Bitcoin Forum

Hi Everyone,
I just put up a new bitcoin exchange.
Please let me know what you think.
https://mtgox.com

Your trade mechanism seems to favor those buying bitcoins at the expense of those selling.  I am not certain but I believe that bitcoin market take the average between the high bid and the low ask while you set the price at the low ask.  This is not necessarially a bad thing, but I did want to point it out.

I should add this to the site but...
that ticker is:
Last Price:  (The price of the last successful trade)
High:  (the highest price in the last 24 hours)
Low:  (the lowest price in the last 24 hours)
Volume: (the total amount traded in the last 24 hours)

Current Lowest Buy Price  (This is the lowest buy price currently offered by another user)
Current Highest Sell Price  (This is the highest sell price currently offered by another user)

All trades are between users. So the current buy price and current low price is just what someone else entered. You can always enter a lower or higher one.

https://mtgox.com/users/login?username=SmokeTooMuch&password=XXXXXXX

what the fuck!?! use hashes for transmitting and saving passwords!!!!

and btw, I cant log in

sorry to say that, but until now your exchange service is just a password-ripoff service ....


BTW: I want you to delete my account and all associated info (like my password, dude!)

I will re-register when you fixed that password thing ...

EDIT 2004-02-27:
Since this post has gotten some attention from reddit I feel I should clarify a few things.
At the time of posting this I had a very naive perception of IT security. It is perfectly normal for sites to receive their users passwords in cleartext and hashing them after (server-side).
I've since learned a lot about IT security and want to apologize for the inconvenience I brought upon the service back then.
The real problem was not the un-hashed transfer, but the transfer via GET (readable in URL) as opposed to POST (non-readable in URL), so the only attack vector was an "over the shoulder attack".

Well atleast POST and not GET. (Btw, 99.9% of web services transmit password from user browser to the server clear text, no JS hashing or something before transmit)

And another thing: The spread is insane. Insanely expensive to buy BC and selling BC mediocre rate for today.

SmokeTooMuch: It is a post over https. It is secure. I'll PM you about the login issue if that is ok.

PulsedMedia: The spread is 2%. Is that too high? I think you are just looking at the difference in what two people are offering. That isn't what you should look at.

You can't use unhashed passwords at a site, that deals with money. That's just one big mistake you just can't make if you want to make such a thing. What if someone hacks your database ? He could steal the money and BTC funded in all your users accounts.



maybe the transmission is secured, but what's with your database ? Since you don't transmit hashes I guess the passwords get stored in clear text.

EDIT 2014-02-27:
See this post https://bitcointalk.org/index.php?topic=444.msg3876#msg3876 (https://bitcointalk.org/index.php?topic=444.msg3876#msg3876)

Don't worry the passwords are hashed in the DB.

That the variable coming to server is unhashed does not say that the DB uses unhashed pws.

The password is practically always transmitted cleartext to the server, within SSL session most of the time however, on crucial things. But it does not tell is it hashed in the database or not.

The thing about if the encryption is clientside, it's trivial for any hacker to hack as the algo can be trivially disassembled and disseminated.

It's a very bad idea to transmit the password in GET variable tho.

so how does it work ?

password --->encryption (ssl) ---> your site/server && decryption ---> hashing ---> saving/checking hash in db ?


as long as you receive the password unencrypted, it's just not an option for me

EDIT 2014-02-27:
See this post https://bitcointalk.org/index.php?topic=444.msg3876#msg3876 (https://bitcointalk.org/index.php?topic=444.msg3876#msg3876)

Why would I use Mt. Gox instead of BitCoin Market?

you could buy BTC cheap at one of them and sell them fore more at the other exchange service (if the exchange rates fit in that pattern)

EDIT 2014-02-27:
See this post https://bitcointalk.org/index.php?topic=444.msg3876#msg3876 (https://bitcointalk.org/index.php?topic=444.msg3876#msg3876)

SmokeTooMuch: Almost all sites do it this way. Are you worried that I personally will learn your password? You can just set your "password" to be the hash of your password if you are really worried.
(or use a different one for mtgox)

> Why would I use Mt. Gox instead of BitCoin Market?

