PR for Face to Face trade

ManfredKarrer · July 20, 2018, 11:47pm

Just added a PR for Face to Face trade:

github.com/bisq-network/bisq

Implements Face to Face payment method

bisq-network:master ← ManfredKarrer:f2f

opened 11:25PM - 20 Jul 18 UTC

ManfredKarrer

+469 -90

Implements Face to Face payment method This is a very basic version without a…ny of the advanced features discussed at https://github.com/bisq-network/proposals/issues/24 It assumes that both traders carry their laptop to the meeting. We could start with that and see how much interest it creates. If positive we can add support for the mobile support as discussed here: https://github.com/bisq-network/proposals/issues/24#issuecomment-406693836 Screenshots: https://github.com/bisq-network/proposals/issues/24#issuecomment-406749665 Depends on: https://github.com/bisq-network/bisq-common/pull/30 https://github.com/bisq-network/bisq-core/pull/138

Screenshots are here:

github.com/bisq-network/proposals

Enable face to face (F2F) trade in Bisq

opened 09:11PM - 02 Jun 18 UTC

closed 08:25PM - 05 Oct 18 UTC

ManfredKarrer

was:approved

Enabling face to face (F2F) trades like offered at LocalBitcoins is an often req…uested feature but has not been considered to be added because Bisq has a different security model compared to LocalBitcoins and with our model we cannot provide sufficient security to make F2F trades safe. E.g. LocalBitcoins uses ID verification and reputation. Bisq uses the security deposit and the arbitrator as security protection which both would not help much in the context of a F2F trade. Though there might be an interesting idea to allow us to support F2F trades. ## Basic idea It is based on the game theoretical idea of "mutual assured destruction" which is basically just the idea that if both traders do not come to a cooperative result both will lose all what they have put in the trade (e.g. trade amount and security deposits). That model was actually used in the very first concept of Bisq and is used in some other projects like BitMarkets and BitHalo/Nightrader. The reason why we went away from that model was because [Adam Gibson](https://twitter.com/waxwing__?lang=en) found a severe risk for a blackmail scenario. In short, there is always an asymmetry of the max. loss of each trader due to the fact of the non-atomic exchange on the fiat side. That enables that one trader could blackmail the other who has more to lose to agree to a different payout result as it was originally agreed on. An economic rational trader getting blackmailed in that way would agree to the changed payout to have less financial loss than if he would stick to the original contract and risks that his funds will be locked up forever. This risk is specially serious in the context of an anonymous global online market. But we do not suggest a pure "mutual assured destruction" model (based on 2of2 Multisig) but rather to use our existing arbitration system to add more flexibility and to reduce the blackmail risk. ## Assumptions ### Physical access changes risk situation People meeting physically have a different risk exposure compared to the anonymous online market situation. E.g. The possibility of physical access makes unscrupulous behavior less likely. We can assume that the risk of a blackmail is much lower in such a context. Of course physical access comes also with new forms of risks (robbery) but that has to be mitigated by the selection of a safe public meeting location. The general risk for violence in a certain country has to be taken in consideration as well. ### Unclear strategy of arbitrators There is no guarantee that the funds will be locked up forever as the arbitrator can do the payout as he thinks it is fair and/or at any time in the future. The threat that the funds are lock up forever is not a strong motivation anymore for the blackmailed person to agree to an altered payout. He rather would try to convince the arbitrator for his side. If those assumptions holds we could use that model as basic protection for F2F trades. ## Details ### Payment method The payment method will contain an email and/or mobile number field which will be used by the traders to exchange the details for arranging the meeting place. Beside that there will be the location data (country, city, maybe map coordinates). In a first version it should be a basic feature but could later be improved by implementing a map to set the position of the trader. Though exact positions of the traders address have to be avoided for security reasons. Maybe we should add "terms and conditions" the users can define. At LocalBitcoins they often require ID verification of the peer. That should be done only in person to avoid risk of identity theft. ### Offerbook Offers for F2F trades will display additionally the location. In a first version that can be added to the payment method info. A filter option to search for traders by country and city would be good as well. In a later version we could implement a map to look up nearby traders. ### Trade process Once an offer gets taken both traders get in touch by email or mobile and arrange a meeting place and time. We could consider that both traders bring their laptop and do the trade process similar like with an online payment. Though the additional risk for theft if they might have more BTC on