Bitcoin Forum

Ok I had to reply to one of the threads (http://"https://bitcointalk.org/index.php?topic=34858.0"),  but this deserves it's own topic,  for good reason.

Everyone is concerned about security...  and they are blaming e-wallets... even though a month ago one of the forum users had 25,000 bitcoins vanish from his client....  there were several posts referencing a "bitcoin gobbler" that was stealing bitcoins from people's desktops as it appears to infect the standard client.

When an individual asked "so how do I access my bitcoins from another location"  the reply was "SSH into your machine... then do X and do Y and do Z"  of course.. because grandma knows how to SSH.

the problem with the online currency is that it was built by us individuals familiar with the process.   Grandma can't invest $300,000 of her 6 million dollar inheritance in bitcoins because she doesn't know what a wallet.dat is,  she doesn't understand how to send money to an address that stretches across the screen, and she's NOT going to SSH into anything.    She's not even going to understand what peer to peer is.   Websites just magically appear to her with no understanding of how it works.

But she could increase the price of bitcoins and make them far more valid of a currency by depositing $300,000 USD into bitcoins.    She might even use them to buy something from an ecommerce site that accepts bitcoins,  or she may also have a meal at Meze Grill in New York,  if she could figure how to pay them in bitcoins.    Asking her to lug her laptop in and send to a huge address isn't going to help matters.

She knows how to login to her banks website,  she's wondering why she can't login to her bitcoin account.

The problem is that there are 2 types of people in this world.

1 -  technically smart,  with limited funds.
2 -  much richer,  but not technically smart.

Our problem is that virtually everyone is in this forum is 1 ....  most of us here are not 2.

But we NEED #2 in order to grow bitcoins as a community.

type 2 people won't install the standard bitcoin client on their desktop... period.   Much less SSH to that client from a remote machine.

So the end result is that ewallets are needed...   in fact ewallets will be the vast majority of bitcoin transfers in the future,  they will as whole most likely will be the defacto way of paying people within the next few years.... IF WE MAKE IT the next few years.

the problem is security,  (on your desktop and in the cloud)  and making it easier to use and understand for grandma...   the only valid solution to that is an ewallet....  

Even if you make the easiest to use client on earth,  you're still going to have to ask grandma to install it from IE: 6 ... because IE : 6 came with her computer....  see my point.

Well said!

Agreed. Can't wait for Flexcoin to come out of Beta, Roger!

If e-wallets are the future, and i think they are if Bitcoin is to succeed, then regulation will be required. But you libertards don't want this - instead, thinking that some web of trust will be enough to sel-regulate. Look
where that got everyone.

Maybe the title should be "Not enough about online wallets...", since the upshot seems to be we need to solve the problem of making sure grandma's bitcoins will be safe even if she uploads them to an online wallet service instead of entrusting them to a bonded executor who will use secured systems to secure her bitcoins for her and pay her tab at the grill regularly for her and suchlike chores.

Would such an executor be any different if such an executor used a website to receive gramma's instructions as to what to do with her bitcoins? Hmm this question seems to come down to how insecure is an online wallet's confirmation of gramma's identity and rightness of mind and secureness of keyboard and mouse channels compared to the confirmations such an executor would use? (Would such an executor even consider trusting some possibly hacked keyboard and mouse, or would they insist on a "verbal turing test with voice stress analysis" channel?)

How do we go about "bonding" an online wallet executor, and for how many aggregate bitcoins and fiat can we bond them per bitcoin or fiat of potential profit we'd have to take out of their operation in order to be able to execute the "bonding" (aka in order to bail out those bonded wallet services' customers that screw up / those bonded wallet services that screw up)?

-MarkM-

No, but mobiles with NFC secure elements will be. Carried just like cash, but even more secure. And yes, in a few years even grandma is going to be using what's today called a "smartphone".

(I won't answer protests from anyone not having at least researched what the [NFC] secure element spec is ;)

There's no reason, even for online wallets, to require my private keys.

Bitomat, how many people scammed?
Mybitcoin, how many people scammed?

You really think grandma knows how to use bitcoins currently?


You, flexcoin, can be honest that's not the point
The fact is people MUST think before use an ewallet: who is he runner, where is he, how can I contact him, etc
When stupid naive people put their money in ewallets and lost it, what is guilty for everybody outside this forum? Bitcoin!
It's like MtGox hack: "BITCOIN HAZ BEEN BROKEN!"

That's why scammed people are attacked: because of them, people see Bitcoin as insecure whereas there's nothing to do with it
So, either grandma asks her grandchildren, or she just doesn't complain if something bad happens...

Not to put you down, personally, Flexcoin, but e-wallets will never be the method of choice for wallet security, especially since this event occurred with mybitcoin. It's just the fact that trust is required and some people do not wish to have "trust" as an element in their financial security.

I am not really clear on why grandma wants to put $300,000 into bitcoins in the first place, really.

