Think Payment Cards are Insecure? Just Wait Until Push-Payments Hit Primetime…

What Brazil’s Boleto Fraud Tells Us About Bitcoin and other Push Solutions

When I explain to people how payment cards work, they are usually aghast. I point out that when you hand your card to a merchant and sign your name or enter your PIN, you’re authorising them to suck funds out of your account and the only thing that stops somebody draining all your money is trust. The picture below shows the standard “four-party” model for payment cards and I stress that the consumer is merely authorising payment; it’s the merchant and all the other actors who actually move the money.


The Payment Card “Four-Party” Model: Consumers authorise merchants to pull money out of their account.

(Aside: I’ve never understood why this is called the four-party model. I count at least five parties on that picture…)

Online, the problem is more stark: you type your card details, including your CVV2 “secret number on the back” into your browser and hope for the best: you have to trust the merchant, their IT supplier, the acquiring bank, their third-party processor, the card network and your own card issuer – and everybody who works for them and has access to their systems. If a bad guy gets hold of your card details at any point in this process, they could drain your account. The picture below shows the scope of all the entities with access to your critical card information:


Your Primary Account Number – PAN – passes through the hands of pretty much everybody involved in processing the transaction.

It seems mad: why would you spray such sensitive information all over the place willy-nilly? Whoever thought it was a good idea to build the system this way?!  Except… the system works.

Fraud is surprisingly low given the design – and consumers get compensated if something goes wrong. And the design isn’t actually as mad as it seems: how else would you build a consumer payment network in a world where you can’t assume the consumer has a smart device with guaranteed network connectivity?

Payment card networks also have the advantage of decades of experience and refinement. For example, the Payment Card Industry Data Security Standards (PCI-DSS) lay down rules and guidance on how to protect the sensitive card data. The EMV smartcard standards make it harder to clone cards. Issuers have sophisticated heuristics to block suspicious transactions. And forthcoming moves to standardise “tokenisation” (something I should blog about one day) will further mitigate the risk of card details getting into the wrong hands. So an underlying architecture that appears wholly unsuited to the web age has actually been patched up to be good enough (but not perfect – and it still has lots of problems)

The Push Pay Revolution – a better way to do retail payments?

As I’ve written often, there is an entirely different way to design a retail payment system, one where the consumer doesn’t have to trust nearly as many people. I call these sort of payments push payments.  Bitcoin follows this model, as does M-Pesa, iDEAL, ZAPP and the Boleto system in Brazil. The defining characteristic of push-payments is that the consumer is in the driving seat.

With Push, it is the consumer who instructs a payment – from their bank or telco or Bitcoin wallet

This is unlike pull-payments, where the consumer merely authorises the merchant to pull the funds from their account.   The difference may seem subtle but it turns out to be hugely important. The picture to have in mind for push-payments is this one:


Push payments have a very different threat model to pull payments. Now the consumer only has to trust their payment provider and their own device.

In previous articles, I talked about the benefits of push payments in terms of innovation and the reduced need to trust quite so many people.   In this post, I look at one of the downsides: push payments can be compromised in hard-to-detect ways if they are not implemented really carefully.

So what’s the problem with push payments?

First, let’s remind ourselves about what we do have to trust and what we don’t have to trust in the pull world.

In the pull world, the consumer has to trust everybody else – and, as I’ve discussed above, there are various safeguards in place to fix things when they inevitably go wrong. One might argue that the safeguards don’t always work and that they come at a cost. Both arguments are, of course, valid but let’s leave them to one side for now.

In the push world, it’s different. The way it’s supposed to work is like this:

  • Step 1: The merchant “tells” the consumer how much they’d like to be paid and to where the payment should be sent. Examples:
    • With M-Pesa, this is usually done in-person, verbally
    • With Bitcoin, it is either done ad-hoc or via a QR-code displayed by the merchant or via the emerging BIP70

To illustrate the point, here is a picture of me in Shoreditch trying to tell a Bitcoin ATM where to send some Bitcoins I’d bought. On my laptop screen is a QR code that represents my Bitcoin wallet address. Note how it’s me as the Bitcoin receiver who is telling the sender (the ATM) where to send the coins.     In the more common case, where I am paying Bitcoins, this means it is the merchant who has to show the QR code to me. I need to know where to send the money to.


This is me using a QR code on my laptop to tell a Bitcoin ATM where to send my Bitcoins. (The Apple Bitcoin ban was still in force when we took this photo… so I had to use my laptop rather than my iPhone…)

  • Step 2: Once the consumer has the payment request, they use a program or app on their smart device (laptop, smartphone, whatever) to instruct the payment. Examples:
    • An M-Pesa user launches the M-Pesa SIM app and instructs the payment
    • A Bitcoin user pastes the destination address and value into their Bitcoin wallet
    • … or uses their wallet to read the recipient’s QR code
    • … or opens the BIP70 Payment Request with their wallet)

When you put it like this, push payments are obviously superior, right? The consumer is in control, they don’t have to trust all those people and there’s no danger of a rogue agent sucking all their money out of their account!

Not so fast…

The analysis above neglects one small, but rather important, fact: devices get hacked.

In the pull model, the only devices that can get hacked are those inside the “circle of trust” – your plastic card is pretty impregnable.  And as the utterly disastrous Target breach suggests, consumers were made whole when the disaster happened. It was the big firms who messed up who suffered the consequences.  

Yes… I know this is counterintuitive… you must be asking yourselves: “is this guy seriously arguing that the Target disaster is an argument in favour of the current payment card model?!” Obviously, no…. the episode was clearly a catastrophe and it was really, really bad.   But… it did eventually get sorted out and the roll-out of EMV, tokenisation and better enforcement of PCI-DSS should reduce the risks of something similar in the future.   So I raise this merely as prelude to the push scenario.

Now ask yourself what happens if a device gets hacked in the push scenario.  The obvious question is: which device?   Well… the only device in the circle-of-trust this time is the consumer’s smartphone. Uh-oh.

This is the device from which we’re instructing real-time payments, right? The one that could be riddled with malware?

This might have been merely a theoretical risk…. And then the Brazilian Boleto fraud happened.

RSA have a great write-up of a country-scale real-life example of what can go wrong when push-payment systems get breached… and it’s really scary.

The Brazilian Boleto system is very cool.   At core, it is a way for fund requestors (utility firms, etc) to send a payment request to consumers. The request is known as a Boleto and they can be physical or electronic.


A Brazilian Boleto. Think of it as a mainstream equivalent of a Bitcoin BIP70 Payment Request…

The idea is this: the Boleto has details of the payment request and includes details of how much to pay and to where.   This is in coded text format and a bar code… basically, something that a consumer can take and feed into their banking app: scan the code with your mobile banking app, approve and you’re done. Or you could take it to a bank branch. And if you’re online, you could copy and paste the code into your online banking website and achieve the same end.

Except… the RSA paper shows all the ways it can and has gone wrong.

First, there’s a simple problem of authentication. How do you know the Boleto really did come from who it says it’s from?   The RSA paper documents examples of people receiving Boletos via email that look convincingly genuine but which have the fraudster’s payment account details in place of the firm from which they purport to come.

This is a real problem but it’s nothing new… it’s not really any different to fake websites that masquerade as real ones. We solved it in the pull world with SSL certificates and the like for websites. And the Bitcoin Payment Protocol includes the option to use the same PKI system, for precisely these reasons.

However, the RSA paper also discusses another attack – and this one’s scarier.

This second attack comes in the form of malware that runs in the consumer’s browser.   When it sees a document that looks like a Boleto, it silently changes the details that the consumer sees on their screen: the payment details are changed from the genuine recipient to the attacker. So when the consumer copies and pastes the details into their banking app, it’s the attacker’s account they’re sending the money to.

Variations on this theme are included in the paper but they all amount to the same thing: if the consumer’s device is compromised then it’s game over. And you don’t even need to compromise the whole device or get root-access… you just need to compromise the browser in this scenario.

