Bitcoin Forum

I have decided to create some real physical Bitcoins.  Here's what's to come.  Cost: 1.15 BTC + shipping, with bulk discounts available.

Each coin has a private key embedded inside worth 1 BTC, covered by a custom Casascius hologram.  I'm just waiting on the holograms, then these are ready to go!  I will have the ordering website available when they are.  I can hardly wait to see them, they're supposed to be gold and have, among other things, a giant sparkling golden B logo in the middle.

http://img714.imageshack.us/img714/4880/img0624v.jpg

Diameter: 1.125 inches.  Material: brass.  Price subject to revision with Bitcoin price fluctuations.  The back side is flat for the hologram, except for a small circular well which holds the private key.  The first 8 characters of the public Bitcoin address are visible on the outside, pre-printed on the hologram by the hologram manufacturer.

very interesting  8)

good luck with your new business

This is super cool, and I will buy at least 1 when they are available

Hey, casascius I'm a big fan.  I think we are the two first people to have bitcoins in our head.  I have a question though.

How is the public key displayed?

j

Answer added to original post

thought your paper wallet was pretty cool.. this is better.  I think you will do well. they would be good to give out to get people into bitcoin.
I dont know if you have, but you should either develop of link to one of the apps that make it easy to add keys to your wallet as i take it these will have to be broken open to put online?

it would be nice if one day they had something like a micosd card inside that you could just insert in a phone or a pc reader and point your wallet at it and go.(noted that would make them much more expensive)

Still I think these will sell well. It would be nice to see if some of the merchants who have adopted bitcoin will take them.

so , the coin with the hologram , the work arround it (filling adresses with 1 btc and so on ) for just 0.15 btc ?

i cant believe you get those done that cheap ...

Sounds interesting.

casascius,

the correct Latin phrase is 'vis in numeris' (not vires).

my 2 satoshis :)

spiccioli.

Google seems to disagree with you...
http://www.google.com/webhp?q=%22vis+in+numeris%22 (http://www.google.com/webhp?q=%22vis+in+numeris%22)

Price subject to revision?  So a Bitcoin will be pegged to a Bitcoin of a different value?  So, one of these Bitcoins that is worth 1 BTC can also be worth a different amount than 1 BTC?  This is all getting very confusing.  "Hey!  I have 20 BTC! They are worth 15.5 BTC!"

Call me dumb but i don't get the hologram/private key thing...
If the coin holds the private key, what prevents someone from reading it, sell the coin, and move the BTC away after it's sold? :-/
Can someone explain please?

Google is not able to correctly translate Latin :)

I've studied Latin in high school (5 years) here in Italy and my wife teaches Latin in high school.

'Vires' means 'soldiers', 'armed forces'.

When used in its plural form 'vires', it may mean 'strength', but only in sentences like 'vires defiunt' which means 'I'm becoming dizzy' (my 'forces' are going away, literally).

If you want to correctly translate 'strength (is) in numbers' the Latin for it is: 'vis in numeris'.

It was even used before, see:

http://articles.latimes.com/2000/dec/17/news/ss-5286

or a manuscript

De numeris: MS Hannover, Landeskirchlichen Archiv D 10 Nr. 1 (PfA Bissendorf HS 20) ff. 186r-195v [inc: Quanta sit vis in numeris noverant...

"How much strength is in numbers ... "

spiccioli.

Its just a single hop. Once it's revealed, you would want to withdraw.

Its "supposed" to be gold?? How could you have no idea what you are making?

Whoops, reading comprehension fail.

That's just for the hologram.

So is there a discount because of the shoddy translation or is it a "collectible unique" now?

Upon reading this thread, I came up with another brain-fart. What if there was a physical Bitcoin designed for each country?

• USA: Eagle
• Canada: Loon
• Turkey: Fez
• France: Duck!

They would have to destructively tear off the hologram to read the key. These holograms tear in a tamper evident pattern.

I think there will probably never a need to tear off and read the key. These coins hold value and are meant as a physical btc exchange medium. Once the BTC is revealed and withdrawn, these coin's only value is its artistic+metal value. Thought there should be a way (like a serial number), for the holder to verify through your website, that the coin is not easily counter-feit and the key is valid.