It is always online, automated, the site is faster and on dedicated hosting and I think the interface is nicer.

Also because, at the moment, bitcoins are cheaper on MTgox, although I am not sure if there are any actually available since with a higher bid than sell transactions should be being resolved.

this won't prevent you from stealing your users cash and btc. pls correct me if i'm wrong.

and i say it again, i want you to delete my account and all associated data.

maybe i will re-register later, but for now i decided to not using your service.

sry for making you such a hard start into business, but it's 5 am here and i'm a bit stressed out.
will go to sleep now.

EDIT 2014-02-27:
See this post https://bitcointalk.org/index.php?topic=444.msg3876#msg3876 (https://bitcointalk.org/index.php?topic=444.msg3876#msg3876)

The password should be hashed in DB. It's plain stupid and ignorant not to hash them. Eventually if there's databreach and passwords are not hashed ...

It should work:
Browser -> send to server (pref SSL encrypted) -> server receives and directs to script -> script hashes (adding salt, pref static + dynamic) and saves to db or verifies from db

Security is a complex matter, but basics should be adhered to nevertheless.

This is exactly what I'm doing. :)

I put up an offer to buy, it's below the ask price, so I am not surprised no transaction happened, but is it going to show up as the highest buy offer?  currently that is 0 (which I assume means nobody is buying bitcoins right now)

I support as many exchanges opening as possible and letting the market decide. :) 
Competition is great!

I see:
Current Lowest Buy Price   0.1224
Current Highest Sell Price   0.05882

Meaning someone out there is wanting to sell BTC for 0.1224
And someone else is wanting to buy them for 0.05882

so if your buy price is below 0.05882 it wont show up until all the ones are sold at the better price. (better from the perspective of the seller)

Ahhhh, I was reading these backwards.  Thanks for straightening that out for me.

I didn't find any info about what payment methods are accepted. You should add something about that.

It says it on add funds page. but I'll add the info for unregistered users.
It just takes paypal right now.
Adding more soon.

Where is the list of offers? Specifically how many bitcoins are being offered to buy and sell at different prices.

I don't have depth of market data displayed yet. I should have that in later today.
Right now you can just see what the lowest ask and highest bid is.

It looks like you hold PayPal USD in escrow, is that correct? This makes trading much smoother and quicker, but puts you at risk of having your PayPal account frozen. I think running an e-currency exchange is against their terms of use, but I don't know how much volume you'd have to have to draw their attention. I'm not saying it's going to happen, but if you use your PayPal account for other purposes, you should be aware of the risk. The nice thing about the other market website is that PayPal can't target the operator, they can only target the many users, which is much more difficult. But this method which is safer for the administrator, does of course come at the cost of fast trades.

Yeah I don't think paypal is a long term solution. I just wanted to get the site up. I'm thinking of other funding methods now.

Maybe I'm, just too paranoid, but I think everyone who has physical access to the server on which your site is hosted can read my password out of the RAM if you only hash it once you receive it. and if he/she has my login data he could act as me and legally withdraw the funds in my mtgox account.  why not just hash it before encrypting and sending it ?

EDIT 2014-02-27:
See this post https://bitcointalk.org/index.php?topic=444.msg3876#msg3876 (https://bitcointalk.org/index.php?topic=444.msg3876#msg3876)

I think he's worried that if someone sees the screen of his computer when he's on the site, it's just too easy to memorize the login information.

that's not really what I'm afraid of, but thats an issue too.

hmm, but still, in theory, it would be possible for someone with physical access to your RAM to read my password, wouldn't it ?

Passing the password in the GET string is wrong, but passing the password without hashing it is perfectly acceptable.

As the DB operator, he could easily steal any bitcoins or cash you gave him. There's really nothing to do about that.

