[wsxcde]

Cheers, those are some good points and I am indeed conflating fraud and theft.

So the key point you're making about the Amazon/Target scenario is that a criminal who breaks into one of these systems has the ability to launch transactions on my behalf, which s/he wouldn't be able to do with Bitcoin. Which is fair but not universally true. Some international vendors and cards require you to go through the equivalent of the verified by visa system for all transactions. The way this works is that you give the vendor-site your credit card info, they pass this on to visa/mastercard and redirect you to visa's page where you can (1) see who you are paying and how much and (2) need to type in a password that only you and visa know in order to authorize this transaction. I suspect usability is the only reason this system isn't universally prevalent.

I think the Bitcoin scenario is worth thinking about a little more. Fred Schneider, the Cornell professor, likes to say that you can't reduce the amount of trust a system needs to work, you can only move trust around. What Bitcoin seems to have done here is now instead of trusting Amazon/Target etc. we now trust the applications which announce our transactions to the Bitcoin network. If this application is another website, like Coinbase, I don't think we've made any progress. If it's a local program that runs on your computer, it's not clear to me that is necessarily more secure. But if this is the hypothesis being made - that locally run bitcoin wallets have a reduced attack surface in comparison to the websites that store your credit card information - then I would say this is a hypothesis that is worth investigating. But we do need to acknowledge that we don't have enough data to determine whether this is actually true at this point in time.

[drcode]

I am in full agreement with what you've written. Distinguishing between fraud and theft was a bit pedantic on my part.