2

Lets imagine the Fed start registering digital USD for use in offline e-wallets, and they figure out a way to make it so that only registered wallets can make transactions.

Without an online centralized server validating and tracking ownership of currency to a wallet, I would worry that hackers could theoretically dupe money.

I know that each time that currency changes wallets, the transaction would need to be signed into the currency.

But what about in cases where there is a dupe (Double-spending) of that currency from the same state?

Could a digital currency function even temporarily offline?

Theoretical safeguards like unhackable wallets and a currency unit having to 'check-in' online after a certain amount of time before it can change hands again, and things like that are ok to assume. Just because whatever-coins haven't done it yet doesn't mean it can't be done.

But from an info-sec perspective, what are some ways to prevent/detect fraud in offline digital currency transactions?

  • 2
    Isn't that pretty much exactly what Bitcoin is? – cpast Nov 5 '14 at 17:58
  • I know its a digital currency but I believe it relies on an online centralized authority. – Andrew Hoffman Nov 5 '14 at 18:42
  • 3
    Bitcoin has been designed to be decentralized. There are offline extensions to bitcoin. – user10008 Nov 5 '14 at 18:56
  • Oh ok, well I guess this is more related to double spending of the same currency unit, which may require a centralized authority, but then how do you do that offline. – Andrew Hoffman Nov 5 '14 at 19:12
  • 1
    @AndrewHoffman user10008 is right, Bitcoin is exactly this. It's decentralized and prevents double spending. You should read up on it. – Luc Nov 5 '14 at 19:23
3

A system somewhat like you suggest is used for transport payment systems, like Oyster Card in London. The cards are (supposedly) tamper-proof hardware, and the balance is held on the card. There is a centralised system, but if the network goes down, Oyster can function offline.

The main security control is the physical security of the cards themselves, and I expect there is also fraud detection in the centralised system. There have been claims of hacks but it's not widespread - presumably the limited value of the cards reduces interest in hacking, and if you travel with a fraudulent card, you are risking arrest. Still, I think it is testament to the system that there have not been more attacks.

Bitcoin has a different objective. It is an online currency (like PayPal, or inter-bank clearing systems) - but it has no centralised system. The genius of Bitcoin is that they figured a decentralised way to perform the role of the centralised system. This comes at some cost - all the Bitcoin mining rigs whirring away around the world - but people clearly think it is worthwhile.

When thinking about securing these systems, you need to distinguish between design goals and implementation flaws. You mention that Bitcoin has had some double spending vulnerabilities. This may be true, but the design goal of Bitcoin is that double spending is impossible, and in general it is very good at meeting that goal. Any vulnerability that allows double spending will be fixed by updating the implementation. It's the same for Oyster - the design goal is that double spending is impossible, but there have been some implementation flaws.

  • I incorrectly used the verbage centralized authority. Any widely accepted trusted currency will have a central authority, what I meant is basically the ability to remain offline and make transactions like a physical currency. That is why I'm more or less not too interested in bitcoin's implementation, it is decentralized but not-so-offline. – Andrew Hoffman Nov 5 '14 at 20:57
  • 1
    I'm not sure oyster is comparable - oyster does use a central authority server, to dupe spend you'd have to know the central server was offline, leaving you with a limited window to commit fraud before it's back up... All to save £6. That's very different to deliberately taking advantage of an always-offline or usually-offline transaction system for a gain of $thousands – Jon Story Nov 6 '14 at 9:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.