I actually hope that people do occasionally test the coins.  It's an integrity check for the whole system and discourages fraud and counterfeiting.  I intend to sell these in bulk packages of "n+1", such as packs of 21, 51, and 101, encouraging buyers to choose one of the coins at random and rip it open to test it.


Each hologram has a factory-printed serial number which is actually just the first 8 characters of the bitcoin address for the coin.  The verification will be possible through any block explorer.

I'm guessing he's talking about the 0.15 portion that covers the cost to make the coins.

But if they drop below 1 BTC, I'll take em all!

I hope, but he said the price is subject to revision due to Bitcoin price fluctuations.  I assume that means volatility.

Edit:  Oops.  Duh.

By the way, the private key inside the coin is represented as 22 characters, rather than 50+.  To get the real private key, simply take the SHA256 hash of the characters inside the coin.  The characters are legible to the eye, and not any sort of QR code etc.  The reduced character count keeps it legible, but were it a QR code, it would drop the density and make it more readable.

The Casascius Bitcoin Utility can do this conversion and reveal the private key and public address, and hopefully the standard will be adopted by others as well (it's pretty simple and straightforward, and also includes a simple check digit scheme to prevent typos).

Sample: (formatted this way because it fits nicely on a circular insert)


Casascius Bitcoin Utility gives a matching private key and bitcoin address: 5JjDdAyDmwCsuDLgcd6aPdpS7kbPLE63pArUZPSYzLRkUHe3vp9 and 1GcJ96oXeaFzEZLox1VfjHbdYtzrSUC54

I'm still a little confused with this bitbill and bitcoin coin things... when you GET one of these things, and you want to actually use the value and put it into your wallet, how do you do it?  I only see the option to send coins and receiving coins is done automatically... I'm on Win 7 client.  Where do you enter this public and private key?



 

+1
I think, physical bitcoins should remain decentralized and controlled by me only. They shouldn't be a part of some service or bank during their lifetime, except our blockchain. Can bitcoin exist without wallet.dat file? If not, where's the wallet.dat for this bitcoin? Excuse me if I lack some technical knowledge, please explain.

Or wait.. is the private key just the text that you save as the wallet.dat file? and it will have 1btc in it..... still confused as to how this works

II don't think so, wallet is much heavier. OK, what's private key?

what happens once the Value from the coin is redeemed and used?

dose the coin self-destruct?  

maybe there should be no key on the coin at all!
only a promises that if you send back the coin(s), you can exchange them to what ever currency you want.
when the coin is sent back to you, you'll pay them and sell the coin again.

having "no longer valid coins" in the system is kinda sucks.

my 2 bitcents

D'Oh...now i get it. The hologram is a sticker and covers the private key... i had some sort of hologram directly lasered on the coin's surface in my mind...you know, to make it look pretty ::)

yeah and a coin with a cannabis-plant for holland!

Ill buy it!

pywallet will do it.. I suspect a future client will do it (https://bitcointalk.org/index.php?topic=34028.0)


but I suspect casascius might know the best ways, as he has had the paper wallets for a long time now.

Thank you, I'm beginning to understand. Great! I think, counterfeiting is not a big problem: there always were fake money, it will not be some bad feature of bitcoin itself. But of course it must be a method to check if the coin is not fake. A detector!

about the double spending and counterfeiting.

this isnt quite fool proof but does help a ton


most addies can be verified by block explorer with just 8 chars.  You could at least see if right at that moment there was exactly 1 coin in there.

Now If I was a store.... I would break it open, import the key to a temporary wallet, and send that money immediately to a permanent wallet.

This is so if he did actually counterfeit the entire coin, and still controls the private keys on his machine at home, the merchant can still get paid right away.

there might still be a small window.. due to the time it takes to get confirmations, but hardly a window very large for him to run home and quickly do a double spend. I'm not sure how that all works so cant say for sure but it adds a layer of difficulty if merchants destroy them immediately.



which would be good for casascius's bottom line..

