Bitcoin Forum

Hi Miners,

BitcoinOPX.com (https://bitcoinopx.com) has recently opened and I wanted to make sure everyone knows of a risk free way to earn 7%, for example, monthly returns on your coins.

This is possible because of the value options provide asset holders who are most likely planning to sell. Below is a great example provided by forum user waltmarkers in a speculation thread (https://bitcointalk.org/index.php?topic=81681.0):


The example uses 1000 coins but BitcoinOPX allows creating options of sizes 10 or 100 as well. The 7% return would apply in any case. I'm happy to answer any questions. :)

If you want to appeal to miners, many of whom are not traders, and many of whom are not native English speakers, you might want to start by explaining the terminology. What is a call, what is covered,what does "in the money" mean, etc.

Exactly. I am a hardware guy not a finance guy. Walk me through the math and we'll see if its interesting.

I agree with the above miners. If you could use C++ or at least PHP to explain it, it would be great!  ;D

Hmm, can't I just say trust me it works! ;)

Seriously, options are hard to understand in depth, but I'll try to give the basics. Below is the option example given on our site:

Imagine a home buyer finds the perfect house for $300,000, but his loan won't be approved for one month. The house seller might write an option contract giving the potential buyer the right to buy the house for $300,000 one month later if he so chooses. The house seller sells this for $1,000, figuring he wins either way because he wants to sell the house. The buyer gladly pays $1,000 for the contract locking in the price.

Three weeks pass and the buyer learns his loan is declined, but the house he holds the option contract to has doubled in value to $600,000. This means his contract is worth $300,000 of savings to someone, and he can sell it for a tremendous profit. This can show the power of options.

Call and Put Options

A call option gives the holder the right (but not obligation) to buy the underlying asset at a set price. A contract holder will likely exercise this right if the market value of the asset is at or above the contract or "strike" price at maturity.

A put option gives the holder the right to sell the underlying asset at a set price. Put options are likely exercised if the market value of the asset is at or below the strike price at maturity.
_________________________________

Okay, so that's the basics for options. Now, in terms of finance and Wall Street we use terms like "in the money", "covered" etc.

You have to understand options in Wall Street finance are traded mostly for speculation, not investment, and you get these shortened phrases like "writing a covered call". Writing an option means you are the person creating the contract. The option is "covered" if you also own the underlying asset of the contract.

This is what miners should do, because it is a risk free way to make money.

Think of the home owner in the example above. Do you think it was wise for him to write the option contract and pocket the $1,000 since he planned on selling the house anyway? Of course it was. His only downside was not predicting his house value would double. Of course, the value could have went down too, but in that case he looks even smarter because he still has the $1,000 plus the house which he can still sell later.

Now, imagine he is actually a home builder and will be in this situation every single month. Doesn't it make sense for him to write and sell option contracts for added fixed income? It does from a mathematical point of view if prices rise and fall (he keeps the option proceeds either way). He only loses out if the home values always increase substantially and never drop.

Make sense?

BTW in-the-money means the contract holder has a positive position because the market value of the asset is above the strike price of the contract. In the example above the option on the home is in-the-money from the time it's written on forward since it never goes below $300,000.

It only generates a password,  I cannot set the password myself.  it is a ... 9 character password.

For sites where my funds are stored, I only trust as being strong a 12 character or more password, which I create using KeePass.

Can't I be trusted to provide my own password?


 

Our site is highly secure. Security experts agree a password at least 6 characters long with a mixture of upper and lowercase letters numbers and symbols is very secure. Our generated passwords meet this criteria, but are at least 8 characters long. Such a password is impossible to guess.

There are two other things that make this secure: 1) The site allows only 7 login attempts before locking the user out so brute force attacks won't work. (otherwise brute forcing would take over 200 years to crack) 2) We use two-factor authentication which means an intruder must not only get the password right, but also your security answer to your security question.

If interested please also check out this informative article on password security:

http://www.baekdal.com/insights/password-security-usability

We don't allow users to set their own password to ensure they don't use a weak one, and also to ensure it's not duplicated from their other Web accounts. You may have heard LinkedIn and Last.fm databases with passwords were recently hacked. This makes all user online accounts vulnerable if they used the same password.

Excellent new service.

I understand where you are coming from, and I'm not saying whether it's right or wrong.  But I do have a couple comments:


Stephen's concern might stem from the security of your database, not the threat of a brute force.  Let's say you're hashing the passwords (which I hope you are, with two salts) and someone gains access to your hosting server.  Your salts and methods are now known and you're safe in the mindset that it would take 200 years for a powerful computer to crack it, while the hacker has spawned several thousand EC2 instances and has cracked half your database in less time that it takes for you to even detect the intrusion.


You are causing users to write down (or worse, save in a text file on their desktop / in their email) this password.  Also, you can not guarantee that users will not set other accounts to the same password as yours.  You security is now only as strong as your user's personal computer / email address.

I really like the idea of the site it's easy to read and I get the information I'm looking for immediately, and I commend you for your position on trying to protect users from themselves.  However I'm not convinced you're going about it the right way.  You might find it more user friendly to just enforce password restrictions (length / alphanumeric / symbols and any other rules) and call it a day.

Wow... talk about not understanding security.  This post alone scares me away from this venture.

Hint: Security questions are not 2FA.
Hint: 6 characters are not enough.

No. Nno. nononononononooooooooo. NO!

Let me guess. You are using MD5 to store passwords, yes? Because some site said it was secure?

@lemonz: I'm happy to discuss and clarify security procedures :)

First, I have to say I didn't directly address @Stephen Gornick's password concern. He stated he only feels secure with a password length at least 12 characters.

This stems from incomplete information about secure passwords. He may have heard a longer password is more secure, and this is generally true, but what's missing is when it makes a difference to use a very long password.

It only makes a difference if the attack method is brute force. If you are trying to secure your computer's hard drive with TrueCrypt because you don't want the government or anybody else to be able to access the files then yes password length becomes an issue. That's because the attacker/cracker is working mathematics against you, betting he can use pure computing power to brute force crack the password and thus password entropy becomes an issue. A 12 character password versus a 50 character password can mean the difference between them succeeding in 10-20 years or not for at least 100 years.

But that's not the use case here. As I mentioned brute force attacks are not available to attackers because we only allow 7 tries. That's it. It doesn't matter how strong the attacker's computer is, or number of EC2 instances (which cost money by the way) they have. It takes pure luck to get the password correctly guessed in 7 tries. It is simply a statistical impossibility.
______

Last, you mention users writing down their password, possibly on their computer. It's true that a password is only as secure as the person guarding it. For example, the article I linked explained a top vulnerability being simply asking a user (in relation to something else) what it is.

And still nothing is vulnerable to a malware installed keylogger, whether the user creates a super strong password themselves or not. And whether or not they are careful with it or not (memorized only etc.).

That's why we include two-factor authentication. Even a completely compromised password will not guarantee account access.

@Inaba: Asking for a second item for authentication is indeed a second factor.

I didn't say it's what is typically used. It's true that stronger TFA would include something in another category, such as something physical the user has.