their wallet as well as the inconvenience and risk to carry the laptop represents some downsides with that simple approach. They could alternatively meet without any laptop and just do the Fiat transfer and when back home do the confirmation in Bisq for the Fiat sent and received events. That would reduce the risk of theft to the Fiat amount but it does not feel very safe to hand over Fiat without getting immediately anything back in exchange. We could require a hand signed contract so both would have at least some form of evidence. Better would be a digital system which is integrated with the Bisq trade process. LocalBitcoins uses Secret codes to be exchanges by the traders but I am not sure if that adds really much protection. Ultimately there is no solution as the Fiat transfer is not an atomic transfer in exchange to a digital transfer of a signature. The best we can achieve is to bring the moments of both events close together. Another approach might be to combine a repeated partial payment with repeated confirmations via a mobile app. E.g. if the trade amount is 1000 USD the BTC buyer could start to hand over 100 USD to the seller. Next step is that the seller confirms on a mobile app the receipt of 100 USD. Then the next 100 USD will be handed over and then confirmed again. That will be repeated until the final amount has been transferred. It would lower the risk that the peer can run away quickly with the money without confirming the receipt. The receipt could be done as simple email to the BTC buyer or via any messenger app. The proof is not strong but at least it adds difficulty for a potential scammer to fake those messages. Best would be a mobile App which is connected to the Bisq trade and provides signed and encrypted messages. But that is too much effort for a first version. It is also questionable if people are really that paranoid and use that repeated payment method or prefer to hand it over in one part and then do the confirmation. That area needs more though how to deal best with it. For the most simple version lets assume there is a paper contract signed by both traders. ### Dispute The arbitrator cannot help much in case of a dispute as in most cases there will be testimony against testimony and he cannot get a reliable proof about the transaction. So the standard resolution of any F2F trade disputes will be that both traders will got frozen their funds forever. Though they have the option at any time in the future to still come to an agreement and then tell the arbitrator to do the payout according to the result both have agreed on. The arbitrator can also choose to make whatever payout he thinks is fair according to the testimonies of both traders. This option makes blackmail even less likely as there is no guarantee that the funds will be kept frozen. Also the blackmailing person will have likely higher risk to lose the case and the arbitrator decides in favor of the other peer. ID verification can be required as well from the arbitrator - a request scammers usually don't want to follow. One problem is for sure that the dispute resolution adds much higher pressure to the arbitrator as he will not have a tamper proof evidence. But as said to not do the payout at all is a valid default option for the arbitrator. Different arbitrators might have different policies how to deal with disputes which again makes blackmail less likely as the arbitrators strategy is hard to predict. It can be expected that real disputes are super rare (as with online trades) but most cases are caused by usability issues or bugs. For those cases the resolution process will work like any other payment methods. ### Police report In case of theft or blackmail attempt the victim can file a police report and present that to the arbitrator. This will have a lot of weight in the dispute process as it can be assumed the the scammer will unlikely go to that step to trick an innocent peer. ### Security deposit It will require more analysis how the security deposit should be set for F2F trades and it will depend on the model how the Fiat transfer will be executed. ### Risks and warnings The risks and different rules for dispute resolution have to be very clearly presented and accepted by both traders. ### Test run We could add that payment method as experimental for a test run to see how it works in reality and see how much demand exists for it. Before that it would be good to make a poll to see how much demand is really there for F2F trade. The still limited volume on Bisq will be an even bigger issue when it adds a location limitation as well. ### Implementation effort Depending on the open questions regarding the fiat exchange process the implementation effort should not be very high. It is mostly UI work and does not require any deeper changes for a fist version. For map integration though the effort will be higher but that should be left for later after a test run has shown how much demand for that payment method exists. ### Request for more research I think we should add more research about the usual issues with F2F trades on LocalBitcoins or other platforms. - What are typical scam scenarios? - Which protection mechanisms are used? - How do traders protect themselves? If anyone can volunteer to do that research or if anyone has first-hand experience please add it below!