" I would break it open, import the key to a temporary wallet, and send that money immediately to a permanent wallet."


Sorry to still be so dense about this..... but how do you go about "importing the key to a temporary wallet" ?

Am I missing something... I have the windows 7 client...  is this only a linux thing?  I see no option to import keys or scan key or manually enter a key... I am still lost as to how I get the 1 btc from the bitbill or bitcoin coin to my actual wallet that I use....

You can import keys with pywallet

Because Bitcoin is projected to deflate in the future, I don't know how well any of these "tangible" Bitcoin projects will do. What happens when Bitcoins are worth "thousands", how are you going to get change back for that coin? A deflationary system would only have a chance to work in the digital world, since a deflationary system will always require you to break off from what you already have.

The potential future issue of having a single tangible bitcoin to spend when its value has become high is not much different from the issue of wanting to buy a soda and just having a hundred dollar bill in your pocket. Assuming that the vendor will accept such a valuable item in the first place, they need to give you change. They might give you change in the form of tangible bitcents, bitdimes, etc. that would presumably be created if the value of a bitcoin goes through the roof and tangible coins become popular. Or they might transfer the change electronically. Or they might decline to accept it and ask you to go change it out for smaller denominations, just as a soda seller might decline to accept a hundred dollar bill.

Personally, I would have marked the private key as a QR code instead of or in addition to an alphanumeric form. In any case, I am interested in seeing how this new coin turns out.

Portable coins are great for promotion  8)

For the visible public key, you should just use the address' firstbits.

Easy, just make new denominations when the time comes.  Although each coin costs the same to make, at the same time Bitcoin value rises, I am sure that eventually someone will be able to do it on a massive scale for cheaper.


I am showing the first 8 characters, this way it's highly improbable that someone else will generate and use an address with the same firstbits before I issue the coin.  I had to generate all the addresses in advance in order to get unique holograms with pre-printed addresses.  And having 8 characters also makes it far less likely that I will accidentally deposit the 1 BTC to somebody else's address.


You'll probably find that the effort of tearing into the coin will probably be much more than typing 22 characters on a keyboard, there is a hard protective layer on top of the hologram.  That said, I am still at the point where I could put them in as QR codes, since I have yet to put them in the coins (a process I am doing solely by myself).


I just simply use a copy of bitcoind with the import/export patch applied.  To use it, I generally just delete wallet.dat (yes), then start it up with an empty wallet and let the block chain catch up, then import keys, then spend the entire balance to some more permanent address so the wallet.dat is worth 0 again, and then shut down.  It's convenient - I never have to worry about the wallet going out of sync with the block chain, because I'm literally deleting the wallet every time I use it.

Is pywallet windows 7 friendly or is this a linux thing?

I am fairly a geek and I still find bitcoin difficult sometimes... I can only imagine the ordinary person.  This is why bitcoins are going for $25 on ebay.  No one wants to sign up with weird exchanges and transfer money to 3rd world countries through middle men and install a thing that they don't understand that is not safe or encrypted and have to transfer between so many places.
This is what holds bitcoins back.  It needs to be easy to the common person.

W7 friendly
Two ways to use it:
 If you aren't afraid by the CLI you only need to install python 2.7
 Otherwise you will need to install two more packages (twisted and zope.interface, just read the readme)

jackajck, a user called sukrim packaged our hopper into a nice *.exe for people that werent that technical. we use the same dependencies and it seemed to work very well for the windows noobs masses... not that it is all that complex.. You'd be surprised the many ways someone can screw it up. Might want to think about releasing something like that.

your app and his paper wallets and things go hand in hand(yeah i see tearing into the coins might be a problem).. it would help if it was a tiny bit grandma friendly.

Makes sense. So a good business plan for a private company to do would be to get into the Bitcoin minting sector, and introduce this "tangible currency" to troubled third world nations who want to get rid of their dictators and want a free source of money. That would be one of the biggest goals people should be working on right now, is getting underdeveloped nations to accept this. It would be so easy to sell, but would obviously require money!

can you make pound coins with this? ;)

Would there be any relatively common scanning technologies (such as those used at a forensic lab or for medical purposes?) that could read this code without tampering with the sticker?