Second, security involves context. You say 6 characters are not enough. But it what context? You are saying you know a way to crack a password that is a random 6 characters of upper and lowercase letters, numbers and symbols in no more than 7 tries?

@rjk: I'll ask you the same question. You're saying a random 6 characters of upper and lowercase letters, numbers, and symbols is NOT secure from being guessed in a maximum of 7 tries?

Nope. As has been demonstrated in the past, bitcoin-related services have been hacked repeatedly, resulting in the compromise of user passwords. Even with hash+salt, a 6 character password really isn't that hard to retrieve.

The reason I am making something of it is because I am certain that the policy of a generated password with no way for the user to change it is going to result in usability issues, namely that of people not bothering to use the system because they have to write down or remember yet another password. And then you might make a change allowing them to edit their passwords, while allowing 6 chars to be the minimum, and that would be bad practice.

Sure, your method is reasonably secure, but it isn't user friendly.

EDIT: Also, http://thedailywtf.com/Articles/WishItWas-TwoFactor-.aspx

@rjk: we may have been talking slightly past each other.

I never said a 6 character password is impossible for a hacker to figure out if they are successful in hacking into a database and then using brute force to retrieve that password. It's not obviously, for reasons as I explained about password entropy above.

What I said is that security experts agree such criteria is regarded as secure.

I'm sure you agree that security is relative, and people to this day honestly use dictionary words like "love" or even the brilliant choice "password".

What I was trying to say is that at a minimum the threshold to begin to enter the realm of secure, especially in the context of the above, is using at least 6 characters which are random upper and lowercase, numbers, and symbols.

Again, regarding the two-factor authentication, yes, I know it's not the strongest possible, but it is an additional item.

Regarding usability, we've done our best to maintain a balance of security and usability. We think that users will indeed write down assigned passwords and not be put off by the requirement when considering security. Users can indeed request a new password anytime, but they can never choose it. And we would never use a password less than 8 characters whether assigned or not.

Oh boy...


If an attacker was trying to brute force your login, you would be down due to a denial of service long before they got in.  That wasn't the original concern raised.  It seems you missed the point about someone getting a copy of your database.  This is where the brute force will take place, and your 7 tries logic doesn't do anything here.



That is good!  But without knowing the implementation, I have to assume the worst: that this two factor auth is stored in plain text, with maybe a LIKE query to match for case insensitivity?  Remember, if the database is compromised, the attacker has everything.


I'm very aware EC2 instances cost money.  I pay a bill every month ;)  But hackers will generally use stolen credit cards to pay for these services, so the cost isn't really a concern to them.  And even if they did have to pay out of their own pocket, they are betting that the reward of getting into your users accounts, and accessing their $ / bitcoins is greater than the investment (which it would be).

Again, I think you've got a great service here... I'm just not comfortable with the implementation, and I think I'm entitled to that.

That's was a good laugh.

Look, we all already know that you have no idea what you are talking about. So I have a suggestion for you. Stop arguing. Shut up. And listen.

- Start with abandoning that silly notion that you can lecture people who posted in this thread on infosec matters.
- Ask them what you need to do on infosec.
- Listen and implement the reasonable suggestions.

For starters I have a few quick suggestions (others will add to it, I am sure):
- Let users to chose their own passwords.
- Do not accept ones that are less than 12 symbols and do not contain lowercase, uppercase and digits.
- Use proper salting and bcrypt or some variation of thereof for hashing.
- Move away from any form of cloud computing, some dedicated servers are a good start, but do look into colocation options.
- A good litmus paper here would be ability to have properly encrypted partitions (all of them). If you cannot do it and do not need to enter the password in order to decrypt those during system startup, chances are you are doing it wrong. (BTW most hosting providers you kids are using these days will not give you this functionality).

There is more, but this is a good start.

107% return per month results in 225% ROI per year.

My 3x7970 rig already does better at 241% ROI per year after cost and depreciation if the exchange rate stays constant.

Actually this is not the best option for me. A 5970 setup would result in ~300% ROI for me. I didn't choose this as I was hedging against the risk of reward halving making HD5xxx worth little to nothing.

+1

Also, while good sercurity is always a great idea....

The security of a site does depend on how much you are storing/moving with it.  Storing 50 BTC and you can afford to loose it?  Maybe a basic dedicated server will do.  Storing 10,000 BTC + and know that the BEST OF THE BEST are going to be attacking you.  Anyone working for you hosting/colo company can be working against you. 

I understand your financial concept and I find it really interesting.

BUT

As others mentioned, review your security method. We are hardware and software guys here. We maybe have difficulties to understand finances correctly, but we swim in network security everyday. I personally always use random passwords of around 12 characters that I generate myself with some software I own. I'm a sort of maniac that put different passwords everywhere.

We are ready to help you secure your project, ESPECIALLY if we invest money in it. If you agree to review your security method, I'm sure you'll find a shitload of good advices to enhance security.  :)

unfortunately, on bitcointalk good advice comes with a bit of exaggerated ass raping. 

Is there any volume?  I see no bids or asks on any contract.....

I've made an account, to try it out. I'm a newbie in those sorts of thing, and all this seems as easy as making a worldwide speech in japanese.

So, here's my real life situation. At the end of the month, I'm going to sell 300 Bitcoins. I'm mining them right now, and they are going to be sold. Let's say you want to teach me how to use BitcoinOPX for my first time knowing that I'm selling 300 Bitcoins at the end of the month, what do you tell me?

Call me oldfashioned, but even before I look at the security "conversation"

Who are you? I don't entrust my BTC to random internet nicks with only an email for contact.

Where are you based? are you a registered company in any jurisdiction?

You say "We" who are the other people involved?

I see you are hosting in Panama, are you on a VM or a dedicated server or your own server colocated?
After the Linode experience, I hope the last.

And on the security issue, you do realise that the other thing GPUs are really good for apart from mining Bitcoins and playing games is password cracking?

Look, 6 chars is enough to prevent a remote brute force (since only 7 tries are given), but it is not enough if your database is copied (since billions of tries are given).

Even you admit this.

It doesn't matter if you think that 6 char passwords are enough, the people in this thread are your potential clients. Concede, and give them what they want, even if it doesn't quite fit with your view.

This is the most important part of this whole thread, where did you come from and why do you suddenly want people to deposit money with you?

Why would anyone want to crack the passwords if they've got the database? Passwords are random, so they're not of use anywhere else. (Maybe they have the passwords but can't access the wallet though. Can happen.) Also I'd expect 9 randomly generated characters to be far better than 12 character user provided passwords.

Having said that, I'd comply with the demands. It's hard to prove people wrong on this matter and it is bad for PR.

EDIT: I'm more interested in security matters like how you store the coins and what my options are if you disappear tomorrow.

6 character passwords have a huge benefit: when a user forgets his password it can be computed from the hash within a few seconds.
<sarcasm off>
Frankly I stopped reading this thread at this point - it seems that these days even hobby sites are more secure than some financial sites.