There are various mitigation mechanisms one can implement (e.g. tying the payment instruction to a signed representation of the payment request and so forth) but the underlying problem remains: if you’re using the consumer device to instruct payments, you have an issue if that device is compromised.

Now, this risk is perhaps over-blown: the risks identified here apply equally to standalone mobile banking apps and we happily run these on mobile devices today, albeit with the belief that their bank will bail them out if something goes wrong. (It’s no surprise that banks are big users of technology like IBM Trusteer).

Similarly, Bitcoin users run their wallets on their devices, in the full knowledge that there is nobody who will bail them out if malware runs amok on the device.  

But I think the two-step dance of an end-to-end push payment request/instruction – where the device is responsible for turning the request into the instruction – is something new that needs deeper study.  So I think the Boleto story tells us is that we need to think very hard about things like:

  • User experience: how is the linkage between Step 1 (receive and authenticate request) and Step 2 (populate and instruct payment) executed and communicated to the user? If step 1 is done by a different app to step 2, what is the hand-off? What security assumptions are being msde?
  • Validation and Reconciliation: what work should (can?) the “network” do to validate that a payment instruction purporting to be in response to a payment request, really is traceable to that request?
  • Malware detection systems: what new behaviours should anti-virus and other technologies be looking out for?
  • Wallet providers: which scenarios are you willing and able to protect your consumers against?

It is possible that this is just a variation on the age-old theme that end-point security is hard – but when things like the Boleto fraud happen, we should use it as an opportunity to look at the other systems being built along similar lines and ask: are there any lessons we can learn and apply?

Why the payment card system works the way it does – and why Bitcoin isn’t going to replace it any time soon

The Payment Card Industry’s weird business model is a work of genius

Regular readers will know that I am extremely optimistic about the long-term potential of Bitcoin and cryptocurrency technology to revolutionise the financial system. But that doesn’t mean I think they will overturn all aspects of the system.

In particular, I am skeptical of claims that Bitcoin will have a meaningful impact on retail payments and break the stranglehold of the payment card companies.

Of course, many people disagree with me. Articles such as this one from last year are typical of the genre: “credit card companies” are accused of charging obscenely high fees, hindering innovation and being ripe for disruption.


Payment Cards fees might seem expensive but does it mean they are vulnerable to disruption?

Now, it’s true that the fees do seem expensive at first glance but, as David Evans has argued, it’s not obvious that the Bitcoin payment processors are really that much cheaper, once you take into account their spreads and the costs of getting into and out of Bitcoin at each end.

But the main reason I think the incumbents are in such a strong position is because the industry has extremely strong network effects, which leads to formidable barriers to entry. Would-be Bitcoin entrepreneurs need to understand this structure if they are to succeed.

The Payment Card Industry is marvellous and weird at the same time

When you step back and think about it, the modern payment card industry is a marvel – an underappreciated, underrated miracle of contemporary commerce: you can travel to any corner of the earth, armed only with a piece of plastic bearing the Visa or Mastercard logo. It’s a minor miracle.

But when you look at the businesses of the major card brands, they turn out to be really, really strange companies. They simply don’t do what most of us think they do.

Take a card out of your pocket… chances are, it will be a Visa or Mastercard, or maybe UnionPay if you’re one of my Chinese readers. Let’s assume it’s a Visa card for now. And we’ll worry about American Express later, because they’re different to all the rest.

Here’s one of my Visa cards again:


A Visa debit card, issued by first direct bank.

Notice something strange. There are two brands on the card. There is the Visa logo and there is one for first direct, the division of HSBC with whom I hold my current account.   Most other consumer products don’t have two firms’ logos on them. Something strange is going on.

Now, it it was first direct that issued the card to me, not Visa.

It is first direct’s website I visit to see my balance, not Visa’s

And it’s first direct I would call if something went wrong, not Visa.

I don’t have any relationship with Visa at all.

There’s no Visa call centre I can call if I have a problem with my card and there’s no Visa app on my phone.  This is strange: a hugely powerful global brand and yet the billions of consumers who use it don’t have a relationship with them.

It gets stranger. Another little-known fact is that no retailer anywhere in the world has a relationship with Visa either!  So we have one of the world’s most recognizable brands and nobody who uses their “product” has any relationship with them.

It’s worth thinking through why this might be and why it is such a powerful model.

How would you build a credit card system if you were doing it from scratch?

Imagine you run a bank in a world before credit cards.   Wouldn’t it be great if your customers could go to local shops and “charge” their purchases to an account that you hold for them?   You could make money offering credit to the customers and make some more money charging the merchants for providing this service.

This is what Bank of America did in California in the 1950s. They issued credit cards to lots of their customers in various cities and signed up local retailers to accept them. Great – the payment card industry was born! You could think of the model looking something like this:

Cards Picture 1

A simple card scheme: a bank issues cards to its customers and reimburses local merchants who accept those cards

But this model has two really unfortunate problems:

  • Your competitors are going to copy this and you’ll soon have schemes like this popping up all over the country, all run by different banks, on different systems, racing to sign up consumers and merchants onto their product
  • Your customers will travel. And they will be very upset when they discover they can’t use your card in a merchant who only takes a different bank’s cards

You would end up with the situation in the diagram below: a merchant who banked with Bank B wouldn’t accept cards issued by Bank A. Why would they? They had no relationship with Bank A and who’s to say cards from Bank A would even work with their machines?!

Cards Picture 2

Why would cards issued by Bank A be accepted by a merchant who uses Bank B if Bank A and Bank B operate competing schemes?

If you were running one of the banks, how might you respond to this problem?

One answer might be to view this as an arms race: perhaps the best strategy is for banks to enter an all-out war… sign up as many merchants as they can… sign up as many customers as they can and bet that you’ll be the last firm standing when the industry shakes out. Obvious problem: it would be ruinously expensive and what happens if it ends in stalemate? You still have the same problem.

But there’s another option… what if you cut deals with other banks: agree for them to accept your cards at their merchants in exchange for you accepting their cards at your merchants. This sounds quite promising but… obvious problem: how on earth would the merchant handle this? They’d need a huge book by every till that listed precisely which banks they could accept card payments from and which ones weren’t allowed. It would be chaos… But perhaps it points the way

A flash of insight – who are you really competing with?

Let’s recap: you’re a bank executive trying to build a payment card business. But your competitors are all trying to do the same and it’s going to end in tears: you’ll confuse the merchants with hundreds of different card types or you’ll go bankrupt trying to be “last man standing”.

It feels like having other banks accept your cards at their merchants would be good… but how to make it work?

And this is where a flash of insight changed the world.

Somebody realized that the cards “business” was actually two businesses.

The first business is all about offering credit to your customers, managing their accounts and processing their payments. We could call this card issuing.

And the second business is all about enabling merchants to accept card payments and get reimbursed. We could call this merchant acquiring.


Aside: we call it “acquiring” because it’s helpful to model the card payment as a receivable that the processor purchases (acquires) from the merchant at a small discount, which you can think of as the processing fee.

This is the key point: issuing and acquiring are totally different businesses which don’t compete with each other.

Sure… all the issuers compete with each other.

And all the acquirers compete with each other.

But the issuers don’t compete with the acquirers.

Indeed, they have a really strong incentive to co-operate… the issuers want all the acquirers to accept their cards… and the acquirers want to offer their merchants the ability to accept as many cards as possible.

So let’s imagine a group of issuers teamed up with a group of acquirers. And imagine they agreed that the acquirers would all process the cards of all the issuers in the group: every issuer’s card would be accepted by every acquirer.   They could use this forum to hammer out some standards: they would agree a common way to process cards, timescales for reimbursement, rules for what happens if something goes wrong… they’d define a “scheme”.

Now… this scheme would need two things: consumer recognition and merchant recognition. Consumers would need to know their card would be accepted at a participating merchant. And participating merchants would need to know a given card was part of the scheme.