I did think of it... which is why I went with regular inkjet on paper for the printing.  And the printing is relatively light, and combined with other printed marks I have made on the private key sheets that help me ensure they have been placed with the right pre-printed hologram sticker.

During the decision making process, I asked myself this same question.  I felt that if I used laser printing, that the fused toner could be detectable through ultrasound or that it might reflect some sort of radiation or have magnetic properties that could be detected.  So I completely steered clear.  And if I had done anything engraved, it almost certainly would be detectable in reflections of radiation.

So... I suppose I would be interested if someone finds a way.  I suspect these coins are going to be collected more than circulated, and a major objective I had in producing the coins is simply to seed the concept that Bitcoins can be tangible and can be a backing and they don't have to exist purely in cyberspace.

If someone finds a way to compromise my coins, their utility will be reduced somewhat - people just won't be able to circulate them amongst strangers.  I take comfort in suspecting that's not happening a whole lot, as compared to people giving away the coins as gifts or to people who they know.  (Example: I gave a family member bitcoins for babysitting...they would have done it for free but the circumstances dictated that paying them something was appropriate...and that something was bitcoins.)

I like how casascius completely ignored the entire "wrong translation" situation...

...honestly, who cares?  Simple crap can be fixed simply...putting together a production process is step 1 to making a streamlined, cheap way to produce long term physical representations of BTC...the last thing we want are central bit coin banks to issue their own coins with no private key (only the promise to redeem them for one on demand)...the start of fractional reserve bit coin banking I think could end up being a very bad thing...

You will like this even worse: I am in the process of making even more elaborate coins with the same wrong translation in all its glory.

I just don't care.

Worrying about the translation is inconsistent with my goals in producing the coin.

So what are your goals? I also support correct Latin translations :P

The problem is everybody seems to have a different idea of what the correct translation should be.

Vires in numeris is the only one where once upon a time there was consensus, even if it was incorrect or ill-founded.

And I believe Bitcoin has a long future ahead of it.  Me doing physical bitcoins is just to say "hey world, guess what, tangible bitcoins are possible, they're not just imaginary".  I will have simply pioneered the physical bitcoin (with all due respect to BitBills).  Someone else will do a leaner, meaner, badder, cheaper, more secure physical bitcoin...and they'll get the Latin right as well.

The whole point of this exercise is to have physical bitcoin similar to gold coins that can be easily traded in person.  Each physical bitcoin should worth exactly 1 BTC and can be given/received just like a gold coin or any real currency.

To enforce this system, the construction of the coin have to be in such a way that if opened to obtain the private key of the 1BTC then the coin itself would be completely destroyed or at least easily identified as "used up".  I think the OP is using some sort of seal to ensure this.

Either way the whole system depends on not able to easily "fake", duplicate, or temper with the physical bitcoin construction. If people can duplicate the coin, or easily extract the private key of the BTC within the physical coin while leaving the structure interact, then this whole system collapses, as noone knows if the coin is 1) fake or 2)already used up.   

This is not an easy problem to solve.  OP is on the right track, but it takes a whole army of people to create regular coins...and what we are talking about here is far more complex than your regular pennies and quarters construction.  Nonetheless, thumbs up for thinking ahead of the herd.

@Casascius

I just saw these hollow coins for storing microSD cards inside.
I don't know if you could make these with a Bitcoin  design but that would be pretty cool and probably sell too.

http://www.ebay.com/itm/NEW-Hollow-Spy-Coin-Micro-SD-Card-Covert-US-Half-Dollar-/230435475593?pt=LH_DefaultDomain_0&hash=item35a7065089

For anyone interested it is possible to crack open one of these beauties and imported the Bitcoin into your wallet.dat.  It was not easy but it is possible.  Hopefully there will be a more user friendly way to do this soon.  Personally I think the best idea would be a web site which downloads a Javascript with two input windows:  1) A place to enter the mini private key from inside the coin and 2) a place to enter your destination public Bitcoin address.  The script would transfer the Bitcoin off the (now destroyed) physical Bitcoin and send it to the desired destination address.  Not having that, this is how I did it.  Ugly I admit:

• Bought a physical coins from https://www.casascius.com/
• Found the full Bitcoin address by entering the address on the outside of the coin (12ho33tJ) here:  http://firstbits.com/
• Verified it contained one Bitcoin in value at: http://blockexplorer.com/address/12ho33tJq5o4uQUnyEemErAgeTfS7YoXDc
• Installed pywallet from: https://github.com/downloads/jackjack-jj/pywallet/PWI_0.0.3.exe
• Before trying to decode my mini private key I used the private key published at https://en.bitcoin.it/wiki/Mini_private_key_format in order to test the decode process.  The mini private key I used was: S4b3N3oGqDqR5jNuxEvDwf
• I then made a file named “short” containing exactly these 22 characters.  This is not as easy as it sounds because most editors add CR/LF and EOF characters to a file.  I used hexedit to make a file of exactly these characters.
• Then I used openssl like so:   bash-4.1# openssl dgst -sha256 < short
• I got the following result and verified it with the result on the wiki page: 0c28fca386c7a227600b2fe50b7cae11ec86d3bf1fbe471be89827e19d72aa1d
• Then I killed my precious unicorn (peeled off the sticker) and read the private key from the sticker.
• I then made a file named “mine” containing exactly these 22 characters.
• Then I used openssl like so:   bash-4.1# openssl dgst -sha256 < mine
• Turned off my Windows Bitcoin client so I could run the pywallet browser
• I used pywallet to import the key in to my wallet.dat.  When it imported the private key into my wallet.dat file the Bitcoin address matched the address on the coin (12ho33tJq5o4uQUnyEemErAgeTfS7YoXDc) so I knew I had the correct private key.
• Finally, I fired up the Windows Bitcoin client with a –rescan and I got 1 more Bitcoin in my wallet!

I really like my coins and do not plan on destroying any more of them any time soon.  They are beautiful and collectable and I just ordered another batch.

Glad to see you got it working!

In Linux the three steps above can be replaced by the following single command:

 echo -n CodeGoesHere | sha256sum

I am using Cygwin.  I can try that and see if it works on Cygwin.

Thanks, that does save a step (I only know enough Cygwin/Linux to be slightly dangerous - and learn something new every day).  Either of these will also work and will save the step of creating the file:

bash-4.1# echo -n S4b3N3oGqDqR5jNuxEvDwf | openssl dgst -sha256
0c28fca386c7a227600b2fe50b7cae11ec86d3bf1fbe471be89827e19d72aa1d

bash-4.1# echo -n S4b3N3oGqDqR5jNuxEvDwf | sha256sum
0c28fca386c7a227600b2fe50b7cae11ec86d3bf1fbe471be89827e19d72aa1d

Received my coins yesterday.  VERY IMPRESSIVE.  Very cool.  Great job, casascius!  Thanks!

 :)

A good idea, but there's one vulnerability of any physical Bitcoin that exists today - possibility of duplication. The public keys displayed can ensure that the money itself is backed by some Bitcoins, but before redemption, no one really knows whether there are the second piece of money that has the same public key.

Although holograms are hard to make, but it's not entirely impossible to duplicate. For fiat money, government controls most of the technologies to manufacture paper money, and to some extent, this control is quite effective.

One thing about crypto currency is that it can be easily duplicated and spent twice, and Bitcoin solved the problem perfectly, through P2P networks.

I wonder if there's any potential for a physical form of Bitcoin that can utilize the P2P network effectively by itself? Or other ways that can effectively reduce or eliminate the problem of double spending attacks on physical Bitcoins?

I like this idea very much, I mentioned it in my blog (http://minetopics.blogspot.com/2011/09/lets-get-physical.html (http://minetopics.blogspot.com/2011/09/lets-get-physical.html)) and I will probably order some coins from you soon to show off to friends.

Someone mentioned earlier the risk that multiple coins with the same key could be made - although if this were happening, it would eventually get caught by random sampling (by people converting their coins back to digital form), so I'm not too concerned about that.