Im no security expert so I will leave the password hashing/salting/cracking to others

I do however have some questions about the finance side of your business: the counterparty risk

In the absence of a central clearer, the margin system you are proposing seems to skew the risk of the options contract to the buyer instead of the writer of the options....

as is stated on the website, margin calls will go out to writers of the options if the initial margin isn't high enough to cover the outstanding amount owed. This is completely natural, but there is NO way for you to enforce people to actually post more collateral, hence you state that in the event the writer of the options fail to post more collateral, you will close the options and payout to the holder, ie buyer

This basically means that a seller of the options can choose to default and never be on the hook for more than his initial margin, while the holder of the option is left holding the bag: counterparty risk

for example: someone sells me a call, strikeprice 6, maturity 2 weeks. He has to put up 15% margin, 0.90 $
Now the price of btc shoots up overnight to $8 (stranger things have happened) the seller has to put up at least $1.10 more as collateral, and probably much more as the volatility spiked. He now thinks to himself, this could cost me more money than I expected and declines to post the collateral. You have no way to enforce him to pay up, so you settle the option with the amount of money that was put in as the initial margin, $0.90

I now am left with a much smaller profit than I expected and have no more exposure to btc, which will cost me now more premium to get back on as the volatility has risen as a result of the price jump

That is why regulated derivatives have central clearing houses and OTC markets see their particpants in heated discussions at the end of the business day to agree on the amount of collateral that needs to be posted

edit: such a nightmare to try and post something in this forum from my Samsung Tab !!!  :P

Seriously?  To log into the accounts and withdraw the funds ($ and Bitcoin) from the users.  

I think the link that you're probably missing is that passwords are (or should be!) stored in the database after being hashed by a one way algorithm, not in plain text.  This means that by just having a copy of the database, one couldn't log into a users account.  You would have to start using the same hashing algorithm that was used to create the hash, and start hashing random strings, until you find a hash that matches one from the database.  For each match that you find, you can gain access to a user's account.

Hey BitcoinOPX.


How does your marginal system works? How can one be sure that the other party actually pays, and that BitcoinOPX doesn't go default?

I had to spend significant amount of time in discussions and getting advice from people with finance educational background to figure out how to build one for the ICBIT futures market.

I wonder how you solve this problem.

As they state on their website: if one defaults on a margin call the option position is closed and the holder of the option is being compensated with the amount of collateral that was posted... so the counterparty risk is not on BitcoinOPX but on the buyer of the option (or at least that is how I read it), see my earlier post

Ah, I was mostly focused on the "passwords are now in the open and they might get cracked in the future" scenario. I don't think it is realistic to assume that 9 character fully random passwords can be brute-forced in a practical amount of time, with the assumption that they are properly stored (bcrypt, PBKDF2, etc.), though I don't think salting is actually necessary. If they aren't properly hashed, then there is still no sense in debating password length. I'm not vouching for the service or anything, it's just that 9 random characters instead of user-supplied passwords is not a bad idea by itself, which seems to be the main reason you feel the site is insecure. We can move the debate elsewhere though, all this is probably off-topic.

Your miners are irrelevant; the ROI he is talking about will be in addition.

The only thing you give up is the increase in value if the price rises to more than the strike price. Else, it's just free money.

Essentially, you are selling your promise to sell a certain number of bitcoins at a certain price. Say, 10 coins at $6. The person you are selling your promise to can choose to call you up at anytime until the expiration date of your promise with the $60 and you'll have to sell 6 coins to her at the $60, regardless if it's $2 or $10 at mtgox at that time.

Of course, she'll not call unless mtgox is more than $6.

It wouldn't be a bad idea to get a copy of the Characteristics and Risks of Standardized Options. It is free and would give a good outline of how options in general works, and the upsides/risks involved.

9 characters is NOTHING, in past ventures with only a couple of Nvidia GPU, one was able to brute force WPA2 encrypted handshakes with 10 character pass phrases in about 36 hours only doing passwords in the Kilos per second range.

My current mining rig can do about 3 Billion SHA256 hashes per second.

People really need to stop taking the "Hacking" they see on TV as the way it is. (Two hackers do not use the same keyboard to try and counteract a hack..LMAO)

No hacker is brute forcing the front end of a web site (7 tries is in reality kind of loose, most high security systems lock out after three, requiring contact with a systems administrator to reinstate.)

Most successful hacks are in the form of social engineering (Easier to have the owner/user hand you the keys than to pick the lock).

After that, most breaches are a result of exploiting un-patched software, finding a 0 day exploit or even something as simple as default user/password combos not being changed.

Once one has access to your server, it is just a matter of coping over what they want, and break the encryption on the database, file , etc ... locally with their multi-GH system.

That's why hash functions better fit for this purpose exist. (EDIT: Hmm, apparently WPA uses PBKDF2, but then again how on earth are you able to brute force 10 character random strings is beyond me.)


+1

Old fashioned brute force. 000000000,000000001,0000000002,0000000003..........etc......etc (well actually one assumes that the the system is using at least a 8 characters so you generally start from there, also many people use the default passwords on their ISP routers. They are random but always the same length.)

Remember, one is preforming it locally with a captured handshake sequence, so there is no network traffic or logging going on.

I remember attending a conference at a network security company recently (for the ethical hacking class I took last semester), that pointed out websites that advertise their password requirements help the hackers out, now they have parameters and do not have to use the whole range of combinations to brute force.

In fact, 7 character password you say, you just knocked the the time down to crack stolen account data exponentially, because the hacker knows the exact length of the password and only has to locally brute force that range.

Here this is how you hash passwords, once and for all people, just pass username and password, calculate hash, then either store username, salt and hash in db when creating the user or changing the password, or check against the database to do auth. Just wrap it into a function or a class and you are golden.

Want to be even more cool? Make user's browser to calculate SHA256 in browser (i.e. client side javascript) then pass it to you instead of cleartext and your servers will never even see the cleartext password in the first place (but still do hashing as above, of course).

Stop pulling linkedin thing FFS!

The above code is hereby released into public domain.

THIS SOFTWARE IS PROVIDED BY THE ME "AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE I BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Well, at cost 10 (compare to Vladimir's 15, which is a lot harder), my PC bcrypt's around 12 passwords per second. Assuming 92 symbols, you have slightly higher than 58 bits of entropy at length 9. So you'd need something 300 billion times more powerful than my PC to scan the complete range in 36 hours. Even with application specific hardware that would be impractical. Of course this assumes that the passwords are "truly" random.

The 36 hour example is when the length and parameters of the password are know.

The example used are ATT Uverse routers that use a 10 digit passkey. so the range is 0000000000 - 999999999. I usually split the range between two computers. Using a couple GPUS and the proper programs, I was able to throw around 100,000 - 125,000 passwords a sec at the packets, so 12 passwords a second is not even close to what a "hacker" would be able to do even on a normal PC.This was years ago, so GPU processing is even faster now, look at current mining rates.

I guess the main point I am trying to make, is the mistake of limiting the range of a password. One of the most valuable things a "hacker" can have when trying to crack encryption is hints on the range of the password. If he knows the length (or range), excluded symbols...etc. It greatly (exponentially) cuts down on the range the "hacker" has to brute force.