So we need a brand. This brand would be something you could put on the cards and place in the shop window. It is how a merchant would know an issuer’s card was part of this scheme and it is how card holders would know a merchant was able to accept cards from that scheme.

One of these schemes is, of course, Visa. Another is Mastercard. And so on. And this is why cards carry two brands…. One to identify the issuer and one to identify the scheme.

In this way, the card schemes have created a system that allows merchants, who only have a relationship with their own bank, to accept payment cards issued by hundreds of other banks, without having to have any relationship with those banks at all.   The only thing that matters to them is that the issuer’s card is issued on the relevant scheme.

And this model has really strong network effects… the more issuers and acquirers in the scheme, the more useful the scheme is to card holders and merchants. It’s self-reinforcing.

Talk is cheap… how does it work in practice?

OK. So we have a paper agreement that says an acquiring bank will accept any valid transaction made with a Visa-badged card.   But how? How do they get approval from the issuer for the transaction? How do they get reimbursed? How does it work in reality?

Do all members of a scheme have to have a relationship with every other member so they can route the transaction to them for payment? That would be expensive and error-prone.

So this is where the scheme re-enters the picture.   In addition to maintaining a powerful brand and setting the rules, they also run a switch: the merchant acquirers send all their Visa transactions to Visa itself… and Visa then forwards them on to the appropriate issuer.   Similarly for Mastercard and the other schemes.

So we end up with a hub-and-spoke model… with Visa at the centre. (And Mastercard and Union Pay and so forth).

Cards Picture 3

Issuers and Acquirers are members of a “scheme”, which sets the rules and acts as a central “switch” to route transactions. It means merchants with one bank can accept payments from customers of another bank, without having to maintain bilateral relationships

So now we can see why card schemes are so successful: their globally-recognised brands create networks that anybody aspiring to issue or process cards need to be part of. It’s a self-reinforcing virtuous circle that is extremely hard to disrupt

And this is why Visa’s “customers” are the issuing and acquiring banks… not end-consumers… Visa exists so that issuers can receive broad acceptance of their cards… and so that merchants can, in turn, offer broad acceptance.

But the schemes depend on consumer recognition – hence why they spend so much money advertising to consumers, even though the consumers are not their customers.

What does this have to do with Bitcoin? Push versus Pull

Notice something really important: this is a pull system… the reason you need all this infrastructure is because your card information has to get all the way from the terminal in the merchant back to the issuer so the issuer can pull the money from your account and send it back to the merchant.

By contrast, Bitcoin is a push system: once you know the merchant’s “account” details, you can just push the payment to them. So why do you need all these intermediaries?

If you were a Bitcoin payment firm trying to break into the retail market, perhaps that’s where you’d start? After all, it’s true that most of the payment card infrastructure simply isn’t needed in the Bitcoin world.

But notice how I set up this story. The infrastructure was the last thing I talked about. For me, the two most important things are:

1)   Global acceptance.

2)   The rulebook

Think about what Visa and Mastercard have achieved: they offer global acceptance and predictable behavior.   Wherever you are in the world, you can be pretty sure somebody will accept your card and you know how it will work and that there is a well-understood process when things go wrong. This offer is powerful. Ask yourself: if you could only take one payment instrument with you on a round-the-world trip, what would it be? If you couldn’t stake a stack of dollar bills, I suspect you’d opt for a credit card.

And this predictability – a consequence of the rulebook – is important: consumers enjoy considerable protections when they use a major payment card. They can dispute transactions and, in some countries, their (credit) card issuer is jointly liable for failures of a merchant. Consumers like to be nannied… even if they have to pay for the privilege!

So for those who aspire to overturn the incumbents, you need a strategy for how you will become the consumer’s “default” or preferred payment mechanism.

American Express has achieved this through a joint strategy of having large corporates mandate its use for business expenses and offering generous loyalty benefits to consumers… they effectively pay their customers to use their cards.

PayPal has achieved it through making the payment experience easier – but note, even here, many PayPal payments are fulfilled by a credit card account!

And this is why I harbor doubts about whether Bitcoin will become a mainstream retail payments mechanism, at least in the major markets… why would a consumer prefer it over their card?  Perhaps the openness and possible resistance to card suspension/censorship will attract sufficient users.  But it’s not obvious.

For me, the opportunity lies elsewhere: high-value payments, smart property and so forth.  But I could, of course, be wrong.  It wouldn’t be the first time…

An aside on history and factual accuracy

I know this account would scandalize a historian but that’s OK: It’s not intended to be historically accurate… the idea is to share intuition on why things are the way they are.

Some of the more important topics I’ve ignored or deliberately simplified include:

  • I’ve not explored the difference between Visa Inc (public company) and Visa Europe (owned by its members)
  • I’ve ignored the “three-party” schemes like American Express.
  • I’ve also ignored fee structures and the importance of interchange.
  • I’ve also not discussed the role of processors… specialist firms who effectively outsource the work of issuers and acquirers
  • Security
  • … and lots more


A decentralized securities trading and settlement system is being built hidden in plain sight

Colored coins, chromawallet, coinprism, NXT Asset Exchange, Mastercoin, Counterparty… tens of projects are working on asset tracking, transfer and exchange systems. What are they doing? Will it work?

I wrote a piece last year explaining how today’s securities trading and settlement systems work. The full picture of participants is pretty complex:

Figure 8 csd

There are surprisingly many parties involved in the safekeeping and exchange of securities. What would the picture look like in a “decentralized world”?

At core, I think the system is all about assuring “performance”. That is… it’s all about making sure that people actually deliver on the promises they make when they enter into a trade

Recent controversies might make this seem hopelessly naïve – and they show that ensuring fairness in exchange is important – but assuring performance is the core of the aspiration.

And to deliver on this aspiration, today’s system is based on a closed, centralized model. I talked about it here and also argued  Mt.Gox model was even more centralized than the mainstream system.

We’re now seeing serious projects work on this problem. Perhaps revisiting the fundamentals will help us predict which of these projects will prevail?

Why do we have exchanges in the mainstream world?  There are lots of valid answers (liquidity, fairness, …) but none of this matters if you can’t be sure a trade you make will be settled. After all, what’s the point of agreeing a trade with somebody if they can just change their mind afterwards if it suits them?

In the mainstream world today, the general model for a stock exchange is one where it has members, who are the only entities allowed to trade on that exchange. These members are subject to strict rules. For example, the London Stock Exchange’s rule book has over 100 pages:

Rule G5000 sums captures the critical function of the exchange for me:


“Obligation to settle: A member firm shall ensure that every on Exchange trade effected by it is duly settled.” Obvious, perhaps… but it needs to be said!

So the exchange helps ensure an orderly market by vetting and monitoring its members. This gives participants confidence: they don’t need to worry about who is on the other side of their trade. They know the trade they agree to will get settled. But other exchanges employ different models:

  • Prefund: Mt. Gox asked everybody to deposit their Bitcoins or fiat with them before they could trade. It guaranteed that trades executed on Gox would settle. Unfortunately, it only guaranteed they would settle on the books of Mt.Gox. As many people discovered to their cost, a settled trade on Gox was not the same as cash the bank or Bitcoins in their wallet
  • Escrow: The model I outlined in my piece earlier this year was essentially an escrow scheme. You place your Bitcoins beyond reach and they are either delivered back to you when your bid/offer expires or are delivered to the buyer. The trick here is in choosing the escrow “agent” (or agents…) carefully.
  • Clearing: This is how the The London Stock Exchange does it. In certain situations, members don’t even need to own the securities they’re selling at the time they trade them; they just need to make sure they deliver them as promised on the day of settlement. This model works because there is a closed group of trusted and well-known entities. However, there is clearly a risk: what happens if one of the participants goes bust between trade and settlement? That’s what a clearing house is there to solve, amongst other things. It keeps a close eye on its members, requires them to contribute to a “default fund” and steps in to make the other members whole if one of them fails.