A more serious risk, it seems to me (from the user's perspective) is:  How do we know that it's not the case that you are keeping copies of ALL the private keys for yourself, and, once there are (say) 100,000 of these coins in circulation that haven't had their values removed yet, maybe your plan is to quickly exchange the BTC backing all those coins for some other currency, and disappear?

I'm not saying it is a particularly likely scenario, and I personally have no particular inclination to suspect you of this, but I'm just saying it is a possibility that can't be eliminated from users' minds, unless you subjected your entire coin-making operation to continuous, detailed scrutiny by some trusted third-party auditors.  Or, if you were a company with numerous publicly-known officers that would be subject to prosecution in such an event, then that might generate more trust in your system.  But, as just a single individual, you might all-too-easily just grab all the loot one day, slip away, & hightail it to Rio.

Many people (myself included) may be willing to take that risk for the convenience of carrying around a little BTC-valued pocket change, but, I have a feeling nobody is going to be filling bank vaults with this stuff, at least not until it's made more accountable than a private one-man operation can be...

But, I think it's cool anyway... Kudos on the professional design work.

-Mike

The problem is not whether it'll eventually get caught. If I accept your physical bitcoin in an exchange for goods and services, I have to make sure that it's 100% unique if I'm not going to redeem it right away.

If I have to redeem it to make sure I can get the value, then there's no reason to make holograms - you can just print out the keys.

So, the problem lies on whether you can make sure that you can get the 1 BTC after 10 years without the use of P2P.

Yeah, but look:  Let's say that 100,000 of these things get made and used by thousands of people over a period of years and years, with a good number of those coins getting redeemed by random people, and there is never a report of someone trying to redeem a coin only to find that someone else had already redeemed another coin with the same code.

In that case, then I can probably be at least 99% certain that there are no duplicates already in circulation of a coin I receive - since, statistically speaking, if as many as 1% of all coins were non-unique, and if (say) 10,000 of the 100,000 coins issued had already been redeemed, then you'd expect that several cases of duplicate coins would already have been found and reported.  (On average, 100 of the 10,000 coins already redeemed would have had duplicates, and ~10 of those 100 duplicates would be included among the 10% of coins already redeemed - so the fraud would have already been caught.)

So, once these things have been out there in circulation a while, there's no need for the person accepting them to have 100% proof that there's no duplicates already in circulation - the lack of any reports of problems from other users would be proof enough.

This statistical analysis doesn't, however, address the scenario I mentioned, wherein the issuer is planning to steal the value of all coins at once in a "Grand Theft" scenario.

Without P2P?
Without the network there is no Bitcoin. There is no value for anyone if the network goes down.
It all spontaneously vanishes.

In the meantime you can always check the address for it's value without ruining the coin or redeeming it.

What if I'm a major merchant and I duplicate all the coins I accepted and save them secretly and only spend the duplicated ones? Then maybe I can redeem them all at once.

I don't have to be the issuer to be the Grand Theft, as long as I can manufacture myself without anyone else knowing.

I've been assuming that they're difficult to counterfeit due to the way the hologram is made.  If that's not the case, then of course you are right.

Of course I can check, but checking doesn't guarantee uniqueness. Our coins are unique because of P2P, but physical bitcoins can't be connected.

When I accept a physical bitcoin, I need to make sure no one else has it. If the OP can get the hologram for 0.15 BTC, I can take over the company the makes the hologram and do the same too.

I a willing to trust as secure the manufacturer's processes and the distribution of the coins that were shipped to me.  If I were to resell a batch of these the buyer would be trusting me as well as the manufacturer, etc.  

Perhaps simply a register or log of assignments is necessary.   For instance, Casascius creates a signed message for each physical coin (its address) asserting that it was sold to me (to my gpg public key).  When I sell one, I sign a message including the previous assignment and assert that I sold it and to whom (to the next party's public key).   And so on, for each sale.

So then when considering buying these physical bitcoins from a third party seller, the buyer can weigh whether or not all previous owners are trustworthy enough to feel comfortable that the bitcoin is truly authentic.  Think WingCash ( http://bitcointalk.org/?topic=4232.0 ) meets Bitcoin.