Random passwords are great, but provide no more protection to a true brute force (not dictionary, or rainbow table) crack of encryption done at a local level,with password parameters known, and the right hardware/software.
Some of the best server side password requirements allow for a large range (I suggest a minimum of 10 up to 64) of length and symbols (including the ever ignored space) and maybe a quick dictionary check to make sure common words are not used.

Even then, one will run into the human side of security. Make passwords requirements too complex and they end up on post-it's or text files placed the computer desktop.

Two-factor authorization is truly a way to thwart brute force hack, as brute forcing a password may not be all that difficult to a skilled hacker with the right equipment, once the second factor is introduced, I see it as end game- Into the realm of dam near impossible without government alphabet soup agency like abilities.

Wow, that's what I get for not remembering where I am...

Trying to defend the integrity of a 6 character password to a room full of network professionals. *shakes head*

Okay, for the record I don't endorse using 6 character passwords as general practice. I was speaking extremely generally, in other words in terms of every use case requiring a password. As mentioned I believe security involves context. Securing a neighborhood forum site is not the same as a bank. My statement was about the lower bound of password length. That's where the 6 characters came from. For a neighborhood forum or dating site or similar I don't think it's wrong to say security experts agree at least 6 random characters, upper and lower, symbols etc. regard that as secure - for those kinds of sites - whereas common words like "love" are insecure.

I should have qualified that statement. That's my mistake.

The length of 12 characters seems to be popular in this thread as "very secure", but if it's a question of securing the data against the government suddenly that length doesn't seem so adequate. That's what I mean about context.

Of course longer passwords are always going to be more secure. I would love to require 150 character passwords, but usability becomes an issue. That's the only reason for adopting shorter passwords.

I wasn't trying to lecture anyone, least of all here... I was trying to make a case and defend the thought process behind our procedures. I'm certainly willing to take suggestions on security. Improving is always a goal. I feel we're all on the same side. We are the productive side of society, not the ones looking to steal, circumvent, and hack.

Continuing the rationale of assigning users passwords, it does seem to ensure users don't use one which unlocks their email for example. They would have to change their password to ours retroactively, and it would still unlikely be one used at other sites like LinkedIn, for example.

Not every user has the same security practices. But certainly we could change to user supplied passwords if that would be an improvement.
_______________________

Next, to address very valid concerns about level of funds and our operations, we purposely look to limit fund amounts. Storing 10,000 BTC would indeed change security context. Originally, we planned to back options with actual bitcoins, and were set up to work with BTCrow.com. However, that's now replaced with a contract for difference model where only the amount of funds representing the change in price movement is posted.

In any case, no funds are stored on the site and we manually approve every withdrawal. Even if our system is completely compromised the hacker couldn't move any funds. I also neglected to say every withdrawal request requires email confirmation, so a hacker would not only need account access, but to have access to the user's email account as well.

Regarding anonymity please see here: https://bitcointalk.org/index.php?topic=84092.msg935881#msg935881

I'll try and reply to the other questions later.

Hey everyone,

By the way, yes we do salt and hash passwords with bcrypt, and we've made 12 characters the minimum password length now.

To receive a minimum 12 character password please click 'My Account' then 'reset password'.

I'll answer more questions shortly.

Regarding the comment about no options on the site yet, yes, we've only recently opened. That's what I'm doing in the Mining forum  ;)

During our Beta soft launch there seemed to be good interest :)

However, after going live with real money we have yet to see much activity. I think it's because many don't understand how to make money with options. For example, there was repeated confusion about the difference between the Trade screen to place orders, and the Create options section. I don't think that's only due to the UI. I think many people are learning the fundamentals of how options work.

Let me answer the specific question from @Brunic:


This is a perfect example. Notice he says "they are going to be sold". That means his mind is already made up about selling, which is the key benefit of what I'm talking about.

Right now June 16, 2012 say the average price of bitcoins is $6.50, and @Brunic knows he wants to sell 300 coins at the end of the month. At BitcoinOPX every Friday options reach Maturity, meaning they can be exercised/settled. So let's pick the target date Friday, June 29, 2012 as our option Maturity.

Here is the dilemma: @Brunic knows he will sell in the future, but he doesn't know what the BTC price will be then. It can be higher or lower (or the same). Without using options he would probably just buy or sell whatever the price. All things being equal he would win, lose or break even 33% of the time. Say the price typically swings 10% bi-weekly. At our current price of $6.50 by Friday June 29 the price will be either $7.15 or $5.85 (or still be $6.50).

Selling 300 coins means a difference of 300 x $.65 = $195 potential gain or loss from the current price of $6.50. By selling regardless of price as bitcoin goes so @Brunic goes, some months good, some bad etc.

Options provide an... option. He knows the price is now $6.50, and he knows he will sell, so why not lock in an additional 10% on the current price free and clear? By creating and selling options he can do just that. He can lock in a future sell price of $7.15 for June 29th, today. Here's how:

1. Go to BitcoinOPX.com and create a free account
2. From My Account click 'Create Option' to create a free option
3. Create an option as CALL, maturity Friday 6 p.m. June 29, 2012, strike price $6.50, for 100 coins (we will create 3 such options)  
4. Click 'Continue'

The system, using a formula, will calculate the amount of escrow required to cover this option. An insufficient USD message with the amount required for escrow will show, since we haven't deposited any money yet. For this option the amount is $105.99.

Since we will create 3 such options we go to Mt.Gox and generate a USD redeemable code for $105.99 x 3 = $317.97. We actually make it for $325.00 to cover any price moves while we create the option.

Go back to BitcoinOPX and click 'Deposit' from My Account and use the redeemable code for instant deposit. Next, go back and create the 3 options described above.

The 3 options will now be in your account ready to be put on sale. Under my account you will see your resulting USD and escrow balances. To this point you've spent no money, and taken no irreversible action. You can cancel the options and your balances will be updated.

Go ahead and click 'Sell to Open' on one of the options, which brings up the Trade screen. We are going to open a position. All the relevant information is already filled in except the "limit" amount, the lowest possible price we will accept for this option. Remember we want to lock in a bitcoin sale price $.65  higher than now, so we multiply number of coins which is 100 x $.65 = $65.00.

Click to send the order. If the option sells you will receive $65.00 minus a .65 trade fee = $64.35 USD in your account. Do this for the other two options. If all of them sell you will have $193.05 USD added to your account.

Notice this is approximately the $195 amount from above representing how much we gain or lose from a future price swing of 10%. What we have done is ensure we gain 10% up front.

Now let's look at what is going on.

You can withdraw the $193.05 and pocket it. That's profit free and clear.  We have approx. $318 in escrow, and 3 open positions. Each position is a June 29 $6.50 CALL for 100 BTC. This means on that date if the weighted average BTC price is above $6.50 we owe the difference multiplied by number of coins to the option holder.