If an attacker had that much access, he could modify the login page to remove the password-hashing JavaScript.

I see nothing about associated brokerage fees, etc, on the site.  Care to fill us in?  What's your take?

Solution:
1)Use a unique password.
2)Only put funds in the account which are immediately to be used for trade
3)Don't trade at one time amounts larger than you don't mind losing.

Then, even if they get your password, what do they do - steal five dollars?

Final post here for now:
I assume that on the "Withdraw Funds" page we don't need to fill in more form elements than necessary?

Ie, if we want bitcoins back, we just give our BTC address.  If we want a check, we give our mailing address, if we want paypal, we give our email address, but there's no need to give a mailing address or email address to get bitcoins back, right?

It would be great if the form changed per our selections - ie, if you wanted bitcoins, you wouldn't see anything for the USD withdraw options.  If you wanted a check, you wouldn't see the request for paypal email or bitcoin address, etc.  JQuery is nice, or any AJAX tool.

The same goes for the deposit forms.

Also, the site mentions that USD withdrawals are manual.  Are bitcoin withdrawals automated?  What about deposits (of both kinds)?

InterArmaEnimSil:
We make money by keeping a 2% spread between the buyer and seller. But the price you buy or sell at is the price you get. The way it works is if you enter a sell price of X the buyer sees the price as X*1.02. So your trades will complete at the price you see on your order the other guy will just be agreeing to a slightly different price.
Adding this info to the site now...

Withdrawing: Yes you only need to enter in the fields pertinent to your withdraw. I'm going to make this form dynamic and better tomorrow. All withdrawals are manual for a few days until I'm more certain there are no major issues. But paypal and BTC should both become automatic soon.

Adding both types of Funds is automatic right now.

Added $10, was credited with $9.41.  I assume this is a 5.9% PayPal fee?

Yeah paypal's fee is 2.9% + $0.30 USD

You should really add a "buyer's price" indicator to your selling form.  For instance, what if I see that the current low price is $.05/BTC.  I go, "If I beat that, then my offer will be the lowest and someone will take it!"  So, I enter a price of $.0495/BTC.  .0495*1.02=.05049.  So, my price isn't the lowest, and my offer will not be taken up.  If the form informed me of how much I get as well as how much a buyer paid, then I could tailor my offer to beat the current ones and still know how much I'd be making.

Paypal really needs to be brought down a peg or two.

Big time. I'm really hoping bitcoin makes a huge dent in them. It annoys me so much that they get 5.9% for running one UPDATE statement in their database.

The thing that annoys me is that google checkout does exactly the same thing.Bitcoin end to end transactions are a nice dream.

MTGOX needs a disclaimer for the PayPal fees.

Also the buy and sell prices are coming together now:  HIGH/LOW Buy @0.0969 Sell @0.09216.

I'd expect the H/L values to even out at the acceptable market rate, and I'm shocked the BTCs are about a dime each!

But than you make a change in the system. That can be suspicious.
If you're just reading it from the RAM and using it, nobody will know.

You should really get rid of the spread and focus on advertisements. The spread unnecessarily complicates the your whole market and makes you less trustworthy than that other market. I'm staying over there for the time being. I actually kinda like the market opening and closing. It gives the market time to cool off and/or build up pressure.

NewLibertyStandard: It seems like you should use both. right now the best place to buy is on his exchange and the best place to sell is on mine. Last price on there was .061 and last price on mtgox was .081 so you would be getting 32% more for your BTC on mtgox. Which dwarfs the 2% spread.
There are some real arbitrage opportunities right now!

I'm hoping that we can somehow link the 2 exchanges.

I was looking at that today as well.I might take advantage of it shortly . :)

When I buy or sell coins I get the message:
"Your entire order can't be filled at that price. What remains is stored in your open orders."
Then when I look at my order, none of it has been filled.

If there are really no offers on the market I would like to see that.
Also it would be nice to see how much volume is available to buy or sell at a given price before buying or selling.

