Bitcoin Forum

I run a company of a little over 30 people.  We recently have stated accepting bitcoin as payment and ran into our first security issue recently.
It then occurred to me how incredibly difficult it will be for companies to manage their bitcoins.
With bitcoins,  it just takes one honest mistake,  or one dishonest action by any single person in the accounting department who has access to the bitcoin wallet to lose all of the bitcoins.   Many companies need hundreds of thousands or millions of dollars in checking accounts to take care of ongoing company expenses.

What steps can companies take to prevent one employee from transferring all of the money away?

What steps can be taken to prevent an accountant at Microsoft for example,  from stealing $100M worth of bitcoins in one shot?

Please give me your thoughts on security measures that companies will need to take to prevent the theft of all of their bitcoins.
Having the owner handle every single transaction personally is not practical for organizations of any size.
In order for bitcoin to become mainstream,  these problems will need to be solved.

Don't have all of your bitcoins in one wallet, for example.

use a php front-end to bitcoind.

I think all of these problems could be solved with a Bitcoin bank, or maybe even just an online wallet service. Remember, Bitcoin is just like cash. No company would let its accountants alone in a room with all of the company cash, and so too no company will let its accountants have access to the primary wallets of the company.

This is essentially the same thing as the online wallet service idea, but could be done with less regulation.  Instead of a banking services script, you would have an accounting script.  You could have a super secure server hosting the accounting script, and your only point of weakness would be IT.  That is always a weakness, though...

Generally id have a 'savings' wallet somewhere far away under lock and key.
then a liquid wallet, likely a wallet website or if you trust your sysadmins, a local server.
then below that, individual wallets for different parts of your organization.. recieving, payments and so forth...
then an interface to an address tied to a individual employee who has permissions. as state, php or something, request a billing address from recieving wallet, and its provided, associated with that employee.
for payments perhaps a transfer request, then authorized by a higher up.

For non automated systems never have less than 2 people's signature on a payout.. that way you wont have a single person who can do something stupid or criminal.

You can always outsource it to a separate company, most likely a bitcoin bank.

I wrote this on July 13, 2010 about a system for companies to use bitcoins but no one (zero people) replied.  Maybe it is time to develop software for companies to use bitcoins.

http://bitcointalk.org/index.php?topic=329.msg2651#msg2651

@Memorydealers
I'd love to hear how you plan on dealing with issues described in http://bitcointalk.org/index.php?topic=8315.msg122561#msg122561 since you honestly seem to be considering BTC use.

Some form of accountability needs to be taken since bitcoin is anonymous by nature.
As stated earlier, maybe some for of front end (php) layer over the wallet itself. Have a user account system in place. That way if all of your coins disappear you know who the liable party is and can take recourse.

I'd also never leave all my eggs in one basket. BitCoins are essentially cash. I don't have that many. But I have 2 main wallets. My 'savings' wallet in on a encryted USB drive that I only connect with once a month to sync up blocks. I'd advise the same. Or some form of legit online storage.

Unless someone decides to write some accounting software for a profit, it will be developed when the community needs it enough to attract some developers.  One of the issues right now seems to be that many of the small business owners (like myself) are driving the software development.  Medium-sized business owners with more complex problems can't just spend a couple hours a day and write the solution.  They're also less likely to have a software skill-set, as management becomes more specialized.

I think that the best approach to this is to post a bounty.  I would put some BTC up for such a product.

I agree completely.  For business of any size to use bitcoins for day to day transactions much better (more fool proof) software is needed.  I am constantly concerned that I will inadvertently do something that will cause me to misplace my coins.  Despite the fact that I have a good deal of computer experience am comfortable with my computer systems the concept of having a file on a flash drive that is worth several thousand dollars regardless of how many backups I have is a bit freaky to me.  I can see how someone with less trust and understanding of computer technology would feel very nervous about handling money this way.