Let's say Dave bought all 3 options. Here are the possible scenarios:

1. Price is higher than $6.50

Let's say the price is $7.50. This is what Dave was hoping for and the reason he bought the options in the first place. He was speculating the price would go higher than $7.15, because anything past that and he makes his invested money back plus profit. Remember, on each option he paid $65.00. So pricing from $6.50 to $7.15 means he only recovers his $65.00.

You owe $7.50 - $6.50 (strike price) multiplied by 300 = $300.00

The system will automatically settle the options out of your escrow funds. You lose almost the entire amount. The remainder is returned to your USD balance which you can withdraw anytime.

So now you are minus $300.00 from your escrow. Other than that you have all your original invested money - plus the $193.05. All you need to do is sell your 300 coins on Mt.Gox which yields 300 x $7.50 = $2250. Now take off $300 to cover that escrow = $1950. Now divide $1950 by 300 coins = $6.50  8) You get $6.50 per coin plus the $193.05 (and Dave profits $105.00 on $195.00)
______

2. Price is exactly $6.50

Here you owe Dave nothing since there is no contract price difference. You sell your 300 coins on Mt.Gox at $6.50 = $1950, and you keep the earlier $193.05. You still made 10%  
______

3. Price is lower than $6.50

Let's say the price is $6.00 Here you owe Dave nothing because CALL options only pay when market value is above the strike price. However, you still keep the earlier $193.05. You can sell your coins at $6.00 if you like, or hold them until the price rises again to $6.50, then sell, or... create more options on them!

In all cases you come out ahead, because you were going to sell and not hold anyway.

Update: Okay, we still assign passwords upon signup, but users can now also choose their own password.

To choose your own password please click 'reset password' from My Account and select that option. We wouldn't want to deny anyone the ability to use a 150 character password.  ;D

Well; getting $6.5 when the exchange rate is $7.5 is not exactly what I would call "coming out ahead".
You also miss the scenario where no one buys your contracts.

That said, interesting service, subbed.

No, don't forget you also have the $193.05.

Divide the $193.05 by 300 coins = $.64 additional per coin! In other words, it's like selling at $7.15.

As for the scenario of no one buying the contract that's partly my job. I have to make sure people know speculative opportunities are available. However, Bitcoin grows overall every day and services are added every day, so that problem diminishes every day.

But, that's not really the point. The point is you have the opportunity to ensure you collect something above and beyond any given price point. It's if the option sells, yes, but it doesn't cost anything if it doesn't. You either lock in extra money or not. You don't lose.

If BTC value goes up, obviously you do lose. You lose the opportunity to sell your coins at that price.

I meant you don't lose if the option doesn't sell.

As for the opportunity to sell your coins at a higher price, yes, the predictive timing dilemma always exists.

Options simply allow you to guarantee you get something upfront. Yes, the trade-off is that you lose out on price movement above your locked in sale price, but the point is at least you got something higher. By not using options if the price ends up stagnant or lower you get nothing extra or lose money guaranteed.

In other words it's great for people intent on selling. A bird in the hand is worth two in the bush, as they say.

Interesting site.

How do you see who has open bids/asks for the options? I don't see any volume.

You might look at cutting back to bi weekly expiration dates or monthly until volume shows up.

I'm still wondering how you are going to handle counter-party risk ?

I for one absolutely LOVE what you are trying to do.  Being a finance geek, I would love the opportunity to sell call options against my future production. 

Clearly the biggest issue you are going to face is generating sufficient volume in the contracts.  I doubt you would be willing to be the counterparty to thousands of contracts miners will sell short?

I'll answer new questions in a second. I want to explain a bit more about the motivation to use covered calls.

In the example above we say the price will typically move 10% for the term of our option. But we already locked in a 10% increase. This is to further address the concern from @P4man about losing the opportunity of selling coins for a higher price.

Look at the scenarios again. We're covered for every possible price up to $7.15. Moving higher than that is not likely since that would be more than a 10% swing. The risk is all on the option speculator. And if the price does go above $7.15 we still don't lose from our pocket, we only lose what might have been made. So there is an almost 100% chance of only coming out ahead, if the typical 10% price swing holds.

But let's say you're still not convinced. The math and logic sounds good, but your gut feeling expects a price spike. Then only use 200 coins for the option and hold 100! That way you're hedged. You get a $7.15 sale price ahead of time for 200 coins, and you keep 100 coins as a wildcard.

Your options don't stop there. Say you've included all 300 coins in writing options, and in a week the price starts shooting up. You think "I knew it, now I'll miss out on higher pricing." Here you could sell some puts! This begins to inject risk, but I'm explaining your options. Put options are the opposite of calls and you pay the difference when the market price is lower than the strike price.

Say the price was $6.50, but moved up to $6.75. You could issue a put option for the same strike price of $6.75 expiring around the same time or maybe a week after the earlier options. You make it for 300 coins. Projecting a 10% downside swing from $6.75 would be $.68 x 300 = $204.00. So that's how you price your puts. You would be betting the price wouldn't end up below $6.07 by expiration, or you start to lose money. However, if you're right that the price will only continue upward then you've gained an additional $.68 per coin, or up to $7.83 per coin before you miss out on profits from the original 300 coins ending higher than $7.15.

It's really interesting. Thanks for the great explanation! You can be sure I'll look into that  :)

allright, Ill toss you an idea I intended to develop myself, but since you already have most of the work done, and my time is finite, you get it for for free. If it makes you rich, feel free to toss me some coins :)

Instead of only trading bitcoin options, add difficulty options, so that miners can hedge against future increases in difficulty. That would allow them to invest in mining hardware without taking on the full risk of their investment going south due to increases in difficulty, particularly now with ASICs on the horizon.

This is great stuff.  Hmm, no options listed yet :/

Here I think you mean bitcoin futures. Thanks for your generosity :) You're right it is a great idea, and we're already working on it (https://bitcointalk.org/index.php?topic=86549.msg951728#msg951728).

Since we settle using a contract for difference model - the advantage being traders don't need to own the underlying asset - we can really allow trading on anything with a price. We're working on adding Gold, Euros, Stocks, and of course bitcoins as CFDs.


No, we're just starting up. This is quite a complex trading site, and I think it will take a while to move in the complex traders  ;)

But I'm working on it! ;D

On the Trade screen you can see the best bid/ask for each option. Typically option chains don't show open bids/asks, but do show open interest (http://www.investopedia.com/terms/o/openinterest.asp#axzz1yC6Pbaap).

There is no volume yet. I think I have to explain the opportunities the site presents first. Bitcoin is still a relatively small community. You're right it may be a good idea to limit expiration dates. For example, a 2 month max contract term may be better than 1 year and would also help limit insufficient escrow due to volatility as I'll explain below.


This is the trickiest thing to solve, even in the real world  :P It's even harder due to bitcoin favoring anonymity.

First we backed options with bitcoins, but I thought that was too burdensome. A contract for difference model is far more flexible. For example, @Brunic says he is currently mining the 300 coins he will sell in the future, so he couldn't put them up for collateral beforehand anyway.

In our Beta feedback thread someone suggested using a formula to calculate escrow, so that's the direction we went. However, I'm now thinking that may be too complex and inadequate for coverage. I'm thinking to simply require escrow to cover a 50% price move.