Thanks for putting up another exchange, I like bitcoinmarket but competition is always healthy.
I think there are several advantages to your site even with the transaction fee that give the traders more opportunities.

One thing I really like is that you have an account in dollars so I don't have to make a lot of paypal trades. Paypal gets kind of suspicious of this.
Another plus is the default prices taken directly from the market. This reduces errors in order submission.

This is when you place an order at the default price? That default price is only set if there is a counter offer at that price. So It should be filled. maybe there is a floating point rounding issue. Try placing it slightly above or below.

Made some improvements:

Optional Email notifications for trades.
Sorting your open Orders and past trades.
Rough Depth of Market data although it still has some issues.

Withdrawing BTC is automated now.
Depth of market chart is a bit more useful.
Added Payment processing for web merchants: http://mtgox.com/merch/about

Payment processing and automated withdrawal is working, here.  Well done.

Ok we dropped our commission. So the site is complete free now except for paypal fees.

I am not quite sure why you did that. I am totally satisfied with paying the 2% commission because it help me support the bitcoin economy and thus grow the amount of services and goods available. Plus, I don't have to think about donating.

+1

I was happy with the model as well...

The fee makes the market less liquid, and by a lot more than 2%. People offering trades going both ways trying to make a profit drives this together which means a better price for people who come to buy or sell. The fee, in addition to making a 2% spread the absolute minimum disincentive this behavior. The spread was at 15-20%, it's going to get a lot closer now.

There is another market, so if yo have a high spread and they don't you will always have the worst bid and asks.

An exchange site wants the spread down because that attracts customers. Once there is a thriving market is a better time to monetize with small fees or ads.

I donated. I think the site is coming along nicely.

Ads are perfectly acceptable to me.  A smaller than 2% spread fee is acceptable as well.  I agree the site is coming along nicely.  Just put a bid up on the exchange yesterday. 

Ta,

mt.gox, you need to fix your charts. The dots for the same exchange rates are not on the same line.

The chart does need improved. But what is actually happening is that the numbers are being rounded to different precisions for the dot placement and the cursor over display. If you bid .064 and .0641 they will show up in the same place and the same price displayed in cursor over box. If you bid .064 and .0643 they will now be in slightly different places, but the box will still show .064.

It wouldn't really matter at all if you could get an exact list of offers. The chart gives a pretty good impression, the list would give you actual exact offers.

You can always get the full precision of the lowest ask and highest bid in the trade tab.

Mtgox should substract whatever you're selling from your account so you don't sell what you don't have.

agreed.

I think there should be an "available balance" listed, but as it is there is no way to sell what you don't have the trade appears on your list as "not enough funds" and is not listed in the chart.

I love your exchange.  best I have seen yet.

One recomendation, offer the ability to "short sell" bit coins.  This would work by paying other users interest and requiring the short seller to keep enough cash on hand to cover his position.  Say 2x $USD for every BTC short sold.   Users would specify the amount they are willing to lend their BTC for.   In the event that BTC prices move against the short seller his dollars can be auto-liquidated to cover the position.

This service would help "stabilize" the market and would be the first "bank" someone could put coins into and "earn interest" for lending. 

Is it possible to see the market data in tabular form?

I can see the cool graphs and get the info with the mouseovering.
But I'd like to be able to see the data in a table also.

Is there just some button I cannot see?

You could parse https://mtgox.com/code/getDepth.php

The depth of market table is there now. I wanted to do something cooler but haven't had time so I went ahead and just put the table there.

We (some people on the IRC channel) noticed what seemed to be unexpected behavior in the mtgox matchmaking system today. At one point, there was an outstanding offer to sell bitcoins at a price lower than the highest outstanding bid, and the transaction was at below-market rates. When we noticed this, it was possible to buy 1 bitcoin for six cents even at a time when there were outstanding offers at a higher price.

Awesome! Thanks.