Now, when we look at some of the most vibrant projects in the Bitcoin and cryptocurrency world, we see something interesting: a large number of them are working on representing non-crypto assets – such as securities – on the blockchain – They’re building out the vision of a decentralized general-purpose asset ledger.

There are two concepts we need to understand:

  • A token – something that represents an asset. Perhaps 100 shares of IBM Common Stock or ownership of a particular car.
  • An issuer – somebody that makes a promise to confer the rights and benefits associated with that asset to whomever holds it at any given point.

A concrete example: imagine I owned 10000 IBM shares (I wish…). I could issue them onto one of these platforms and publish the definition so others could see it and could see it was from me. I would, in effect, be making a promise:

“I will convey whatever benefits I enjoy through my ownership of these shares to whomever holds the token”.

So if I receive a dividend cheque, I pay it to the holder of the token. If you trust me to be good for this promise, you might be willing to purchase the token from me for $2m or so… the price of the IBM shares… owning the token would be just as good as owning the shares… and you could store it in your Bitcoin wallet and not have to deal with your broker any more!

Now, it is unlikely that you’d trust such a promise from me. But if was made by a major custodian bank you might. But note: you do have to trust the issuer.

So why bother? Why bother going to the trouble of building a decentralized asset ledger if you have to trust somebody at the end of the process?

For me, the answer is that this approach might allow increased competition between issuers. Furthermore, moving disparate asset registers (custody records, vehicle registration databases, etc) onto a common architecture might enable innovations we haven’t yet considered.   It’s too early to tell so we can all be grateful to the pioneers who are experimenting so we don’t have to.

I think there are three broad camps:

  • Coloring Bitcoins. Projects such as chromawallet and coinprism are working on systems to “tag” Bitcoins so that they can be tracked across transactions
  • New Protocols Running Over Bitcoin. mastercoin and counterparty piggy-back on Bitcoin’s peer-to-peer network, double-spend protection and consensus system but their tokens are essentially independent of Bitcoins. A counterparty token is not simply a “tagged” Bitcoin.
  • Entirely Separate Protocols. NXT and ethereum fit into this camp.

I have no particular insight into the structure of any of these projects so let’s assume they’re all run by capable, honest people and further assume that we’ll see a future where assets of all types, including securities, will be represented on a blockchain-like decentralized platform.

Then what? Presumably people will want to buy and sell…. To exchange.

And that’s where things get interesting… because we have to solve the performance problem.   We’re now in a decentralized, pseudonymous world… how do we ensure somebody who offers to buy an asset for a given price actually goes through with it and pays up?

What is the crypto-ledger rule G5000?

Is it possible to build a decentralized exchange on any of these platforms that has the strong performance guarantees we need? Can we build a decentralized exchange where a matched bid and offer inevitably lead to a settled trade?

It we look at our three models from previously, “clearing” isn’t going to work (it is, by definition, centralized and reliant on trusted identities). “Prefunding” is also problematic – what happens if the entity you sent your assets to disappears? So it looks like “escrow” is the only game in town.

Now, part of the solution already exists: we can construct “atomic” asset transfers using the Bitcoin protocol today. So I will assume exchanging payment and asset in a single transaction (“Delivery versus payment”) is achievable today on any of the platforms discussed above. But we need to get to a point where creating a valid transaction like this is inevitable once a bid and offer are matched.

Here’s where I think the state of the art is with the three approaches and it’s surprisingly different:

Coloring Bitcoins. The systems I’ve looked at don’t route bids/offers over the Bitcoin system so any matching will be done external to the platform. So it seems to me that “decentralized exchanges” on this model will have to require those posting bids or offers to demonstrate that they have placed the corresponding colored coins/Bitcoins in escrow with one or more acceptable third parties. There’s nothing that will do this automatically. So, it’s worth watchin firms like Xapo in the US and Elliptic in the UK. Professionally-run Bitcoin “cold storage vaults” such as these feel like “proto custodian banks” that could perform this function. The question is: can they devise a service that is sufficiently decentralized yet which still allows them to earn an income?

New Protocols Running Over Bitcoin. My understanding of these systems is that they embed bids/offers in the blockchain and have a protocol definition that means matches can be determined unambiguously. Furthermore, the act of making a bid or offer locks the associated assets until the trade is resolved or a bid/offer expires… automatic escrow, if you like. Assuming I am right, then this does appear to offer the “inevitability” promise that I think is so important. But it is at the expense of polluting the blockchain with bids/offers. It seems inelegant to me that one would store transient data (time-limited bids/offers) in such a permanent form of storage. But perhaps there’s no other way?

Entirely Separate Protocols. My working assumption is that NXT, too, works on the basis of bids/offers encumbering the associated assets until the outcome of the trade is resolved.  With Ethereum, the answer to every question is, of course, “it’s Turing Complete so of course you can do it” but I need to dig a little deeper to be sure….


Where is this going?

I think we’re going to see a market test: the colored coin approach is, in many ways, the most elegant as it uses the blockchain solely for storing/transferring the asset.   It means a range of exchange types can be trialled (escrow, pre-funding, reputation-based?)… but none of them will deliver full “inevitability” of settlement.  Perhaps consumers will care. Perhaps they won’t.

Projects like mastercoin and counterparty look able to deliver on the “inevitability” promise but will it be at the cost of blockchain bloat?

It will be an interesting few months ahead.


A final thought… What if we simply don’t worry about it and price it instead?!

The other approach is completely radical… instead of trying to force performance, why not model it as an option? We can think of somebody who posts a bid/offer but who then reneges as exercising an option to renege. This option clearly has value – if they would lose money by completing the trade as agreed, the option payoff is at least as much as they stood to lose! So is it possible to model the value of the option to renege and force participants to pay the option value up-front in order to post a bid/offer?

Unanswered questions: to whom would the price be paid? Is there any precedent for modeling the “option to renege” in this way? What would be the liquidity implications?


I said at the start of this piece that a new financial infrastructure is being built “hidden in plain sight”. For the reasons outlined above, I think the “exchange” aspect of this infrastructure still has a long way to go but we’re about to witness a fascinating experiment.

Bitcoin Mining: The First Technology Platform That Works because it goes SLOW?

They key to understanding mining is to realize we need blocks to be produced slowly!

Whenever I present Bitcoin to new audiences, I avoid talking about mining. I find it confuse more than it enlightens. Instead, I simply give some intuition. I say:

“Today’s value-transfer systems rely on central ledgers. Banks, telcos and other firms have a big computer that keeps track of who owns what. And when you want to make a payment, they update this central ledger. Bitcoin does it a completely different way. It doesn’t have a central ledger. Instead, everybody who runs the (full) software has their own copy of the ledger. That’s right: hundreds of thousands of people all have a full copy of the ledger. This means no single person can cut you off, confiscate your assets or charge you an unfair fee. And the genius of Bitcoin was to figure out a way to encourage people to maintain these ledgers and to do so honestly. Exactly how this works takes a long time to explain but the end-result is that we have a system with no trusted third parties.”

The value of this explanation is that skeptics in the audience know what assumptions I am asking them to make (“assume for now that the economic incentives and cryptography do actually work…”) but we avoid getting bogged down in unnecessary technical detail. It lets us move on to the more interesting topics

OK – so we have a way to side-step the mining question. But what if you actually need to talk about it? What then?

I am enlisted on the University of Nicosia’s Digital Currency MOOC, led by Antonis Polemitis and Andreas M. Antonopoulos and I was intrigued to see that they attack this question and the “byzantine generals” problem head-on in module two. It’s a very nice treatment.

In this post, I take a complementary approach and ask: how would I build a digital cash system from scratch if I didn’t know anything about Bitcoin? What might I try first? What might go wrong? How might I fix it?

Let’s go on a journey to build our own digital money system from scratch…

Imagine you wanted to build a system of electronic cash without a third-party. How would you do it?

Here’s one way. You could create some “money files” on your computer hard drive. These would be like bank notes. Maybe they’d look something like this:


An early attempt at a digital money system!

