<p>MultiBit connects to (typically) four bitcoinds at random at start up. It then picks the best peer (using ping times, advertised blockchain height and the version of the peer to decide) and uses that as the download peer to get the block headers from.</p>

<p>It is thus using one peer to catch up the blockchain from where it previously knew about.</p>

<p>It listens to all four connections to hear about all the new broadcast transactions and uses this to work out a 'transaction confidence'. If four peers tell it a transaction exists, it has more confidence that the transaction is real.</p>

<p>When it sends a transaction, it sends it via the single download peer and then listens on the other peers to hear that transaction 'echo' back from the network. Once it has heard the transaction it just sent come back via other peer(s) it can be confident that the transaction is 'out in the Bitcoin network'.</p>

CC BY-SA 3.0
2013-11-13T15:16:21.307Z
2013-11-13T15:16:21.307Z
jim618
<p>Electrum is not peer-to-peer (P2P). It only connects to electrum-specific servers to broadcast your transactions and to receive transactions. It's very similar to a web-wallet, however you're the one who holds the keys. So the Electrum client signs the transaction with your private key (that you hold), and then sends it to electrum-specific servers that take care of broadcasting it out to other peers.</p>

<p>MultiBit on the other hand does connect to other peers without any proxy server, so it is P2P.</p>

<p>Both Electrum and MultiBit clients download the blockchain headers (not the entire content) so they're considered Simplified Payment Verification (SPV) clients.</p>

CC BY-SA 3.0
2013-11-13T13:46:10.093Z
wait a sec, are you saying then that MultiBit client **is** P2P, therefore it's less secure?
knocte
CC BY-SA 3.0
2013-11-13T13:47:56.437Z
Being P2P doesn't make it less secure. It simply means you connect to several computers instead of one.
Luca Matteis
CC BY-SA 3.0
2013-11-13T14:14:22.563Z
if it connects to several computers instead of one, then it is MORE SECURE, because finding N malicious nodes is harder than finding 1 malicious node (therefore Multibit is more secure than Electrum)
knocte
CC BY-SA 3.0
2013-11-13T14:20:45.563Z
What? `"finding N malicious nodes is harder than finding 1 malicious node"`. That doesn't really make sense. You have the keys so they cannot do anything with your money. So they're both equally secure. But again, i'd rather stay with P2P clients because, if say Electrum servers go down, you can't really send transactions. But security wise, again, both secure equally. You hold the keys.
Luca Matteis
CC BY-SA 3.0
2013-11-13T15:04:18.723Z
@knocte to complete what you've said: Electrum client connects to multiple Electrum servers in order to retrieve block headers and find the longest chain. This way it can avoid malicious servers.
rdymac
CC BY-SA 3.0
2013-11-13T15:04:54.130Z
@rdymac: is that a recent change?
knocte
CC BY-SA 3.0
2013-11-13T15:05:41.393Z
@LucaMatteis by insecure I've never meant that the servers could take my money, but that they could give a false blockchain information, therefore I'm downvoting your answer
knocte
CC BY-SA 3.0
2013-11-13T15:05:51.807Z
@knocte it was introduced in 1.9 and some other security improvements https://github.com/spesmilo/electrum/blob/master/RELEASE-NOTES
rdymac
CC BY-SA 3.0
2013-11-13T15:07:49.660Z
@rdymac, ok thanks, I've updated my question
knocte
CC BY-SA 3.0
2013-11-13T15:09:49.113Z
@knocte they can't. you have the headers (SPV) and you can check their validity by checking their hashes against the target. so they can't give you a "false" blockchain.
Luca Matteis
CC BY-SA 3.0
2013-11-13T16:50:22.787Z
against what target? the mathematical proof to check that the blockchain given is correct is just to make sure it's not a random blockchain, but one could still fake one which is correct
knocte
CC BY-SA 3.0
2013-11-13T16:53:44.693Z
@knocte you obviously don't know how Bitcoin works, and you've downvoted me nonetheless. Please inform yourself before assuming something is wrong. I don't feel compelled to explain more in details, so I'll just say that: to generate a valid blockchain yourself you'd need more hashing power than the entire network. So no, nor you nor Electrum can fake it!
Luca Matteis
CC BY-SA 3.0
2013-11-13T16:58:39.380Z
I didn't downvoted your comments, but your answer, which still assumes I was referring to "taking my money". You can still remove your answer. And take in account I am not saying that me or Electrum can fake a blockchain, but an **electrum server** (just one), could, and specifically, to an electrum client v1.8 or older (because since 1.9 the client connects to more than one server).
knocte
CC BY-SA 3.0
2013-11-13T13:31:23.750Z
2013-11-13T14:08:09.287Z
2013-11-13T14:08:09.287Z
Luca Matteis
<p>As far as I know, when I use Electrum I'm just choosing servers to trust that hold the blockchain.</p>

<p>But in this <a href="http://www.nytimes.com/2013/11/17/magazine/switzerlands-proposal-to-pay-people-for-being-alive.html?pagewanted=2&amp;_r=0&amp;smid=tw-share" rel="nofollow"><em>recently published article</em></a> I read this about Multibit:</p>

<blockquote>
  <p>It uses a slightly weaker trust model than Bitcoin-Qt. In SPV mode, with clients like Multibit and Hive, it still scans the blockchain, and what it assumes is whatever blockchain has the majority of miners on it [is correct]. Instead of verifying the entire contents, it just trusts that the majority of miners are honest. It's still peer to peer. </p>
</blockquote>

<p>Does this mean that Multibit's SPV implementation is more "P2P" than Electrum? Does it connect to peers (other thin-client users) instead of servers?</p>

<multibit><electrum><thin-clients><spv>
Is Electrum's SPV (thin-client) implementation not P2P (as opposed to Multibit's)?
knocte
# Is Electrum's SPV (thin-client) implementation not P2P (as opposed to Multibit's)?

