I am providing a service that accepts Bitcoin. In order to speed things up a bit, I am planning to reduce the number of confirmations I require before I consider the money to have arrived.
I have read that it is quite safe to work with even a single confirmation if you take some precautions measures. What are those?
More specifically, with which options should I run bitcoind ?
At the moment there's very little orphaning of blocks, and next to no occurrence of two-block side chains. Unless you're dealing with large amounts (larger than two block rewards worth, probably), your chances of attack are incredibly incredibly low. If you're dealing with amounts less than a few BTC, I'd personally be happy accepting one-confirmation transactions.
There's no specific flags for bitcoind that you can use to control confirmations, it's all in your software's side. Generally if you're a merchant, you should avoid having a listening node (set listen=0) just to be on the safe side. Be sure to be using cold storage if your server accumulates a target-worthy amount of currency, by sending off to an address that the server does not know the private key of.
If you're not using walletnotify to control your internal accounting system, you probably should.
There's a significant increase in the risk of being defrauded when the merchant accepts payment 0/unconfirmed and at the same time has bitcoind configured for incoming transactions. In that situation, the attacker can reach a near 100% success in double spending against the merchant simply by making a direct connection to that merchant's node and broadcasting one transaction to it and then to the rest of the network broadcasting a double spend transaction.
But when the merchant waits until there is at least one confirmation the this race attack risk essentially disappears.
To disable listening, the setting is "listen=0".