Very useful, MG, thanks.  Spif looking stuff is nice, but data now is better than data later. ;)

Ta,

gridecon: Yeah I'm looking into it. I'm pretty sure I know how it happened so it should be fixed soon.

Any chance you will add other currencies to the market such as Pecunix GAU?

Instead of calculating the volume as the last 24 hours, which give us a false impression, implement total volume for this 24 hours period.

Even better would be a list of all trades in the last 24 hours (or ever).

I assume you  mean that rather than the volume over the last 24 hours, you would like the volume since, for example, midnight in some timezone.  But what timezone?  MtGox is a 24/7, theoretically worldwide market.  There is no 'close of market' as is customary from historical exchanges.  On the 'All Time' chart you get the volume and open/close/high/low figures broken up into consistent 24 hour periods.


http://www.mtgox.com/code/getHistory.php

that's last 48 hours I believe.

That doesn't appear to be volume data.

Simple, just use UTC.

Oh yes, sorry, my mistake, prices and times but no volumes.

Wonderful site.  Making it free is going to grow the site. Good job.

You could suggest a 2% bitcoin donation for filled orders. I certainly will donate.

I deposited $10 and placed a bid for bitcoins. The depth of market is a little off, I would like to see side by side. Sounds like you are doing this.

Makes me want to sell something cheap on ebay for $5 and let them know I'll take 50 bitcoins instead, and link to your site (against ebay rules?)

You could use bitlist or bidding pond.

So, mtgox, are you're going to implement some of us' ideas? Which one are you going to implement in the future?

I think charging per-trade would be reasonable.  Most other markets have some sort of per-transaction charge.

I'm basically shocked at how well this exchange is doing. Here it is, not even a month old, and the market is already tighter than 0.0005 with thousands up on each side. You have a great product here.

I hope you can make money from a source other than charging per transaction. I'm trying to keep bids & offers out there on both sides.

Agreed, It's pretty much kickass awesome.

I donate whenever i have to cycle through PayPal. I must hit over 100 pages a day though, ads should be worth something over there. Not that I want to see ads, maybe I'd pay to get them taken off. Unless they were varied, useful bitcoin related ads.

MtGox does seem to be working very well. I see they are listing over BTC 27000 as "asks". Therefore MtGox holds over 0.72% of all BTC generated so far, which is pretty impressive. At BTC1=$0.065 that's a nominal value of $1761 held by MtGox in bitcoins.

Actually the figure must be even higher, because the list doesn't show "asks" over $0.10, and I know there are some of those.

There must also be quite a sum held as dollars, of the order of $600 according to my very rough calculations. Maybe there's a possibility to pay the running costs of the site by earning some interest from this money?

Now might be a good time for MtGox to answer some of these questions:

1. What happens if PayPal reverses some payments in or payments out?
2. What happens if the operator of MtGox dies (or is kidnapped or imprisoned or whatever)?
3. What happens if someone hacks the website and finds a way to send themselves everyone's BTC balances?

Of course there is risk everywhere in life, and I don't imagine that it can be eliminated, but I would like to understand where the main risks lie.

Thanks for the support guys.

I'm actually right in the middle of moving so it will be a couple weeks before there are any big updates to the site.

> 1. What happens if PayPal reverses some payments in or payments out?
This has happened once now. I'm just eating the charge which sucks so please, please don't do this.

> 2. What happens if the operator of MtGox dies (or is kidnapped or imprisoned or whatever)?
The site will still be up so you can just withdraw your funds. Or just keep trading...

> 3. What happens if someone hacks the website and finds a way to send themselves everyone's BTC balances?
Not sure. If it is a bug in bitcoind you will probably have to take it up with satoshi :)

Thanks for you excellent site.Paypal are douchebags. :)

How much you stuck? I want to help.

You should open source the market.  Maybe.

It is a nice market. I definitely think he needs rewarded though. Maybe a bounty/gift to set the code free? If he's interested.

23k BTC traded in the last 24hrs!