If it is to purchase a house or something maybe she might be able to convince the real-estate agent to accept dollars instead of bitcoin, purely as an exception just for her of course being as how she somehow fails to grasp exactly how to give the poor chap bitcoins instead.

It might be better to target fund managers who manage many many gramma's $300,000 investment portfolios or something, as if those chaps are too handicapped to manage to run a wallet they probably should be fired.

-MarkM-

But how would   you regulate this? UABB?

I'm not a libertard but what you are requesting is almost impossible.

Not impossible at all. Shinobi will decide how Bitcoin is "regulated" and then his gunmen will make sure the ewallet services do what he wants. If not, well, the gunmen pull out their guns.

How are they going to chase around anonymous e-wallet services?

Even anonymous services require service providers. Rare is the person who will not talk when there's a gun at his head.

There are plenty of people who aren't very technically smart but don't have a problem installing and running software. Plenty of non-technical people are perfectly capable of downloading an app on their phone. And that is far superior to trusting a bitcoin bank.

Bitcoin needs online wallets not only for people who couldn't install a client but for accelerate and make possible RL transactions.

NFC

... and until all mobiles have NFC, QR codes works perfectly. No more complicated or time consuming than chip + pin.

NFC is not in the street at the present (1 or 2 Nexus phones are nothing) and you forget that Bitcoin transactions may easily take 30 minutes to be confirmed.

In most situations you'd ever use cash or small credit card transactions (person 2 person, merchants) "0/unconfirmed" visible instantly when the other party is standing next to you is good enough.

Tried Bitcoin Wallet on Android? You should.

Think about you just have said. Imagine that you go to the grocery and has selected all the meals that you want. Now you have to pay. With Bitcoin you are who initiate the transaction, because this, a QR code has no sense. You should send your coins to the grocery's address and they must confirm that you actually paid.

Whatever the method, must be active not passive because you have to initiate a transaction. And this is the first challenge, the second is he time required.


Even you only require the 0/unconfirmed, you need wating several minutes to the receiver can see this transaction.

I suggest you try Bitcoin Wallet before posting random nonsense. The merchant can initiate the request for a specific sum which instantly generates the QR code you as customer scans to pay.

I don't know how it works, I have not an Android device but I'm not convinced for what are you saying. Yes, the merchant can generate a QR but if this code is only a receipt to be readed for my phone, we still have the same problem of waitings.

Transaction in bitcoin network only would starts when I pay not when you generate a QR code.

I do.


I have.


It starts, and becomes "0/unconfirmed", when the payee scans the merchant-generated QR code. That's enough for small transactions of the every day kind. It's no less secure for your average cash-accepting (could be fake) or credit-card accepting (could be stolen and reversed) seller.

Maybe it's not clear how the app works: The seller enters a sum which instantly updates the QR code on the screen of her mobile. The buyer selects to pay and points to the sellers mobile with the camera viewfinder. A popup comes up asking the buyer to verify that she's indeed going to pay the agreed sum of BTC and offers her to verify or cancel.

That's all. It's really not complicated at all, and is very close to the end user experience we'll get with NFC.

And by the way: NFC is already implemented since some weeks. It's just missing the phones...

How much time will have the cashier for verify the operation, 10 minutes? Any VISA/Mastercard do this faster.

When you are in other contexts, with enough time, you can do this, but not in a supermarket checkout line.

Here:


I suggest you find a friend with an android mobile and test it yourself. You don't need to wait 10 minutes.

Unbeatable http://usa.visa.com/personal/cards/paywave/demo.html

Why do you keep posting random nonsense about something you've already admitted to not knowing anything about?

VISA Paywave is using the exact same infrastructure as any Bitcoin client can do on mobile when NFC is readily available in more models. You simply fail at being coherent.

If transactions takes a long time, bitcoin needs intermediaries. In VISA Paywave, it's clear who is it. But Bitcoin network is too slow for the real world.

You believe that any merchant would agree to accept unconfirmed transactions, but if they doesn't. A merchant may not want taking that risk, even exchangers and online wallets waits for confirmations and they are experts in the bitcoin business.

Third time:


Feel free to think through what's needed for someone to defraud a merchant in the Bitcoin case compared to what they're already risking today with cash and credit cards. Do you know how a credit card cancel days later towards a merchant works? Is it the merchant or VISA/Mastercard that's out of pocket?


edit: This is a good writeup: http://bitcoinweekly.com/articles/bitcoin-for-merchants-part-i

Anyone that can't understand how to SSH into anything is not going to be able to assess just how likely the online wallet they're using is to be full of gaping security holes - especially ones of the subtle Bitcoin-specific kind that MyBitcoins claimed they had. They certainly won't know how to use tools like Whois to figure out how easily the owner could run away with their hundredsd of thousands of dollars worth of bitcoins, and probably won't realise the implications of (for example) dealing with companies registered in Nevis. Why should we be encouraging people to act in a way they can't rationally assess the risks of again?