In the picture above, I have two “ten pound” files and two “five pound” files. Great – I have £30 of digital money. This is easy… Why did it take so long for Bitcoin to be invented?!

Now… let’s say I wanted to send £10 to a friend. This would also be easy. I’d just need to write an email, attach one of the “ten pound” money files and click “send”. Wonderful! The money has been transferred.

Screen Shot 2014-05-21 at 20.09.09

Emailing £10 to a friend. Who needs Bitcoin?

There’s just one problem…

There’s still a copy of that file on my computer.    So there was £30 in the system before and now there is £40. Now… I am, of course, honest and will delete my copy. But what if I forgot?

Worse, what’s to stop me simply making hundreds of copies of the “ten pound” file on my computer? I’d be RICH!!

This idea simply isn’t going to work and that’s why digital money systems have the idea of a ledger: there needs to be something that everybody trusts to keep proper track of how much money each person has.   We need this ledger to record the fact that I have £10 less and my friend has £10 more.

All systems before Bitcoin did this using a centralized ledger – in a bank or a telecoms firm, say.

But does this ledger really need to be centralized?

But here’s a thought what if I sent the “money file” attachment to my friend – just like before – but I also put everybody else in the entire world on cc?

The rest of the world could see that I had sent the money to my friend and if I tried to send the same file again in the future, they’d see that I was cheating and I’d be in big trouble…

If we leave aside questions of scalability, we could be on to something here…

But… race conditions are our enemy

But there’s an annoying problem. Software engineers call it a “race condition”. It’s still possible for me to cheat, even if the whole world is watching.

Here’s what I could do:

Imagine I owed £10 to each of Alice and Bob and wanted to cheat the system by sending the same £10 money file to them both:


I owe £10 to two people and want to cheat by sending them both the same £10 “money file”

I notice something interesting… Alice and Bob use different email providers….  And I know that information takes time to travel.

What would happen if I use my Gmail account to send Alice’s money to her Gmail account and I use my Hotmail account to send Bob’s money to his Hotmail account, copying everybody in the world on both emails per the rules?

Different people will see the emails arrive in a different order depending on which email provider they use.

Imagine you’re another user of Gmail:

You’ll receive a copy of my email to Alice pretty quickly. After all, I sent it from my Gmail account.   Shortly afterwards, you’ll receive a copy of the email I sent to Bob. It arrives a bit slower because it’s coming across the internet from my Hotmail account.

Now imagine you’re another user of Hotmail.

You’ll receive a copy of my email to Bob pretty quickly. After all, I sent it from my Hotmail account. Shortly afterwards, you’ll receive a copy of the email I sent to Alice. It arrives a bit slower because it’s coming across the internet from my Gmail account.

And now imagine you use a completely different email service. Who knows which email you’ll receive first… it will be effectively random.

So we have a big problem: everybody will see that I’ve tried to spend the same money twice…. that’s something, I guess.   But they won’t agree whether Alice or Bob is the rightful recipient! Some will think I sent it to Alice first – and that the payment to Bob is therefore invalid – and some will think I sent it to Bob first and that the payment to Alice is invalid!


There’s no such thing as total “ordering” in a decentralized system

And there’s no easy way to resolve this… we can’t rely on timestamps since I could fake them(and they might be identical). And we can’t simply say: “if you see a double spend then neither transaction is valid” since it would mean I could always block up the system and “take back” money simply by issuing a new payment to confuse everybody…

Oh dear.

But notice something interesting: it doesn’t matter whether Alice or Bob is judged to be the rightful owner, since one of them was always going to be disappointed. We just want everybody to know who it is.

And this is the insight that allows us to begin to solve the problem.

Because it means we should think of these payment emails to Alice and Bob not as definitive payments but as payments proposals. They might be valid. Or they might not. We need the “system” as a whole to determine it – it needs to come to consensus.

Now… figuring this out on a payment-by-payment basis would be overwhelming. So we’ll settle for a system that batches up these payments proposals into lists – or “blocks” – of confirmed payments.

So where have we got to? We have this idea of directly sending “money files” to recipients – “peer-to-peer”, if you like. And we have the second idea that you also tell everybody else in the world about it so they can see what’s happening. And the key problem to solve is: how do we come to agreement when payment proposals conflict?

Let’s bring the observers into the picture

Here’s something we could do: we could say to all the people on cc:

“hey… help us out here.   You’ve been copied on all these payment proposal emails. Why don’t one of you choose a selection of payment proposals that haven’t already been confirmed in the past and which don’t conflict with each other and email the list to everybody else? We’ll all agree that the list you circulate is the one we’ll go with to resolve the conflicts”

If we’re lucky, somebody might look through their inbox, choose some unconfirmed payment proposals and draw up such a list. Perhaps they decide that they will include the payment to Bob in their list. This means they can’t also include the payment to Alice (since those payments conflict with each other – they use the same underlying payment file). But at least we have a decision! They email this list to everybody else in the world.

Everybody receives a copy of the list and can update their own view of the world… their copy of the “ledger”, if you like…

So we all now know that a decision has been made: We have agreed through this “protocol” that Richard has paid Bob and the payment to Alice is invalid. And we know this because we know everybody else received the same file and will be following the same thought process.

Excellent. We now know Bob has the money and the world moves on. We’ve solved the problem right?

  • We have this idea of “payment files”
  • You “spend” them by emailing them to the recipient and copying everybody else in the world.
  • Somebody on copy periodically produces a list of transactions they’ve seen that are not fraudulent and are not “double-spends” and circulates this list to everybody else.
  • Everybody who receives this list knows that everybody else has also received this list and that everybody else knows that they have received it and so feels confident in updating their own records to record that the payments in this list are now “confirmed”

Except… why on earth would anybody go to the trouble of producing and circulating that list in the first place? What’s their incentive?

There really isn’t one.   So we need to incent them. Perhaps they can earn a small transaction fee or perhaps we could award them some newly created “payment files” in return for their effort. That would be a neat way of introducing these payment files into the system in the first place, in fact.

But now we have the opposite problem… everybody will want to produce these blocks and we’ll be overwhelmed with competing blocks being emailed to everybody… it will be like the worst “reply to all” email tsunami ever and nobody will know which of the competing blocks to use to update their ledgers!

It feels like we’re back to square one.

The world’s first technology platform that works because it goes SLOW

Exceptand this is the genius of Bitcoin. What if we could agree on a system that makes it so difficult to produce one of these lists that, even if everybody is trying really hard, they only produce one every few minutes?

The would give enough time for the list to work its way around the internet. And once you received it, you could be pretty sure there wasn’t a different one flying around because they are only produced every few minutes and if there was another one, you’d have seen it by now in any case…

So now you have the right balance: incentives to ensure somebody produces these lists (Bitcoin calls them “blocks”) and a system that makes it difficult so that they’re not produced so quickly that we end up with multiple competing blocks at any time.

And this is what Bitcoin mining is all about. It’s nothing more than participants in the system competing with each other to find one of these valid blocks in order to earn the reward.

Bitcoin aims for a “block interval” of about ten minutes. Perhaps this is too slow. Perhaps it’s too quick.  But it does achieve the aim of ensuing the blocks usually have time to reach everybody else before the next one is found.

Now… the system in use by Bitcoin is probabilistic… so sometimes two blocks are produced in quick succession. But this is rare… and you can deal with it when it only happens occasionally.

So how do you make things go “slow”?

One way to make block production slow is to make it incredibly difficult to produce one. This is what Bitcoin does. It uses a system called “proof of work”, where participants essentially have to perform nearly identical calculations again and again and again until a solution matching a pre-agreed pattern is discovered… and the difficulty of this problem is periodically adjusted so that a solution is found every ten minutes on average.

This seems wasteful but we need something just like this to achieve our aim of not producing blocks too quickly.