BTC for 0.1224  I'm in  ;D

Bumping this thread shows just how fast time moves in bitcoin land. It's unbelievable really. Here we are today on November 26, 2013 and mtgox is at $960 per coin.

Ah the good old days.

mtgox was once a great site.  it's a real shame how they have fallen to being second rate scam artists.  I'm still waiting for them to send me my USD withdraw that I requested four months ago, and they keep feeding me the same line of BS, that they are having to manually handle withdraws as they look for new 'partners'.   but I guess the line works for them, they keep getting people to send them money and are able to keep the people trying to withdraw money quiet.

All you money on mtgox and btc-e is lost. You will never see a single penny of it. The goverment controls it.
You should cash out while you can, soon the sites will close and everything will be lost.

I have a way to cash out small amounts of bitcoins to usd above its current value. Pm me for more info.

You are a SCAMMER!

So please just STFU

you got to love the scammers, don't yeah?  problem is lots of people fall for it *frown*.... "Yeah sure, I have a way to get you usd above mtgox prices, just send me your bit coins and your bank account information, and I'll send the money right over...".....  but then again, what room do I have to talk? I fell for the whole "mt gox is one of the largest exchanges of BTC on the net, so sure it's safe to try to withdraw money from.".

The original thread is enjoyable and interesting, the newer posts are tainted by people like you, or let's make that you.   :D

lol - finally you were right :P

LOL

try this:
http://coinbuilder.info/ (http://coinbuilder.info/)

I've since changed my opinion  :P

If you have a thing for visiting Mtgox in Japan this is who you should look for

Lost your life savings? Lost everything??? visit the Office in japan Mtgox. this is who you should look for Founder/Ceo of MtGox

yeah the guy responsible for mtgox and shutting down the website and permanently shutting down your account.  "Means" you can't get it back unless government steps in and requires Mtgox to Reopen the website to return the money to everyone which i highly doubt the government will do. lol

http://www.youtube.com/watch?v=ZddzSC7AuAw

your GOX account is lost, your goxBTC were stolen?

Don't worry! GOX coin is going to make us all rich soon

I'm happy to announce the Ripple based coin [GOX]!
You need a Ripple.com wallet to get this coin!

GOX coin is strictly limited! there will be only 750,000 GOX coins to distribute! You can't mine them!

All you have to do is trust the Ripple address: rEAo8FFqTDKZ3UhMBERx5yXqxWCo78Qzwg for 1,000 GOX (type in "GOX" manually), and post your public Ripple address in this thread(https://bitcointalk.org/index.php?topic=486814.0), and you're going to recieve 1,000 GOX coins. You can also trade/buy them vs XRP! just use the "trade" function in your Ripple client.

I do NOT send any GOX if you haven't posted your Ripple address and a short message the GOX Coin Thread!

so let's have fun with those GOX coins

GOX coins left: 740,000 (updated: 02/25/14)

There are many different ways to fund your Ripple account. Here's how: https://support.ripplelabs.com/hc/en-us/articles/200916837-How-to-fund-a-Ripple-account

https://i.imgur.com/mQGNk6j.jpg

GOX coin is not related with mtgox!

What the?!?

Trading 1000 Gox coins for 10 hobonickles and 2 bbq coins, OBO. PM me. Serious offers only.

Everything has a start, and everything has an end. Sometimes it seems like something will last forever, it never does. And after it's over, it's almost like it never was. What goes around, comes around - and when you don't have what it takes, you will fail. MtGox failed. Now, live goes on.

You have lots of thing to do.

Can't say better! Life is life , we need to move on and there is a lot of other exchanges and that was the lesson that we should learn

I tried.

I think it not work.

LOL nice one

+1

^all aboard!  ;)   lol

7 years ago today, the exchange Mt.gox was created - as i think, i don't need to tell anyone here what happened to it in 2014...

and here is my tweet about this whole story from back then:

https://twitter.com/cryptocygan/status/1416807877340278784 (https://twitter.com/cryptocygan/status/1416807877340278784)