Feedback welcome!

alexej996 · July 21, 2018, 1:27pm

It is exciting to see this feature finally coming to Bisq.
Hopefully it will be a huge success and we get some valuable feedback.

Peer · July 21, 2018, 5:12pm

I used to do cash transactions on localbitcoins. The problem was that 3 out of 4 times the counterparty did not show up. So I eventually stopped doing cash.

Doing a quick search for a cash transaction on lbc I found that I have to travel 200 km and another 200 km back home again. Now most of my sepa transactions are with another country. I guess this feature doing cash transactions in bisq is a bit premature. But it is a nice feature none the less.

I admire your hard work and dedication.

peoples · July 21, 2018, 5:23pm

If I understand BISQ correctly:
Both the maker and taker need to put up a security deposit/escrow.

This makes BISQ more resilient than localbitcoins. BISQ discourages wasted time and spam/scams.

I also commend your work and dedication!

MnM · July 21, 2018, 5:49pm

Great news! I think @erizo will like it.
I’m reading everything on the PR and I like a lot how all the possible issues can be managed. I was very skepticall about F2F trades on Bisq. But after Localbitcoins requiring KYC I think that a window has been opened and something better than Localbitcoins is on the way.

ManfredKarrer · July 21, 2018, 10:17pm

I hope the security deposit will help to avoid that. But good point we need to check how the arbitrator can find a solution in such cases. If peer tells a conflicting story the fund might get locked up if arbitrator cannot find clear evidence. The seller is here for sure more at risk as he has more funds locked up.

ManfredKarrer · July 21, 2018, 10:42pm

Just stumbled over an older discussion here:

The idea from @erizo to use a bank transfer as security tool was quite interesting.
We could recommend the users that they do a tiny 1 EUR transfer to each other, so they know the others bank details. That gives them some sort of KYC and reduces the risk of robbery a lot IMO. As it is just a recommendation it is up to the users to do it or not. They could also perform a normal ID check but that comes with ID theft risk, so a bank transfer might be less critical.

@peertrade also gave a lot of input there. Would love to hear his opion about the current proposal.

zhaos · July 23, 2018, 6:19pm

Thank you for this pull request.

I would like to propose this also.
For the traders who do not want to leak personal data, shop keepers may become witness of a trade and receive a tip for that.

For example an exchange is done in a shop with a shop keeper as a witness.

the shop keeper creates a bisq account, and broadcasts his adress and his readiness to act as a witness
two traders meet in his shop to perform a trade
the shop keeper scans the QR code of both participants, so that he receives the trade details and be linked to the trade
the traders perform the trade
the traders and the shop keeper confirm (or not) that the trade occured properly
if everything is ok, the shop keeper receives a witness fee and gets an increase in reputation

The shop keeper would have little incentive to lie because his shop real adress would be public, while the traders may remain anonymous and not give away private information (ID, voice/camera record of the trade, etc.).

ManfredKarrer · July 23, 2018, 6:43pm

Hm interesting approach but wouldn’t turn that the shop keeper as the trusted third party who could act as escrow anyway? E.g. wouldn’t it be more simple to just do a classical escrow with the shop keeper in such cases?

peoples · July 23, 2018, 9:51pm

very interesting idea.

The shop owners can put up a BSQ bond to prove ownership and escrow legitimacy.
It’s true, the shops can do this outside of the platform, but BISQ can provide a listing space for these F2F shops.

I’ll open the first bonded BISQ trade shop!

Homard · July 24, 2018, 5:00am

I like the idea of trying to standardize things, but this shopkeeper idea is imo the (nth) return of the third party. Throw him by the door, he reenters by the window.
Not only would the shopkeeper be a third party, but also a wonderful point of failure.
Half of drug affairs today in the US are affairs where one of the party cooperates with the FBI when he’s not simply a FBI guy.
Even if not cooperating, a fixed place is also an easy place to easily monitor today. Even from outside, even with non specialized hardware.
etc.

peertrade · July 28, 2018, 9:44am

Personally, other party showing up hasn’t been an issue for me. But considering the scenario…

It seems to me that if counterparty doesn’t show up, then either:

both parties should get their escrowed funds returned, or
the party that did show up should receive escrowed funds of the one that didn’t, as compensation for lost time/expense, and to dis-incentivze that behavior.

(1) is simple, and likely sufficient for now, unless/until it becomes a significant issue.

(2) is perhaps more desirable, but it requires some proof for arbitrator.

For (2) I can think of a policy something like:

meet details (address, place name, time) must be recorded and agreed in advance somehow, in a private but non-forgeable way. Ideally bisq would include a tool for this, eg so both parties can digitally sign. Then it is recorded via proofofexistence.com or maybe encrypted in bisq p2p network (accepted offer info).
If party a does not show, party b can take photos to prove s/he was there. Ideally this would be of signage such as: entrance to establishment, address on door, street name sign, etc. Ideally with GPS location in photo metadata. The photos should be entered into a timestamping service such as proofofexistence.com within 1 hour of the meetng.

agrieved party submits original agreement from (1) and photos from (2). arbitrator checks them at proofofexistence.com ( or similar service ) and awards if photos are convincing and timestamped docs are found. (if counterparty cannot do same within X period.)

quite possibly more trouble than it is worth in short term, but could perhaps be usable by mere mortals with enough hand-holding from the app. I imagine even a bisq localtrader mobile app that assists with evidence gathering and submission to timestamping service(s) and arbitrator.

peertrade · July 28, 2018, 10:27am

I just had a look at the screenshots and reading discussion. In general, very happy, thanks! a nice surprise.

A couple thoughts:

I don’t see need for bringing laptop. I think most people doing f2f are accustomed to using phone wallets for actual transfer. And the laptop doesn’t accomplish so much. if a thief is going to rob me, he can simply shove a gun in my face and instruct me to confirm the transaction was completed. Then he takes my laptop too. Instead, why not let the meetup be for funds transfer only, and then the final step is completed when one is back in a safe place.
The escrow brings some warm fuzzies for both parties, but may actually be a risk for bisq project and arbitrators as it puts them in uncomfortable situation if law enforcement gets involved over a dispute. Bisq could instead act simply as a “counterparty discovery” mechanism, and everything that happens after two parties contact eachother is their own responsibility and no one else’s. I fear that the arbitration feature could become a “hook” one day used by kyc/aml advocates to go after the bisq project, particularly if a violent crime ever occurred and funds were somehow released to the wrongdoer.