But there are other options. For example, one variant of a scheme called “proof of stake” makes it difficult to find a block unless you own several coins and you haven’t done anything with them for some time. This combination of “stake” and “time” dramatically reduces the opportunity for participants to find blocks and so the rate is kept low, without computers having to burn electricity solving puzzles to the same extent.

The security analysis and design of such schemes is an active area of research.


I have omitted some (lots of) important details and it’s clear that the “payment file” analogy is highly imperfect.   But I think encouraging people to consider “how would I do it” can help impact a considerable degree of understanding.  And the key insight is: “Cryptocurrency systems work because they are the first computing platforms deliberately designed to go slow!”



Bitcoin and Bankers: Reflections on a panel discussion

Look beyond currency to see the true potential for cryptocurrencies… but don’t forget to apply the lessons to today’s problems too…

I participated in the Bitcoin panel at Finextra’s Future Money conference at Canary Wharf’s Level 39 in London this week. Zilvinas Bareisis of Celent has a succinct write-up of the event here. It was live-scribed by the amazing Mela Atanassova:


The Finextra team assembled the “who’s who” of the London FinTech scene and it pays to be prepared when speaking in front of that sort of audience… so I gave some thought to my talking points beforehand.

When I reflected on the event afterwards, it struck me that our moderator, Liz Lumley, had expertly led us through most of the key “what Bankers need to know” questions: In what way is Bitcoin different to what went before? Why do cryptocurrencies cause such intense discussion? Why do sensible people get so excited by this stuff? Where might it be going?

So in this blogpost I’ve combined my talking points with observations made by my co-panellists: Stan Stalnaker, Ali Farid Khwaja and Nadav Rosenberg.

How do you bring a diverse audience “up to speed” on Bitcoin?

Elizabeth Lumley kicked off the panel by asking who in the audience had a Bitcoin wallet. Over half of the hands went up. Oh dear… this was not your typical audience. What could we tell these people that they didn’t already know?

Luckily, we had been preceded by a keynote by Allessandro Hatami of Lloyds Banking Group. He’s a very smart guy and he gave a thought-provoking presentation. But I noticed something interesting: although he only mentioned Bitcoin in passing, he referred to it in the same context as Amazon Coins. Now, I’m sure he understands the differences but it highlighted that it’s very easy to lead audiences into “category errors” if we’re not careful.

Luckily, we had planned for this in advance. So I spent a few minutes outlining what I think is the “irreducible core” – or fundamental difference – of cryptocurrencies relative to everything that went before, using my “how I explain Bitcoin to new audiences” piece as the structure.

In short:

  • Bitcoin is audacious: until cryptocurrencies came along, humanity had no ability to transmit value at a distance without the permission and support of a third party. Bitcoin taught us how to do it.
  • Blockchain technology could be as important as the web: if we think of the web as the world’s first “internet-scale open platform for information exchange”, we can think of the blockchain as the world’s first “internet-scale open platform for value-exchange”. And the openness is the key.
  • The implications go beyond payments: think “economy of things” and “smart contracts”

In other words, if you’re thinking Bitcoin means “funny internet money”, you’re missing the point.

OK – it could be a cool piece of computer science. But why are so many serious people talking about it so seriously?

Some very smart, very sensible people have concluded that the “web analogy” is plausible and are investing and working on that basis. Other people have been transfixed by the elegance of the underlying consensus algorithm. So it’s not surprising that Bitcoin has unleashed a storm of commentary.

But I think there’s also another reason. I think that Bitcoin has made large numbers of intelligent, thoughtful people realize that they didn’t understand the things they thought they understood. And they are rather enjoying the intellectual rabbit-hole of discovery it has sent them down as they try to “re-learn” things they thought they already knew… This is certainly the case for me. It makes us think deeply about questions like:

The eye-opener for me was what happened when I published my piece on how payment systems work. I wrote it for Bitcoin users who didn’t know much about the banking system. What surprised me was who read it. It was being linked to from banks’ own internal training sites. The answers to these questions are not obvious and Bitcoin has inspired many of us to really think about them.

And I believe this is a big reason why so many people are talking about cryptocurrencies: they force us to clarify our own thoughts about things we thought we already knew.

OK – so cryptocurrencies are important and have potential. But give me just one good example of how it’s going to replace what we already have

I was challenged by a banker in the audience who had clearly heard the cryptocurrency story several times before and was growing tired of all the hype. Sure – it’s clever. Sure – it lets us do things we couldn’t do before. But so what? What real-world problem does it actually solve?

I answered this in three parts.

First, I pointed out how there is a short-term opportunity to take huge cost out of International Remittances. Not glamorous but a clear area where the technology could make a difference to the world.

Second, I argued Bitcoin helps us think about value: what makes today’s financial institutions valuable? Consider Payment Cards. If Bitcoin allows you to pay anybody else near-instantly for near-zero cost, doesn’t this mean Visa and Mastercard will soon be dead? My answer was no. If you believe all they do is payments then Bitcoin is a mortal threat… but that isn’t why they’re valuable. These networks are valuable to us because they promise universal acceptance – they minimize “acceptance anxiety”* no matter where we are in the world. And they have sophisticated rule-books: disputes and chargebacks give consumers and merchants certainty about what will happen when things go wrong. These things are valuable.

Third, I argued that – regardless of whether cryptocurrencies gain widespread adoption – they are already influencing today’s mainstream banking debates. Companies like XBTerminal have shown us how to route Bitcoin push-payment transactions via the terminal, to overcome the problem of mobile devices with no data connection. Peter Keenan, the Chief Executive of Zapp, was at the event and I pointed out how this approach could solve the problem his service will face when customers try to use it in underground shopping malls…

* An aside on “acceptance anxiety”: this is what I call the fear that your payment instrument won’t work when you try to use it. My prediction is that any retail payment solution has to induce less acceptance anxiety than existing methods if consumers are going to adopt it

By way of example, here’s my attempt at using a Bitcoin ATM in Shoreditch… my colleague’s smartphone wallet wasn’t working so I tried my laptop. This is not quite the seamless consumer experience we aspire to :-)  (not yet…)

Richard Bitcoin


How are Banks supposed to formulate strategy when faced with a bewildering landcape of altcoins, sidechains, treechains and who knows what else?

Answer: by keeping laser-focussed on the principles – and ignoring everything else.

This is why I am so maniacal about hammering home phrases like:

  • “Value transfer at a distance with no third party”
  • “Internet-scale open platform for value exchange”
  • “Solving the problem of coming to consensus with people you don’t know, don’t trust and where many of whom are trying to steal your money”

We have to keep focused on these principles because the reality is that the underlying technical details are constantly changing. It may not be obvious to outsiders but it’s important to realize that the cryptocurrency phenomenon is an experiment. Fire up a copy of Bitcoin Core and look at the “about” dialog. Here’s mine:


“This is experimental software”

This point is important: the Bitcoin we see today is not the Bitcoin we will be running in two years’ time. Many of today’s supposed problems (transaction throughput limitations, slow confirmation of transactions, …) will have been addressed through sidechains, treechains or solutions that haven’t even been invented yet.

So the only way to formulate strategy today is to keep focused on the principles and to ignore those details that are purely transient.

Ask yourself: what happens if our customers can send money instantly and for free? What happens if push-payments become universal? What happens if we can settle securities transactions, with finality, without needing clearing houses, custodians and CSDs? …


But banks should also bear in mind that widespread adoption could take longer than we expect:

Ask a technologist when the web went “mainstream” and they’ll probably say 1994 or 1995. But this answer is wrong by a decade! Facebook wasn’t even founded until 2004. Twitter? 2006. But even this misses the point. The transformational impact of the web (the internet-scale open platform for information exchange, remember…) was that it enabled the mobile and cloud revolutions. Yet Amazon Web Services didn’t launch until 2006 and the first iPhone wasn’t released until 2007.

And on top of this, the reality is that most mainstream users of cryptocurrency technology won’t even know they’re using it.

The only way to stay sane is to focus on the principles.

What about trust?