I imagine software that lets your employees queue up transactions and attach a note and then you or someone responsible logs on and sends the batch out.

You current set-up may not be optimal if a single point of failure would be catastrophic for the whole organisation. Bitcoin may just be forcing you to think about security of funds flaws that were already existent but unrecognised.

Here's a radical idea, organise your company into quasi-autonomous cells. Each cell has specific area of business but manages its own affairs (including funds). You can afford a failure at one cell.

Or wilder still, start your own bitcoin bank? You seem to be running ahead of the pack and if you need it someone else may need it too.
 

How will Bitcoin work when refunds are not allowed. IMHO that is not good and will slow adoption.

Refunds are "allowed", they just do not have a third party controlling when they are applicable. We'll have companies just like paypal that acts as an intermediary, only for your bitcions, so they can act as escrow and control refunds, if necessary.

People hate paypal because they have such control over your money online, but a third party controlling refunds/cashbacks can be useful. We'll have these businesses with bitcoin as well I assume, but the important thing is that when you take away that third party option or if they shut down your account, you still can pay someone online with your own wallet of bitcoins, which isn't something you can do if paypal blocks payments and you have no other way to get money online.

the big problem with paypal is how they handle freezing...
instead of waiting for one or the other to claim foul... they instead just freeze arbitrarily.. or when they feel their tos is in danger.. A weaker TOS and instead of freezing but just returning and saying "no" would be the better option for an escrow.

Bitcoin doesn't allow chargebacks in the exact same sense that the dollar doesn't allow chargebacks. You have to build something on top of the dollar, like PayPal, to do the chargebacks. If people want to pay for it then someone will make it for bitcoin.

yes.. bitcoins are not credit, they are digital currency.
Its true weve gotten far too deep in to the credit industries pocket and weve forgotten what currency is.

If that much money ($100m) is involved, bitcoin banks will take care of it.
I mean a real accountable registered bank.

You could say the same thing about banks today, whats to stop an employee with the right level of access and know-how from wiring all the money to some offshore account.

There probably should be an enterprise client, or rather an enterprise system for handling bitcoins. Every large transaction would need to be approved by upper management.

it's open source, just find programmers and they could code whatever management you like...

at the moment make separate wallets for every dealer you have

It's possible to create transactions that require signatures from several different people to spend. With some extra coding work, you could set up Bitcoin to keep (say) 500 BTC liquid and spendable by anyone, the rest would be automatically locked such that signatures from 3 different people were required to spend it.

That feature isn't available today, but it might help in future.

There should be a program written that allows you to manage  Bitcoins securely. maybe even get them on flashdrives for small wallet like stuff. there should be a way for bigger companies to manage their  bitcoins but it should not be centralized like a bank.  The whole idea of  bitcoins is a decentralized unmonitored system. If  bitcoins, or private organizations started banks, then we would have similar problems to the current Monetary Economies. Not to mention if someone cracks  Bitcoin or a 3rd party company for banking. then there go your Bitcoins. I think a program should be written to have o n your private computer that cannot be accessed through a 3rd party source. like a safe?

Just thinking out loud, and I am no programmer, nor do I own such a biz, but it would be nice if a hypothetical BTC Enterprise client allowed you to store your BTC's P2P under conditions set when you store them. So if I had a business with some incoming BTC, I could set that I want to store them (or at least catalogue the freezing on spending the designated BTCs) in the P2P cloud (which perhaps is perhaps comprised of all the other Enterprise clients) and only be allowed access (or the ability to spend the designated BTCs) should certain conditions be met (perhaps 3+ of some set of designated clients, confirming). Obviously there could be other conditions set. This would lessen the need for BTC banks. I wonder if you could also in this way make time based deposits, so one condition being your deposit could be lent out to the market, for a fee, and you could not withdraw/spend until a certain date. Anyway my $0.02, er 0.02BTC.

Most of the issues surrounding using Bitcoin also apply to cash handling, and I expect the solutions are going to be similar.