That gives traders more solid payment assurance. They can feel safe buying with the potential to make up to a 50% difference in price.

In the example above it would mean, for example, putting up  $6.50 x 50% = $3.25 then multiplied by 300 coins = $975 into escrow.

That's a lot more burdensome on the option writer, but only half as burdensome as putting up the coins directly. And it gives plenty of upside room to speculators. The price could move to $9.75 and they would know they would be paid.


Thanks! :)

No us being a counterparty wouldn't be prudent, but there may be good interest in the speculation thread. It's chicken and egg, though, first the options have to be written before people can decide whether or not to speculate on them ;)

Options chains actually do show open bid/asks.  Each put / call at each strike price is an entirely different traded instrument.  In other words, you need a full depth of market and time and sales for every single one.

Hi @Goomboo, nice to speak with you again.  :)

Typically option chains show only the best bid/ask, and that is for each call/put at each strike price. Yes, each strike price is an entirely different instrument, but you won't typically find the detailed bids and asks for each instrument. If you know a way to do that I'd love to see it ;) For example, here is the option chain for Google's stock:

http://finance.yahoo.com/q/op?s=GOOG+Options

However, as I said before when this topic came up Bitcoin is largely about blazing new trails, and if that's something that enough people want to see we may certainly add it.

Howdy! :p

That's because you're looking at a flat view (level I) of the market.  I'm more familiar with the commodity markets (than equities), so I'll venture a guess that the reason you can only access the level I data is that the exchange requires you to pay some "professional" fee to access it (identical to level II quotes for stocks).

The way to show it (on your exchange) is to have a table show up when you click "trade" next to a quote.  It should show the full bids and offers for the specific instrument at the specific strike and maturity.

Yeah, here's what I mean:

http://www.schwab.com/public/schwab/resource_center/expert_insight/investing_strategies/options/whats_really_going_on_options_market.html

Yes, paying fees does generally enable access to more data. But the page you linked still doesn't appear to show depth of market, only real time quotes for best bid/ask, and comparison between the exchanges.

That's what market depth is in the equity markets - a compilation of all executable prices from all eligible market markers sorted by best price.

Equity example:
http://www.realfasttrader.com/daslevelii.gif

That's exactly what you're looking at in the link I sent.

You really need to provide that for each instrument at each strike / maturity.

But there is only one exchange right now for our instruments, that's us.

Yeah...I don't see how we're not connecting on this...instead of exchanges (as in the posted example), you put traders' orders...

bitcoin.clarkmoody.com

We're not connecting because you're talking about two different things. A comparison between exchanges of one instrument is not the same as the orderbook on an exchange for that one instrument.

Edit: I know what you want us to add. As I said we may add it. I'm not against the idea.

Not true man, but this isn't really worth talking about.  The issue at hand is that you need market depth for each traded instrument.

The equity order book shows the best bids and offers of competing market makers and large players.  If you have direct market access (DMA), then you can place a bid / offer on the book.

http://en.wikipedia.org/wiki/Direct_market_access

In the BTC world, all traders have DMA, so their orders must be on a book that can be seen and interacted with.

Ah, now I see what you're talking about. I still don't think it's a fair comparison. When this came up before you said you wanted to see "what the market was thinking". I hardly think the nine best bid/ask orders between nine real world exchanges will give you that.

But, as I said an orderbook on options may be added. It's already in the works for our contract for difference section for Gold, Euros, Stocks etc.

I have a lot of reasons for needing it - it is one of the most used tools in active trading.  A significant percentage of professional short-term traders rely almost exclusively on market depth and time of sales.  It shows the positioning of the market as well as the velocity and volume of the market.

Relevant analogies:

-Would you go to a candy store if you only knew the price of one piece of candy and not the whole bag?
-Would you go to a party if you knew that only the most easily persuaded people would be there?

I mean this really shouldn't be too hard to do...in fact, if you aren't already doing this, your exchange is broken.

I want to buy the option for $40.  Someone wants it more than me, so they bid $41.  Your webpage now shows $41 as the best bid.

Someone sells to the $41, taking the $41 off the book.  My $40 is now shown again as the best bid.

I just want to see the full depth that your exchange should be storing already.

@Goomboo: Yes, I know. Can I get back to the tread topic now?  ;)

Sounds good.

I do agree you have to find a balance somewhere between 0% and 100%, so 50% should be a good option... I would suggest you then place a request for further collateral when 75% - 80% of the current collateral is in use because of a price rise (calls) or price fall (puts). That would give you ample time to close the position should someone renege on their obligations, with the least damage to the counterparty

Looking forward to see this get up and running !

I guess you're talking about an order book view, like this: https://bitcointalk.org/index.php?topic=50817.0 (see screenshot in the first post)?

Yes, I think that's the best solution.  :)

Additionally, I'm thinking to limit contract terms to 2 months at a time. That will help with both volume and volatility range.


Yes, he wants an orderbook for every option, every strike price. Orderbooks are common on BTC currency exchanges, for example, but not in the real world for options. However, I remember wishing for that information myself when trading options, so I'm in favor or the idea. We will probably add it.

Hey everyone, I'm happy to announce exciting new changes!  :)

Summary:

- We've expanded options to now include Gold, Silver, Brent Crude futures, shares of Google, Apple, Facebook, and more!
- Option lot size 1 added (all sizes: 1, 10, 100, 1000)
- Trade fee reduced to just $0.25 per contract
- Simplified escrow is now covering a 50% price move for bitcoins, and 5% move for all other assets

The biggest change is our expanded trading to options on the assets above. Additionally, we've added a lot size of just 1 and lowered the trade fee to $0.25 so it's now possible to trade "for fun" too ;)

Please see our updated How it Works (https://bitcoinopx.com/how-it-works) page for details.

More features are planned including currency exchange, and a user requested order book view for every option, every strike price. Something else you'd like to see? Please let me know of comments or suggestions you have.

Thanks, and happy trading!

http://img4.imageshack.us/img4/1598/screenshottradeplus.png

If the bid/ask can be moved by a small order, you'd want to have an order book (regardless of what the type of security is). Many retail trading platforms do not show depth of market for options because the counterparty is usually a market maker who is able to absorb fairly large orders without significantly moving the bid/ask.

I'm not sure what you mean by "moved by a small order". When an order is placed if it's the best for the instrument then it is the best shown. Options often represent some larger multiple of the underlying asset, such as 100 company shares in terms of stock options, so even 1 option contract is generally significant. I've sat in front of the screen live trading Google options (a $500 security) and watched stingy traders have a bid/ask war for the equivalent of $5.

However, even if that were the case there is no reason (that I can see) to withhold bid/ask data. I happen to agree with @Goomboo about the information being useful for data analysis purposes.

The market price for retail options, especially longer term ones, is very much affected by perception. Being able to see all bids and asks could be quite useful. As I said I had wished for that information myself.

I'm missing something I think.  The higher the strikeprice, the less Bob needs to put up for escrow.