After the panel, I was approached by a member of the audience who was astonished that we hadn’t touched on the topic of trust. Fair point. Finextra’s Matt White was nearby and grabbed me for a two-minute follow-up:


My thanks to Elizabeth Lumley, Nick Hastings and the Finextra team for organizing such an excellent event.


[Updated 2014-05-05 with clearer Live-Scribe image]

Ripple is hard to understand, but it’s worth making the effort: there’s a deep insight at its core

Ten dollars in your pocket is not the same as ten dollars in the bank and neither are the same as a ten dollar credit on your electric bill or the ten dollars your friend owes you. Ripple is simply a manifestation of this insight.

I spent a couple of hours at the Startupbootcamp Fintechathon last weekend. I was there to share ideas on what types of finance problem are a good fit for block chain solutions – and which ones might be best solved using other techniques.

When I arrived, the audience were deep in videoconference with Ryan Terribilini of Ripple Labs. I thought he did a great job of answering their questions about Ripple and I decided it was time I finally tried to get my head around it.

The conclusion I have come to is that Ripple is built on a really deep insight:

Not all dollar, euro and sterling liabilities are the same.

And Ripple is nothing more than a platform that makes this insight explicit.

Here’s how I finally wrapped my head around Ripple

I wrote a piece last year about how money moves around the banking system. I wrote:

Perhaps the most important thing we need to realise about bank deposits is that they are liabilities. When you pay money into a bank, you don’t really have a deposit… you have lent that money to the bank. They owe it to you.  It becomes one of their liabilities. That’s why we say our accounts are in credit: we have extended credit to the bank.  Similarly, if you are overdrawn and owe money to the bank, that becomes your liability and their asset.

I then explained how the payment system is really little more than a bunch of systems for transferring these obligations around.  Where Ripple encourages us to think more deeply is about whose obligations they are.

Imagine I owe my friend Bob £50 and that we are both customers of Barclays bank. When it’s time for me to pay him back, I instruct a “transfer” online. I tell the bank to reduce what they owe me by £50 and increase what they owe to Bob by £50. The bank remains flat… the only difference is to whom they owe the money.

This is the same story I told in my piece about the payments system.


Richard and Bob both trust Barclays as an issuer of pounds. So Richard can pay Bob by transferring the money inside Barclays

But think about just happened:

  • Before the transfer, I owed £50 to Bob.
  • After the transfer, the bank owes £50 to Bob.

Bob still doesn’t have the £50 in his hand… all that’s happened is that somebody else now owes him the money.   But this is just fine for Bob…. He trusted me to owe him the money and he also trusts his bank to owe it to him.


Bob previously had a £50 “asset” issued by Richard. Now he has a £50 asset issued by Barclays. Richard’s debt to Bob is settled and Bob is happy.

OK – so that’s obvious, perhaps.

But notice how it only worked because Bob trusted both me and the bank.

And also notice that he doesn’t trust us in the same way.   He’d probably be quite happy to have thousands of pounds in his bank account. I suspect he’d be very uncomfortable lending me more than £50.

Not all dollar, euro or sterling asset deposits are the same!  It matters who issues them.

It is highly likely that Bob prefers to be owed money by his bank than by me. £50 owed by me is not the same as £50 owed by the bank.

And this is the Ripple insight.

This is a really powerful observation

Imagine now that the situation is a little more complicated.  Bob and I are sitting in a café. I don’t have any cash and Bob can’t remember his account details. How am I going to pay him?  A Barclays transfer isn’t going to work.

Out of the corner of my eye, I see that the café sells prepaid debit cards. Excellent! I use my own debit card to buy a £50 prepaid debit card and hand it to Bob.   My debt is settled, right?

Not so fast….

What makes me think Bob would be happy to accept a prepaid debit card from an issuer he’s never heard of? Are they insured? What happens if they go bust before he can spend the cash?

£50 on a prepaid debit card is not the same as £50 in cash or a £50 IOU from a friend or £50 owed by Barclays bank.   And it is Bob’s choice whether to trust that card.

It turns out that Bob doesn’t trust this card… So we have a problem. I don’t have his bank account details and he won’t accept a prepaid debit card. How am I going to pay him?

Conveniently for my story, it just so happens that my friend Carol is sitting at the table next to us. Bob doesn’t know Carol so I introduce them to each other.

It turns out that Carol is trying to buy some goods online and has forgotten to bring her credit card. The goods cost £50 and she just happens to have £50 in cash in her purse. (It really is a most amazing coincidence…)

So the situation is something like the diagram below. We see that I have nothing that Bob will accept as payment but that Carol might be able to help us bridge the gap. (I’ve added some detail to show that each person might trust each issuer to different extents – it’s not a yes or no question)


How can Richard pay Bob when there are no issuers of pound sterling that Bob trusts that Richard is able to use?

Here’s what we could do: I could give Carol the prepaid debit card (she needs something she can use online and the £50 balance is well below the £1000 limit that she is willing to trust the card company for) and she can then give the £50 in cash to Bob. Bob is happy to take the cash: he also trusts the Bank of England, the issuer of the notes.

Great: Bob now has £50 issued by somebody he trusts. I’ve managed to pay Bob what I owe him by enlisting the help of a prepaid debit card provider and Carol… even though Bob didn’t trust the prepaid debit card and he doesn’t even know Carol.


Richard can pay Bob by “rippling” his transaction through multiple issuers and intermediaries, finding a route of trust that wouldn’t have been possible otherwise.

Yes, yes, I know…. It’s an utterly contrived example.  But it makes the point: not all pounds, dollars and euros are the same. It all depends on the issuer: when we open a bank account in the UK, we’re saying we trust that bank to issue GBP liabilities to us.     When we lend £50 to a friend, we’re saying we trust that friend to issue GBP IOUs. And we all trust different groups of issuers and to different extents.

So how does this relate to Ripple?

The answer is that Ripple is a general purpose ledger and payment network based on the key insight that when you try to pay somebody, it’s only going to work if they end up with an asset that was issued by an issuer they trust.

In our case, Bob trusted me, he trusted Barclays and he trusted the Bank of England. But he didn’t trust the prepaid debit provider and he doesn’t trust Carol – so a £50 balance issued by the prepaid debit card provider was never going to satisfy Bob.

But, because Carol and I both trusted the prepaid debit provider and both Carol and Bob trusted the Bank of England – and Carol actually had some notes issued by the Bank of England in her purse – I was able to settle my debt to Bob by routing it through the prepaid debit card provider and through Carol.

The lesson of all this is that if you’re going to build a system that represents real-world currency balances and make payments between them, you really need to think about who issues those balances.

And once you get this point, the point of Ripple becomes clear:  it’s a way for one person to hold funds issued by issuers he or she trusts – and to pay anybody else by transforming those funds into balances issued by issuers that the recipient trusts.

Sure – there’s more to it than that…. But once you get the idea that any individual participant will only trust balances issued by certain issuers, the whole point and design of the network becomes clear.

But this isn’t really about Richard, Bob and Carol: think about the banks themselves and major corporations

The example in this post feels contrived, because it is.  But imagine you’re a major bank.  You have precisely this problem: you have correspondent banking arrangements around the world.  You have separately capitalised and regulated subsidiaries around the world.  And you need to make payments to people and firms all over the world on behalf of yourself and on behalf of your customers.

You need to keep track of balances issued by hundreds of legal entities around the world and need to instruct transfers and exchanges thousands of times per day.

Today, you do this through correspondent banking arrangements, the SWIFT network and multiple other intermediaries and communication platforms.

If I understand the vision correctly, Ripple sees itself as a universal, distributed ledger for simplifying and rationalising this complicated landscape.

Will it work? Will the banks and major firms adopt it? Who knows. But the underlying insight is deep and it feels like they’ve figured out something that is important.

Postscript: What about Bitcoin?