Ah yes, of course, because it'll help increase the value of our own bitcoins. Why did I even bother asking.

The Bitcoin network is far faster than the VISA network! It takes DAYS to settle a VISA transaction; a Bitcoin transaction is settled in minutes.

But the confirmation takes a long time, unaffordable in a real life store, credit cards takes long time in complete the whole operation but confirmation is almost instantaneous. And products like VISA Paywave are even more efficient.

the only reason why i could se people using mybitcoin besides it was a good place to register anonymously is that everyone else was doing it.
too me it always seemed a bit crude of a site and it definitely didnt say "bank" to me. Surprised people had so much coin there. One of the "flaws" often brought up about bitcoin are things like banking protections and just plain banking. So i look forward to the flexcoin and other bitcoin banks

Me? Pulling guns? I'm not the one talking of "bounties"!

Ffuentes is right. It is an impossible situation. That was my entire point.

I do not believe you. It takes six MONTHS to confirm a credit card - and thus as a derivative from that also a paypal payment or dwolla payment - sufficiently to be reasonably sure it is not an orphan transaction / double spend attack (aka "chargeback").

-MarkM-

(In other words, five MONTHS of confirmation from VISA is worth less than 50 minutes of bitcoin confirmations...)

I don't know if you're right but you're talking about "credit card confirmation" and I'm talking on "transaction confirmations". I've confirmed my card with Paypal and took about a week or less than this, but is not the matter.

No, I am talking about TRANSACTION CONFIRMATION.

Even if it is true that you have confirmed your card with paypal, it still takes six months for a transaction of you sending me money to be confirmed.

Up until six months I can be told oops, sorry, that confirmed card was actually used by a hacker not by the customer we thought we had confirmed, sorry, that transaction is orphan now, you owe us the money back...

With bitcoin, after just six BLOCKS it is very unlikely the transaction will turn out to be an orphan, even if it WAS a hacker. By six MONTHS, good frickin luck getting me to refund your money unless *I CHOOSE* to.

-MarkM-

You mean authorization? Sure, on the VISA network this takes a few seconds; it also takes a few seconds on the Bitcoin network.

No, the bitcoin network takes more than seconds, it has to wait until a block is resolved (and if the block accept include it) to the nodes can see the transaction.

Bullshit.

It takes a few seconds or less for a node on the VISA network to confirm that the transaction has been received by the net so will very likely be propagated through the net, just as it does with bitcoin.

Oh but with bitcoin your very own machine can be such a node, thus confirm in microseconds or milliseconds that it has been received by a node (yours) and thus barring some catastrophe such as the node losing contact with the net it will be propagated over the net.

So in the VISA case it takes a few seconds or less to know that you will find out in six months whether the transaction is for real, and with the bitcoin network it takes a few seconds or less to know that you will find out in 120 blocks whether it is as real as a freshly minted bitcoin barely long enough out of the minting process to be an actual bitcoin at all, which one might be tempted to say is as real as bitcoins get were it not that they keep getting more and more and more real block after block after block...

-MarkM-

If the bitcoin network can assure fast transactions, I take back what I said. I'm not putting VISA or Mastercard as a better payment methods, I'm just talking about instantaneousness, it's obvious that credit/debit cards works in other way and the existance of chargebacks is actual but it's not the matter.

Seems like is a taboo talking about escrows for certain people.

If chargebacks are not {the matter? does that mean "a problem"} then fine, bitcoin and VISA both have chargebacks, with bitcoin it could turn out any time in the next hour or two after doing the transaction that it is afterall a chargeback whereas wih VISA it could take six months to learn that it is a chargeback. But if you don't care about chargebacks, either is just as good/fast but VISA probably more expensive (as it also has to cover the case of you cheating the customer by not delivering the goods purchased.)

-MarkM-

I think Grandma just realized how complicated it was and sold all her bitcoins. That's why the crash.

The Bitcoin network sends transaction notifications in real time. How else could the transaction processors know they existed in order to put them into blocks? In one of my windows on my screen I am watching every transaction on the network scroll by in real time. It goes pretty fast. :) Soon the network will be too big to do this, but it's OK for now...

http://i56.tinypic.com/o0qypc.png

I feel the issue is not online wallets, but insecure online wallets. How is an online wallet without 2 factor authentication even expected to work well and be secure?

It is also a matter of trust. How do you know that the owner won't disappear with all of the bitcoins of the users?
Then, the security is also a concern. It is not possible to know whether the system (no matter how many authentication factors it uses) is secure or not, well, until it is hacked (I think Sony though that their system was secure until the hack too). Next is the account security. Two factor authentication is a must, and all banks in my country use two factor (a regular password and a "password card" or a password generator) authentication for online banking.

Unless some big companies (Google, banks etc) start providing this service online wallets will be untrustworthy. Security, well, some companies havve better security track record than others, so maybe they know what they are doing.

Eggs, basket, etc.

Or: why you should spread out your funds over multiple providers.