Using your example of Bob creating a CALL 100 option on bitcoins, but let's say the strike price is $9.50 expiring in 4 weeks. Current price is $6.50.

Escrow = ($6.50 x 50%) = $3.25 + $6.50 = $9.25 - $9.50 = -$0.25

Taken literally, Bob can write that call option without having to put up any funds for escrow.

No you have it right. :)

The price wouldn't be expected to move above $9.25 as that would be more than a 50% move. However, there is a $5.00 minimum (there was a How it Works page omission - updated), so that would be $5.00 x 100 coins = $500 required for escrow. Also, once 80% of those funds are in use a margin call is issued which must be met within 24 hours or the option is closed and settled in favor of the holder.

Edit: I replied hastily and made a mistake, the $5 is flat, please see below.

Well, now the example in that page is incorrect, as the $3.00 is below the $5 minimum.

You're right, I replied hastily and made a mistake. The $5 is not multiplied by anything, it's flat. So the escrow due would be $5.00.

What's going on here is far out-of-the-money options are not well backed, due to the difficulties of counterparty risk. So in summary, people should not look to make a killing on them as the system isn't set up for that. Traditionally most traded options are in-the-money or close to in-the-money. You do get trading in the cents range on far out-of-the-money positions, but these usually do expire worthless. We will probably add a high risk of default warning message on such orders.

Wow, a lot to wade though.

First impression: If the point is to run away with everyone's money, why bother having security that might actually make it harder for stupid people to hand over their money? Better to make it user-friendly, the moeny is gone anyway, whether some third party hacker gets it first or not.

-MarkM-

LOL

Thanks @markm, you're probably right. I think a good indicator of a scam site is not having resistance to anything. Business logic for the longer term means basing decisions on a bigger picture, not short term aims. We certainly do have a larger picture in mind. Stay tuned... :)

Hi everyone,

We're working to add currency exchange with a focus on MoneyPaks (http://www.moneypak.com) because these are handy for getting money into and out of bitcoins. MoneyPaks can of course be used to reload prepaid credit cards used for cash at ATMs.

http://img525.imageshack.us/img525/1407/moneypak.png

We want to match sellers of BTC (miners) with buyers of BTC who may be new to Bitcoin or otherwise not want to wait for their money to reach an exchange.

Say a miner wants to sell 50 BTC. They would look up the current exchange rate (say $6.00) and list a MP request for $300 in our currency exchange section. Someone looking to buy BTC would just go to a local 7-eleven, CVS etc. and load that amount to a MP.

They would return to our site to accept the offer and submit the MP code.

There are two ways to handle things from here:

Way 1. We need to manually check (or bypass moneypak.com's captcha) that the code is valid and not yet used. We'd then alert the seller the code was valid and we were soon transferring their BTC to the buyer, so they should use the code immediately.

-or-

Way 2. We get the seller's re-loadable prepaid card number upfront, and load the MP code onto it ourselves to verify everything works out ok before transferring the BTC to the buyer.

Either way we act as middleman to facilitate the exchange for hopefully a negligible fee. Moneypaks themselves cost just $5. If we can set things up efficiently this could be one of the fastest and cheapest ways to go from USD to BTC.

Yes, BitInstant (http://www.bitinstant.com) is a stellar service which can be used by new people to get money into bitcoin, but this would be even cheaper (and faster?) especially for larger amounts (MP loads up to $500 or $1K at Walmart).

I think way 2 is best, but what do you think? Also, would this be a desired service?

Are you sure you want to accept traceable USDs for a service like this?

We wouldn't accept any USD. All we do is take in the BTC from the Seller and the MoneyPak code from the Buyer and facilitate the trade. The same thing happens already in the forum's currency exchange section, but without the efficiency of a middleman between the parties.

I'm missing something then.  Is this to enable the ability to deposit funds to BitcoinOPX for trading?    If so, then you carry a history of where those MoneyPak's are spent.  MoneyPaks are exclusively purchased only in the U.S.  BitcoinOPX, um .... , probably shouldn't be accepting funds from the U.S.

With Bitcoins from the blockchain, neither you nor anyone else except the sender really knows which country the funds came from.  With MoneyPaks, you know the exact country the funds came from.

Am I missing something obvious?

Think of the MoneyPak exchange as a separate service, because that's really what it is. I actually had the idea before BitcoinOPX, so this is sort of combining the sites. However, the added traffic should also help with BitcoinOPX trading.

But as for deposit options we don't plan to accept MoneyPak at this time.

Do it ™

You need marketmakers, or else the orderbook liquidity will continue to look like sahara. Most people are victims of psychological manipulation that makes them completely mathematically incompetent to understand elementary school math (vanilla options are just that), unfortunately this includes miners. Their competence is excellent in addition and substraction but they cannot comprehend anything more complicated (such as multiplication, % or division, which is all thats required to understand options really).

Secondly, your site needs security, i myself lost over 100 bitcoins (when they were still trading at above 8$) to bitoption.org because their site vanished together with its owner.

In short, i love options, but im not going to trade any single option unless the exchange seems to be able to offer these 2 things: liquidity, and existence 12 months from now.

At this time, given the past failures (bitoption, bitcoinca etc) you're propably much better off trying to team up with someone such as mtgox.

The site may have discontinued service but the operator most definitely did not vanish.  You might still be able to submit a claim for funds.  PM me if you don't know how to contact them.

I'm guessing you're joking about miners and math... One could argue Bitcoin is thoroughly about math; if anything it's too mathematical and geeky for quicker mainstream adoption.

As for the current lack of volume (I'm still laughing about the Sahara bit) I think it's to be expected. The main reason to list options is to make money. If it's not readily apparent how to do that then no action will be taken. Something that dawned on me considering Bitcoinica's rapid adoption and success is how straightforward it was: you look at the price and if you think it's going up you buy, otherwise you sell... the site offers leverage either way to magnify your bet, and nobody else need be involved; as long as there is liquidity the order is filled. Simple, effective, and direct to profit (or loss).

Options on the other hand are not so straightforward. It can take a while to get the hang of them, and positions are not opened and closed in a matter of minutes, round-the-clock. Instead, options require a longer term view and more consideration of actions taken. They provide traders with more options and strategies because they are more complex.

Bitcoin is a small niche community, and the subset of people perfectly comfortable with jumping in and trading options must be far smaller.

Also, we've only just added trading other assets. So I think the site will do well given time, but won't have the fast explosion Bitcoinca did. And people are still recovering from that unfortunate loss.

I'm looking longer term and betting on Bitcoin's continued growth. Adding the currency exchange functionality should help with traffic, and possibly trade activity too.

As for security I don't know if you're familiar with the Linode hack, the first time Bitcoinica was hacked, but several other Linode hosted sites were also hacked. In the aftermath one site owner with Linode posted on the forum that he specifically wasn't gloating, but had to say when he heard about the hack he wasn't the least bit concerned. This was because he didn't have funds hosted on Linode. Not a cent could transfer without his manual authorization. I read that and nodded to myself because I knew I would handle things the exact same way. And so I have. Even if our website is completely compromised no funds can be moved because all withdrawals require manual approval.

