But as far as i read these 6 confirmations are giving nearly no more security. I mean waiting one hour for a digital payment is a big timeframe. Ok, its part of the network but if the waiting time is unneded long it isnt an argument for using bitcoins.
Anyway... i found a workaround but i still dont understand that the outcome of security <> time needed comes out to this result. But its your decision. Maybe im only wrong and the security gain is really worth to note.
From what I understand double spending after even a single confirmation would be nearly impossible, but MtGox is willing to do big transactions. Transactions involving five digit numbers of bitcoins and six or more digit numbers of dollars. When transactions get that big, sometimes you have to take the safest route. Waiting for six confirmations may make things absurdly safe on their end, but they have to do it because any security failings can hit their reputation hard.
However 6 confirms isn't magically safe. It isn't like 5 confirms = massive risk and then 6 confirms = impossible.
Lets assume the attacker has hashpower that equals 20% of the network.
To reverse an unconfirmed transaction will be 100% successful if using a finney attack or 20% of the time by brute force. Obviously too much of a risk for high value transactions.
To reverse 1 confirmation will be successful (0.2^2 ) 4% of the time. An attacker could reverse roughly 1 in 25 deposits. That likely is insufficient.
To reverse 2 confirmations will happen (0.2^3 ) 0.8% of the time. An attacker could reverse roughly 1 in 125 deposits. Pretty small attack vector but still plausible.
To reverse 3 confirmations will happen (0.2^4 ) 0.16% of the time. An attacker could reverse roughly 1 in 625 deposits. The attack is non-viable and very obvious*
To reverse 4 confirmations will happen (0.2^5 ) 0.032% of the time. An attacker could reverse roughly 1 in 3125 deposits. The attack is completely non-viable.
* With a 0.16% success rate the attacker would only reverse on average one in 625 deposits. Given there are only 144 blocks per day the attacker would need to deposit a MASSIVE amount of funds every hour (24+ times per day) for an average of 4-5 days before being successful. The signature would be very obvious. The attacker will on average lose 625 blocks to orphans for every successful attack. The lost blocks would be worth roughly $203,000. So to yield a 30% bonus on that would require a $300,000 double spend. Think it might be obvious someone with a level 3 verified account depositing and withdrawing $300K in BTC every hour for days and days?
MtGox 6 confirm policy is simply an anachronism. Why 6? Why not 60 to be super duper sure. Satoshi never intended the #6 to have divine like powers.