In general, I suggest f2f participants to use the following strategy.

Use a system such as bisq to find new people to trade with locally.
For first trade(s) with someone, use small amounts only. Bring a phone wallet with only small amounts loaded, or equiv small amount in cash. Meet in public place and Bring a friend or two if you are worried about safety.
Get a feel for the person. Build up trust over a few smaller trades, or walk away.
If the person is reliable and solid, you can continue to do many trades with them over time. Usually can just contact them directly, no need to use bisq, lbc, etc.

So imho the escrow is only really needed for large amounts and untrusted parties, but that’s not a situation one should find oneself in, if using above approach.

peertrade · July 28, 2018, 11:21am

another thought, looking at the market screenshot for takers…

I see that there is “Filter by Payment Method”, and presumably one can select “F2F”. well and good.

But then I guess I would see F2F offers from all over the world.

I think that when F2F filter is chosen, another filter should appear that is Filter by Location. Ideally one could type in a city, country and choose a proximity (eg default 100 miles) to get all offers in that area. Or maybe for now it is just a listbox with values populated with unique country,city from all offers, or even just country is likely sufficient for many places.

LBC offers google map integration and that could be nice at some point, though not really necessary.

A sortable location column also be quite useful.

alexej996 · July 28, 2018, 1:31pm

Yes, I don’t think laptop is necessary, smartphone is useless as well.
You can simply do the cash transfer on site and confirm the payment once you get home.
Just like going to a bank to do a cash deposit.

Escrow isn’t something Bisq offers, but if people want to do something with it outside of Bisq, that shouldn’t be anything stopping them.

ManfredKarrer · July 29, 2018, 7:40pm

We don’t want to introduce a new trade protocol as we don’t have the dev resources as well we don’t know if users will really use that new payment method. So we need to start with existing structures and that is that the payment is done via Bisq and the arbitrator is part of it. If we see that the payment method will really be used we can invest more effort to fine-tune.
So for now the main challenge is to make the best out of that setup and if we can find ways to add more security without adding a lot of dev effort. To recommend a test bank transfer of a 1 EUR amount for both traders is such a suggestion which will not add effort on Bisq dev side but would add quite a bit of security for those who are willing to do that.

MnM · September 4, 2018, 9:35pm

I think that requiring and ID exchange (know your peer identity) at meeting point in “Additional Terms” is not supported by the trading protocol.
If both parts aggree, why is that a bad idea?

Homard · September 5, 2018, 5:23am

1/ At the beginning of this same thread, it was noticed that
"after Localbitcoins requiring KYC I think that a window has been opened "
… and now there is suggestion to walk the same path ?

2/ Honest people do not use false IDs, but dishonest people have no worry with that.
By dishonest I mean also people collaborating with govs, and for them false ID is very easy.

There is certainly room for improvement for this very new F2F feature.
But hopefully we’ll have enough imagination to find new solutions and not returning to using usual gov collars.
I don’t know if it is already in the protocol, but each party bringing it’s onion address may perhaps be useful ?

Or for people wanting, they may have PGP exchanges before and agree on a passphrase or a dressing code etc (shower ideas ;-))

MnM · September 6, 2018, 7:52am

Police/law force is going to be needed if things get ugly. I don’t think that a PGP key or a dressing code is needed. If someone is coming to a trade we’ll have no problem to identify ourselves. Lack of reputation and liability is the problem here. Exchanging PGP keys it’s not something that will make me feel more confident, it doesn’t say anything about my peer’s past behaviour. But knowing your peer’s ID could be a good way to start a police report and make things easier, so it could be also a good way to stop some people from doing bad things.
I understand that a bad guy could use a fake ID. That’s a very good point against requiring ID, but I still thing that it could be allowed as “Additional Terms”.
Faking ID is a crime that police will pursue, and is heavily punished, so it could stop some bad guys for low amounts.

Homard · September 6, 2018, 8:02am

Concerning reputation,
it was already discussed here, and the idea which emerges which conciliates privacy together with reputation,
is to consider negative reputation (only appying to few) versus positive reputation (applies to everybody).

You have already some reputation tools here in Bisq:

make a search with your buyer/seller onion address here in the forum. If he’s a known scammer, you’ll know it
look at the account age, number of trades, you’ll know if your peer is a new account or an old bisq user.

And I profit to remind the doc about F2F and smart advices:
https://docs.bisq.network/trading-rules.html#face-to-face-f2f-trading