could do the same for gas stations, and they could steal arbitrarily much money from you. With the bitcoin setup, the most you can lose is the payment for the gas.

For example, it is common for criminals to put up fake ATMs, or surreptitiously add hardware to existing ones, so that when you use them they steal your card number and PIN. One could do the same for gas stations, and they could steal arbitrarily much money from you.

When someone stole my card and got gas with it, the credit card company immediately refunded me the transaction. If it were bitcoin theft, I would have lost my money.

Also, people go to prison for a long time for stealing credit cards. I may have missed it, but I think the law hasn't yet convicted anyone of bitcoin fraud. So there's no deterrence yet.

"the credit card company immediately refunded me the transaction"

You pay for that service in the form of ~3% higher prices on everything you buy. Gas stations are a great example because they actually list separate prices for cash vs credit card sales so it's pretty obvious what that credit card costs you. You still paid for that loss it was just amortized over the 1,000's of transactions you do every year so you can make yourself feel better about it. In the case of your stolen credit card the losses could have gone all the way up to your credit limit. In the case of a fake QR code at a Bitcoin gas station the most you could possibly lose is the $50 it takes to fill your tank and it would more likely be the gas station that shouldered the loss because they would still be dispensing the gas to you because otherwise people would be wise to the thief after a single "I paid but the pump didn't turn on" incident.

"I may have missed it, but I think the law hasn't yet convicted anyone of Bitcoin fraud."

There is at least one that I know of and I could cite several other civil suits working their way through courts right now involving allegations of fraud and involving Bitcoin.

https://www.sec.gov/News/PressRelease/Detail/PressRelease/13...

Debit cards aren't as nice here. You can end up being liable for a good chunk of the loss if the skimmer gets your PIN and you don't notice the fraud right away.

This is one reason why you should never run transactions as debit.

I can't wait until people start adding skimming devices that take your money, or figure out how to attach a GSM skimmer so they don't even have to retrieve the device. Wanna see a magic trick? Avada Kedavra, poof! Your moneys gone, and there's going to be a seriously long wait before you notice it gone or before you get it back.

There's a physical presence, so if the owner set it up to take your money and not give you any product, you should have little trouble getting the police to take care of it.

For the hacking scenario, I imagine the owner of the pump could still be held liable for the loss.

There's no way to prove whether the owner was a victim of hacking, or whether they intentionally set it up to steal people's money. And since the law won't catch up with bitcoin for many years, consumers will bear the risk in the meantime.

Why does the law have to catch up with bitcoin? It's just a cash transaction that happens to use an unusual currency. Fundamentally, it's no different than a pump that takes cash, which has the same potential for ripoffs. Gas pumps that take cash aren't common, but vending machines for other stuff are, so it's not an unprecedented thing.

Bitcoin enables some novel and difficult situations, but this isn't one of them.

It's a currency with irreversible transactions, meaning there isn't any fraud protection. With cash, the consumer would get their money back. With bitcoin, they won't.

That doesn't make any sense. Cash transactions are irreversible too. The consumer gets their money back not by reversing the transaction, but by calling in the law and getting large men with guns to force the person to return the money. This works equally well with bitcoin as it does with US dollar bills.

The consumer gets their money back not by reversing the transaction, but by calling in the law and getting large men with guns to force the person to return the money.

Actually, consumers get their money back by calling up their credit card company, saying "I didn't make this transaction," and then the credit card company issues a refund and a new card. I've done it.

Anyone can be a bitcoin payment processor, meaning anyone can set up a fake system to steal your money. The best you can do with dollars is to steal a credit card number, which gets you prison time and no money.

We're not talking about credit cards, we're talking about cash, as in small green pieces of paper. The law adequately handles cash fraud and bitcoin is no different. There is nothing for the law to "catch up to" as you previously stated.

There's been a history of people setting up fake ATMs, rolling in looking all official-like, plugging them in without people questioning it, and later being removed for data extraction. Few people find it suspicious that a brand new piece of hardware isn't "working correctly" and never dispenses money.

Setting up a pump in a parking lot would only draw attention because of the relative novelty of it.

Slapping a "We accept Bitcoin" sticker on someone else's regular gas-station pump and betting that someone would eventually send money would probably be more profitable.

Exactly, I think the risk to the consumer here is actually substantially lower than is the case for a debit-card accepting pump. There is no way to install a skimmer on these. Your liability is limited to the amount of bitcoin you transfer.

I can't invest in a low-risk mutual fund without reading five or six notices. They explain, "Past performance is not a guarantee of future results...There is risk associated with this investment...etc..."