(Asked by: username_0 on 2013-11-13)

As far as I know, when I use Electrum I'm just choosing servers to trust that hold the blockchain.

But in this [*recently published article*](http://www.nytimes.com/2013/11/17/magazine/switzerlands-proposal-to-pay-people-for-being-alive.html?pagewanted=2&_r=0&smid=tw-share) I read this about Multibit:

> It uses a slightly weaker trust model than Bitcoin-Qt. In SPV mode, with clients like Multibit and Hive, it still scans the blockchain, and what it assumes is whatever blockchain has the majority of miners on it [is correct]. Instead of verifying the entire contents, it just trusts that the majority of miners are honest. It's still peer to peer.

Does this mean that Multibit's SPV implementation is more "P2P" than Electrum? Does it connect to peers (other thin-client users) instead of servers?

**Tags:** multibit, electrum, thin-clients, spv


---

## 2 answers

### Answer by username_1 on 2013-11-13. Score: 5

MultiBit connects to (typically) four bitcoinds at random at start up. It then picks the best peer (using ping times, advertised blockchain height and the version of the peer to decide) and uses that as the download peer to get the block headers from.

It is thus using one peer to catch up the blockchain from where it previously knew about.

It listens to all four connections to hear about all the new broadcast transactions and uses this to work out a 'transaction confidence'. If four peers tell it a transaction exists, it has more confidence that the transaction is real.

When it sends a transaction, it sends it via the single download peer and then listens on the other peers to hear that transaction 'echo' back from the network. Once it has heard the transaction it just sent come back via other peer(s) it can be confident that the transaction is 'out in the Bitcoin network'.


---

### Answer by username_2 on 2013-11-13. Score: 4

Electrum is not peer-to-peer (P2P). It only connects to electrum-specific servers to broadcast your transactions and to receive transactions. It's very similar to a web-wallet, however you're the one who holds the keys. So the Electrum client signs the transaction with your private key (that you hold), and then sends it to electrum-specific servers that take care of broadcasting it out to other peers.

MultiBit on the other hand does connect to other peers without any proxy server, so it is P2P.

Both Electrum and MultiBit clients download the blockchain headers (not the entire content) so they're considered Simplified Payment Verification (SPV) clients.

> **Comments:**
> **username_0**: wait a sec, are you saying then that MultiBit client **is** P2P, therefore it's less secure?  
> **username_2**: Being P2P doesn't make it less secure. It simply means you connect to several computers instead of one.  
> **username_0**: if it connects to several computers instead of one, then it is MORE SECURE, because finding N malicious nodes is harder than finding 1 malicious node (therefore Multibit is more secure than Electrum)  
> **username_2**: What? `"finding N malicious nodes is harder than finding 1 malicious node"`. That doesn't really make sense. You have the keys so they cannot do anything with your money. So they're both equally secure. But again, i'd rather stay with P2P clients because, if say Electrum servers go down, you can't really send transactions. But security wise, again, both secure equally. You hold the keys.  
> **username_3**: @username_0 to complete what you've said: Electrum client connects to multiple Electrum servers in order to retrieve block headers and find the longest chain. This way it can avoid malicious servers.  
> **username_0**: @username_3: is that a recent change?  
> **username_0**: @username_2 by insecure I've never meant that the servers could take my money, but that they could give a false blockchain information, therefore I'm downvoting your answer  
> **username_3**: @username_0 it was introduced in 1.9 and some other security improvements https://github.com/spesmilo/electrum/blob/master/RELEASE-NOTES  
> **username_0**: @username_3, ok thanks, I've updated my question  
> **username_2**: @username_0 they can't. you have the headers (SPV) and you can check their validity by checking their hashes against the target. so they can't give you a "false" blockchain.  
> **username_0**: against what target? the mathematical proof to check that the blockchain given is correct is just to make sure it's not a random blockchain, but one could still fake one which is correct  
> **username_2**: @username_0 you obviously don't know how Bitcoin works, and you've downvoted me nonetheless. Please inform yourself before assuming something is wrong. I don't feel compelled to explain more in details, so I'll just say that: to generate a valid blockchain yourself you'd need more hashing power than the entire network. So no, nor you nor Electrum can fake it!  
> **username_0**: I didn't downvoted your comments, but your answer, which still assumes I was referring to "taking my money". You can still remove your answer. And take in account I am not saying that me or Electrum can fake a blockchain, but an **electrum server** (just one), could, and specifically, to an electrum client v1.8 or older (because since 1.9 the client connects to more than one server).  

---