This ruins anonymity, though I suppose a party in the chain could remain pseudonymous -- just that I don't know how trusted the pseudonymous participants would be.

[Update: Or, can the model that namecoin offers, w/dot-bit offer something here?]

Either way, in this particular case, trust in the manufacturer is required.  I could just as easily make a physical bitcoin with a duplicate private key as one with no private key (except perhaps for the fact that I only got each address printed on each hologram once).

I sincerely hope that someone makes a bigger, better, badder, more secure, more auditable, more everything physical bitcoin (and cheaper, too).  As Bitcoin gets bigger, that's bound to happen.  Practically speaking, Casascius physical bitcoins get used right now mainly as all of the following:

• A collector's item.
• A low-cost gift (for the buyer) worth saving (for the recipient) because one day it may well be worth a ton.
• An appealing way to bring up the topic of Bitcoin with people who don't care about otherwise "imaginary" currency.
• A way for people who trust each other, one who has lots of Casascius coins and the other who doesn't, to settle some small debt (like paying for lunch) in a fun way.
• A proof of concept to the world, that bitcoins don't have to be intangible.
• A way to get otherwise uninterested people thinking about how the internals of Bitcoin really work... "so what you're saying... there's a code in here, and you call that a private key?"
• And finally, a few get torn apart just out of curiosity and to test the redemption process.

At this point, I bet very few get "spent" in the arms-length process where the recipient thinks very little of bitcoin other than just another kind of dollar.  Physical bitcoins get traded nowadays only among people who know each other's name, possibly because the spender paid a premium to acquire the coin and isn't eager to give it to someone who won't appreciate that or compensate them for it.  In an environment where trading partners generally know one another, passing counterfeits or duplicates or scams is arguably harder than making them.

I understand, and yes if they can be easily counterfeited it is a problem, but I still think you're making too big a deal about the physicality of the coins.  That isn't really the issue - since ALL information is, ultimately, physical.  The coins' state of disconnectedness from the network isn't really the issue either.  The P2P system, by itself, doesn't do anything special to ensure uniqueness of the key that any given Bitcoin is associated with.  Even with conventional "all electronic" Bitcoins, there is no way to know for sure that a given Bitcoin's private key (even one you made yourself!) is truly unique, UNLESS you are 100% confident that no one other than yourself ever had access to that key from the moment the keypair was first created, and that either it was originally generated using a secure source of random numbers that couldn't be eavesdropped on in some way, or else by using a long passphrase (which only you know) as a random seed.

All that the P2P system does is to ensure that you can't transfer the same coins from a given account more than once, and have both transactions finally accepted by the network.  But, whether the destination account's private-key details are stored in a physical coin or on a hard drive (or in your head!) is really a completely separate from the issue of whether another copy of those details exists (or can be regenerated) somewhere else - which the P2P network itself does nothing to ensure.  Even if the only way to get the key is to regenerate it from a passphrase in your head, you could always mumble it in your sleep, and someone could overhear you, and then make another copy of your key & spend your coins before you ever get the chance.  :)

I think the real issue here is that the keypairs themselves are being generated by a third party, rather than by a client on your own computer.  Any time that's the case, no matter in what form the keys are delivered to you, you can't be sure the sender didn't keep a copy!  Whether they deliver the key details to you in a coin or on a USB drive or over an https connection has nothing to do with the question of whether they kept a copy of it for themselves.

On the plus side, anyone who is nervous about Casascius coins is always free to resell them, or to immediately take them apart and  transfer their value elsewhere... So there isn't really all that much risk of theft here, unless you plan to hold onto a lot of Casascius coins in their original form for a long time.  So I don't think most vendors would have a problem accepting them - especially if they can verify the balance on a smartphone by keying in the firstbits...

The website seems down.

https://bitcointalk.org/index.php?topic=41892.msg544974#msg544974

It will probably be down for several more hours.

It's up now, the issue has been taken care of.  (that's what I get for running this from home =) )