Why shouldn't companies that encourage consumers to invest in Bitcoins disclose all the related risks? Granted, I'm thinking mostly of certain Bitcoin exchanges that pitch Bitcoin as a smart option for personal finance and savings. Still, companies about doing X with Bitcoin are based on this premise.

Bitcoin aficionados will see this is a boring or unpopular sentiment,but bear in mind that I'm not saying Bitcoin isn't a good investment. My argument is that, from an ethical standpoint, the discussion of risk and volatility should be built into the way Bitcoin-related startups communicate.

If Bitcoin gets me to work in the morning, what happens when the value of my investment drops by 50%?

"I'm thinking mostly of certain Bitcoin exchanges that pitch Bitcoin as a smart option for personal finance and savings"

Can you cite a specific legit exchange that does that I can't think of any.

"If Bitcoin gets me to work in the morning, what happens when the value of my investment drops by 50%?"

This sort of sentiment is looking at it for what it was not what it will be.

As I type this reply, the counter says parent comment is 15 minutes old. It is the top comment right now. Why on earth? It is an off-topic comment! Is it because anti-Bitcoin sentiment is popular? Or is it because on HN the top comment must always be negative, even if off-topic, for some weird bias of the community?

Double-spending seems problematic. You can't really wait 10-30 minutes before starting to dispense gas, the lines would be terrible.

I don't really see the problem. Start dispensing gas immediately. Have surveillance cameras with timestamps that tie into the transaction. In the unlikely event that you lose out to a double-spend, you have the culprit's face, his car, and his license plate and you can point the police to him.

Let's not forget that until fairly recently (ten years ago or so?) it was common for gas stations to let you pull up and start pumping without any payment whatsoever. You went in and paid after you finished. There was occasional abuse, but it worked reasonably well overall.

You haven't had much experience reporting crimes to the police, have you?

If you tell a cop that someone cheated you in a transaction involving BitCoin, I'm guessing that 80% will laugh at you and tell you to contact your insurance company and fill out an online property crime report with their automated city/county system before hanging up, 15% will actually open an investigation on your gas station for suspected money laundering or tax evasion, and 5% will actually follow up on your report as you seem to expect they should.

There are dedicated laws for gas station drive-offs and as far as I know the police take it fairly seriously. In some states you can lose your driver's license for committing a drive-off.

If gas stations managed to survive the era of ubiquitous post-pay transactions without being killed by drive-offs, you are not going to convince me that bitcoin double-spends, which are vastly more difficult to pull off than simply pulling up to the pump, pumping, and driving away, are somehow an insurmountable problem here.

It is not an insurmountable problem, but the solution is not to let the police handle it. The police response does not prevent the station from losing money. It just prevents the same people from committing the same offense many times in a row.

The reason you have to pre-pay now when you didn't before is that pay-at-the-pump points of sale make it possible to require it without losing business. Stations that had prepay-at-the-pump could lower their prices below stations that did not. The stations that did not have pre-pay did not die off because all the competition was in the same boat, using the same technology and exposed to the same risk.

You can't avoid those economics. Your pay-by-BitCoin technical solution has to be the same order of magnitude time-wise on verifying the payment as credit card terminals. At the least, your transfer should be verified by the time the customer is filled up and ready to drive off.

As such, the solution should probably be to take a big transaction to activate the pump, verify it while the pump is running, and issue a refund transaction for the unused amount after that verification and before the customer drives away. If the transaction fails due to a double spend, the person might still be on the premises long enough for an employee to request an alternate form of payment. Or use a coin with shorter transaction verification times.

Or the solution could just be to not wait for validation. Yes, it will mildly increase fraud, and thus costs, but evidently not a huge amount. It could make bitcoin-gas more expensive than the regular kind, but so it goes. Given the difficulty of carrying out a real double-spend attack, I doubt it would happen with any sort of frequency.

As long as no other BitCoin-accepting pump can devise a better solution, whatever solution you have that works as well as a credit-card-accepting pump should be just fine.

> Let's not forget that until fairly recently (ten years ago or so?) it was common for gas stations to let you pull up and start pumping without any payment whatsoever.

That's actually a bigger point than you seem to think. Gas stations deliberately stopped allowing this for a reason. Did the ability to defraud a gas station owner go away in the past 10 years and no one noticed? If so then surely they'd allow for pumping before payment today without Bitcoin.

Prepay won because it's generally better, but postpay is still viable. Certainly the solution doesn't need to involve a 10-30 minute delay for validation before dispensing product.

"it was common for gas stations to let you pull up and start pumping without any payment whatsoever"

That's how it works in the UK. In many stations (at least in London) one of the people at the cash register has to press a button, but they do this after seeing you and (I guess) after they've confirmed that the number plate was correctly OCR'd.

Good point.

Reply on news.ycombinator.com