It amuses me when I see Bitcoin and Ripple discussed in the same context because, for me, they’re completely different.   The core of Bitcoin is all about building a trust-free decentralized transaction ledger for tracking the ownership and transfer of scarce tokens – Bitcoins. And the whole point of Bitcoins is that they are counterparty-risk-free assets: my Bitcoin is not somebody else’s liability.

By contrast, Ripple is all about dealing with assets that are somebody else’s liability. So the focus in Ripple is on representing liabilities issued by identifiable issuers and enabling them to be transferred between individuals on a network.

They share some similarities but they’re not the same thing at all.

Welcome to Bitcoin Island

Forget currencies and commodities… perhaps the right analogy for Bitcoin is LAND!

Oleg Andreev posted an insightful tweet the other day:

You could argue this is a trivial observation: how else could it work?!  But thinking in terms of ownership and protocols for transfer of ownership is a surprisingly helpful way to think about how the system works.  And that’s because the “protocol of ownership” insight means there is a whole other world of history, tradition and precedent to learn from: land!

Here are some observations to motivate the thought:

  • In the end-state the quantity of Bitcoin will be fixed, just like land.
  • Bitcoin is not perfectly fungible and neither is land
  • Bitcoin is not “consumed” through use – just transformed and transferred. This is similar to land and dissimilar to many commodities, which are consumed (or at least degraded) through use.

OK – not a perfect parallel but let’s go with it for now…. What happens if we think about Bitcoin through the lens of land?

Well, first, it allows us to think about coins that haven’t been mined yet… we can think of them as parcels of land on “Bitcoin Island” that haven’t been released yet:


The “Land Interpretation” of Bitcoin. Think “Bitcoin Island”

Second, it helps us put some intuition behind the concept of the “unspent transaction output”.  These are Bitcoins that have been sent somewhere but not yet themselves been spent.  So the set of all unspent transaction outputs (UTXOs) can be thought of as the latest state of every Bitcoin that has ever been mined.

The UTXO is absolutely crucial to everything in Bitcoin and yet very few people think in these terms, talking instead about misleading terms like “address balances” and so forth.

But the interesting thing is: if we take a “land interpretation” of Bitcoin, then UTXOs have a really simple explanation: they are plots of land! And Bitcoin transactions are simply actions that merge or split these plots of land.

Imagine I own twenty Bitcoins. My Bitcoin wallet software will show a “balance” of twenty. But it’s likely that this balance actually consists of multiple unspent-transaction outputs. Even if I had bought all twenty Bitcoins in one go, it’s likely that the seller merged several smaller UTXOs that added up in total to twenty Bitcoins.    So perhaps I received three plots of “land”: 7 Bitcoins in one, 7 in another and 6 in the third.  My total “holdings” are 20 – but it is formed from three “UTXOs”.

Perhaps my holdings on Bitcoin Island look like this:


We can think of Unspent Transaction Outputs as plots of land on “Bitcoin Island”. Plots A, B, C represent three unspent transaction outputs controlling 20 Bitcoins

And now it’s possible to teach people about Bitcoin transactions without completely confusing them!

Imagine I wanted to buy a second-hand car for 11 of my Bitcoins.  Let’s also imagine that I pay a transaction fee of 1 BTC to keep things simple (a HUGE over-estimate, of course)

I need to do a few things:

  • Step One: I need to prove ownership of the coins I’m trying to spend
  • Step Two: I need to say how the coins are going to be allocated – how many am I sending and to where? 11 to the seller, 8 back to me and 1 for the miner in this case.
  • Step Three: I need to specify what the new “owners” will need to do to prove they do indeed own the coins. In other words, I need to specify what they will need to do in their Step one when they try to spend their coins in the future.

I do this in Bitcoin by issuing a transaction that accomplishes all three steps in one.  Here’s what it might say:

“I own three unspent transaction outputs: A, B and C. In total they represent twenty Bitcoins. Here is my proof I am entitled to spend A.  Here is my proof I am entitled to spend B.  Here is my proof I am entitled to spend C. I hereby reshape my plot into two new plots: one plot 8 units in size, which I call X and a second plot 11 units in size, which I call Y. Whoever mines this transaction can claim the remaining 1 BTC. If you can satisfy the following conditions then you will be considered to own X: … . If you can satisfy the following conditions then you will be considered to own Y: …”

I will set the conditions so that only the seller of the car could satisfy the Y condition and so that only I could satisfy the X condition (that’s my change and I don’t want anybody else spending it!)

The end result is that I have simply rearranged the land holdings:


Transaction outputs A, B, C are now spent, replaced by two new unspent transaction outputs: X and Y.  X is my change, Y now belongs to the car dealer and F goes to the miner.  


But we can go further… we can now have an informed discussion about what “ownership” means in Bitcoin.  When I “send” Bitcoins to somebody, I’m not assigning ownership to an individual.  What I’m actually doing is laying down a condition – and anybody who can satisfy that condition will be considered the owner.

Now, normally, the condition is very simple.  It says something like:

“To spend this output you must prove you know the public key that hashes to the following address: …   And you must prove you own the corresponding private key by issuing a digital signature”.  

That’s what the “OP_DUP OP_HASH160 …” stuff you sometimes see is usually saying.

But the conditions can be far more complex than that…. It’s all down to how you write your transaction.

Where is this going?

OK – so thinking of Bitcoin in terms of land helps us build some intuition around UTXOs, which we can think of as “parcels of land on Bitcoin Island” and we see that Bitcoin transactions are really just a way to merge or split these parcels of land and impose conditions that allow people to assert ownership.

And now things get really interesting.  Because there are all sorts of interesting phenomena that happen with land transactions that we can use to think about Bitcoin problems.


The land analogy works because Bitcoins are not perfectly fungible. Sure – there are projects trying to overcome this but this feels like an arms race between developers and law-enforcement agencies. To the extent that fungibility remains imperfect, what drivers could force different “land parcels” to have different values?

For me, the biggest topic on the horizon for fungibility is “coin tainting”, “whitelisting” and the other schemes intended to “tag” Bitcoin addresses or UTXOs.

I see these schemes as directly analogous to concepts like land “blight” on the one hand and maybe “planning gain” on the other.  For example, if you own a “plot of Bitcoin land” that has been “whitelisted” by an exchange or finance firm such that you can access their services, presumably your “plot” would be worth more than one that didn’t have that property?

It is perhaps no surprise that the fungibility issue is so hot right now.

Mineral Rights and Colored Coins

Two pieces of seemingly identical land can be worth vastly different sums: if one is sitting on oil and the owner has mineral rights, a purchaser will be willing to pay them more for their land than if it didn’t! Perhaps this is a useful analogy for colored coins: two identical Bitcoins can trade for different prices if one of them has been “colored” by a trusted issuer. What are the taxation implications? What happens when projects trying to add coin coloration to Bitcoin conflict with projects trying to create fungibility?

Alt coins

Perhaps Altcoins are just different islands! If there is a Bitcoin Island, then presumably Litecoin has Litecoin Island and Dogecoin has Dogecoin Island?

This interpretation now helps us think more clearly about the role and value of altcoins.   Perhaps the innate characteristic of a currency (faster confirmation? Use of scrypt?) makes the island a more attractive place to live. But if all the infrastructure and population is on Bitcoin Island then these features may not be enough.  Who knows.

Charges and Liens

It is possible to impose conditions on land parcels in many jurisdictions. A mortgage company can prevent sale of land unless the debt is settled and some landowners in the UK have been dismayed to discover that their land ownership came with an expensive obligation to pay for the upkeep of a local church.

In some cases, the obligation is short-lived (e.g. the mortgage charge) but in others, it persists across transactions (e.g. chancel repair liability).    A question I don’t know the answer to is: can you write a Bitcoin transaction that imposes conditions on a UTXO that propagate?  That is: can you write a transaction such that whoever spends the UTXO must impose the same condition on their transaction output?


Of course, the land analogy is imperfect but I do think there is something to it.  If nothing else, the mental image of “Bitcoin Island” with UTXOs being the plots of land feels like a really useful one… it has certainly helped my understanding…