Hi - please be sure the redeemable code is USD and try again. We are working on this section for currency exchange between BTC and USD.

That image is hilarious.

If you have any questions please ask :)

One of the goals in setting up BitcoinOPX is making options more accessible to people. It can be a hassle getting set up to trade in the real world, even with the advances in web based solutions. And then there are the trade fees. BitcoinOPX is meant to provide people better accessibility, sort of like Bitcoin itself does.

That's been fixed, IIRC.

I will try to throw out a few bids on some call options, size 100. With the price here at 6.80 on 7/9, I'll pay $15.05 for the right to buy 100 bitcoins from you on 7/27 for $700. Sell the option to me, and you will be credited $15.05. Price stays under $7.1505 and you are better off. After that, you'll need to credit my account the difference.

I think I threw out a good price, but feel free to outbid.

Suggestion: Open up a december 28 2012 option, I would put a bid on a few 100 calls.

To clarify this issue there was nothing to fix; it was a misunderstanding.

We have never accepted 6 character passwords, always 8 characters minimum. The 6 character length came from a comment I made to a poster who said he only felt secure with 12 character passwords, because our system assigned passwords (minimum 8 chars). I was trying to explain about password length.

I said security experts agree people should use at least 6 characters, uppercase, lowercase, and special symbols, and we used at least 8. The mistake I made was not qualifying that comment, and the group here (who specialize in computation power of all things) ripped into the 6 character length.  ;)

When it comes to passwords the longer they are the more secure they are. Using a 150 character password, for example, would be great if everyone could do it, but usability becomes an issue. For most users the shorter the better; for example, no password or 1 character would be convenient, but that's not secure at all. So where should the lower bound be set? I said security consensus puts that at minimum 6 when using all the symbols, because I was speaking in general - for all sites on the Internet, the majority of which are not financial.

I still don't think I'm wrong in that, but my mistake was not qualifying the statement. For a community of hacking professionals, which is still a bit on edge from the Bitcoinica hacks, I can understand the quick and harsh backlash my comment drew.

However, listening to feedback we've adjusted our password procedure. We still assign a minimum 8 character password at signup, but include a note that users can set their own password anytime. This will hopefully discourage non-security conscious users from using passwords shared with other sites, while at the same time allowing users to set a password length they feel is very secure.

Thanks, TTBit! :)

Let me go over what you are proposing:

Right now the price is about $6.80, and you are willing to pay $15.05 for a July 27 CALL 100 with strike price of $7.00. (this is the right to buy 100 bitcoins at $7.00 on July 27th)

This is offering someone interested in selling about 5% over the current price. ($15.05 divided by 100 = $0.15, plus we add $0.20 for the difference between current price and strike price = $0.35 additional per coin)

If I was a miner taking you up on the offer here are the possible outcomes:

I list the option and put your $15.05 in my pocket.

1. July 27th price is above $7.00

Let's say the price is $7.10.

I owe you $7.10 - $7.00 (strike price) multiplied by 100 = $10.00

I sell 100 coins on Mt.Gox for a total of $710. I give you the $10 which leaves me with $700. However, I still have your $15.05 in my pocket, so that's a total of $715.05. So that's like selling my coins (when the price is $6.80) for $7.15 each which is 5% higher.
______

2. July 27th price is exactly $7.00

Here I owe you nothing since there is no contract price difference. I sell 100 coins on Mt.Gox for $700, but I still have your $15.05 in  my pocket, so that's a total of $715.05. I still made 5%.
______

3. July 27th price is less than $7.00

Let's say the price is $6.00. I owe you nothing because CALL options only pay when the market price is higher than strike price. I can sell my coins on Mt.Gox if I want, or I can wait until the price reaches $7.00 then sell. I still have your $15.05 in my pocket! I could also create more options on my coins!

So, miners, TTBit is ready to give you 5% selling premium (or more?) on 100 coins! You just need to create the option described above and place it on sell for him to buy.
_________________

Regarding a December 28, 2012 option, that's about 5 months into the future. We currently limit options to 3 months to help preliminary volume, and also reduce volatility risk resulting in insufficient escrow coverage.

I noticed that! Eight's not secure at all and be cracked with some gpus?

I'll take that challenge.  I'll give you a bcrypt hashed (workload 20) of a random 7 char password (all keyboard keys) If you can't return the password in "minutes" (lets say 60 minutes) you lose.  If you can you win. How much do you want to wager?  I agree with the larger point that OP security policies are .... lacking but your belief you can crack any 7 char hash in minutes is probably unfounded.  A high end GPU will get less than 1kh trying to brute force bcrypt (workload 20).
  

We salt and hash passwords with bcrypt. We also require the password be at least 8 characters, numbers, letters upper and lowercase, and symbols. You say that's not secure at all?

This also means an attacker has gained access to our database to try a brute force attack.

I'm mindful that computer hardware is advancing, probably helped by Bitcoin mining demand. I'd be curious to know if this community believes 8 characters is no longer adequate.

Apologies, Obsi. It's approved. We don't yet have much withdrawal activity.

We're working on adding BTC <-> USD currency exchange (via MoneyPaks) which should be ready soon. I think that will help with traffic, which may spill over to trade activity too. People are still getting up to speed with options and how they can be applied to their own situation.

The overall Bitcoin community continues to grow too, so with luck things will pick up. :)

Why do I see absolutely NO bids on options?

Am I doing something wrong, or is there simply zero interest in your service? 

OK, I actually found some bids.....I am trying to hit them, and I get this error:

Preview order There was a field error. Please click here and verify field values.

Regarding interest in our service, I think there is good interest. During our beta soft launch we had lots of testers and helpful feedback. Since going live we have had sign ups, but not many have taken trading action. I think people are still getting up to speed with how they might use options for their own situation. This is a small community and people comfortable with options will be smaller.

For placing an order from the Trade screen please be sure the quantity and limit fields have a value entered. If you would like to email a screenshot of your entries before clicking 'preview order' to info@bitcoinopx.com I can give more information.

Hey everyone,

I'm happy to announce our exciting new change: hourly options.

https://bitcoinopx.com (https://bitcoinopx.com)

Our lack of volume may have been due to our options not being a good fit with the needs of the community. People deposit, withdraw, and trade bitcoins on exchanges 24/7, so it makes sense hourly scheduled options might be a better fit :)

We've added trade examples (https://bitcoinopx.com/trading-options) to our options overview page, including how miners as coin sellers can benefit.

Details are on our updated How it Works (https://bitcoinopx.com/how-it-works) page.

We hope you'll try out our new set up, and let us know what you think.

Happy trading! :)

Update: thanks to user feedback we've now switched to American style ability to exercise options anytime before maturity!

If the market price is above (or below for puts) the strike price you can exercise the option immediately and cash out your payment.

We've also added a handy view all link on the Trade page to see all active options on the same page.

bitcoinopx site is down, or ... gone now?

Never really took off......which is a shame.  I would LOVE to be able to trade calls and puts on BTC. 

MPEx:

 - http://en.bitcoin.it/wiki/MPEx