Bitcoin Forum
May 27, 2024, 01:39:56 PM *
News: Latest Bitcoin Core release: 27.0 [Torrent]
 
  Home Help Search Login Register More  
  Show Posts
Pages: « 1 2 3 4 5 6 7 8 9 10 11 12 [13] 14 15 »
241  Economy / Service Announcements / Re: Camp BX Hacker / Security Audit: Results on: June 29, 2011, 05:03:35 PM

@Serge and Ananas,
          Accepting payments from outside USA requires a lot of compliance paperwork and lawyer-time for a company, so we will work to integrate Europe payment options after our USA launch.

         Please PM me with your favorite payment options, and we will work with you to offer those options in Camp BX.

Thank you,
      Keyur



Thanks. I actually live in the States, but was wondering if you'd work on global scale.

Any word on your rates?

Got it!   We are at 0.55% for non-margin trades.

242  Economy / Service Announcements / Re: Camp BX Hacker / Security Audit: Results on: June 29, 2011, 04:41:40 PM
While it is great you have had this done, this is mostly marketing.   Unless there were some other tests done, you are being very misleading on what this really means.

Quote
"(formerly McAfee Hacker-Safe), who are ranked #1 in security industry for threat detection"
Ranked #1.  When and by whom?

Quote
"We were tested for >1,000 known vulnerabilities specific to our platform"
Really?  How were the tests specific to your platform?  To my knowledge, and after talking to them on the phone today, there is only one McAfee Secure product.  It is a standard daily PCI scan that is the same for everyone that buys that product.  You can be set up and them scanning you in hours by putting some code on your site.  As their rep said on the phone  "it is all in the cloud, you just put the code on your site and we scan every day."      

Quote
We have also achieved all requirements for the McAfee Secure Trustmark
The trustmark is just a badge you get for passing all the automated tests every day.  It is a marketing "bonus" to show your customers you got the scan done, there are no additional tests involved.  They even say on their site that by displaying the badge customers got "12% increase in sales conversions"

Quote
certified for compliance with 7 information and data security standards
Is this what McAfee says you have passed from using their McAfee secure product?  Or do you have other tests?  


Itsagas,
      I think there may have been couple of miscommunication on your call - McAfee has three products.  (1) McAfee Secure  (2) McAfee PCI Certification, and (3) McAfee Saas Vulnerabilities Scan.

Sales teams are not the best source for technical answers.  Please open a ticket with their support team, who will be able to tell you far more details.

Essentially, the test includes a set of probes to guess what software / versions you are running, and then the specific tests battery starts.  I have the full log available to me, and can share it with a reputed member of Bitcoin forum for independent verification.

And as I mentioned couple of messages back, McAfee is just one facet in our approach.  We are using everything from Nmap to peer-reviews to find holes before launch.

Hope this helps,
      Keyur



243  Economy / Service Announcements / Re: Camp BX Hacker / Security Audit: Results on: June 29, 2011, 04:09:31 PM

@Serge and Ananas,
          Accepting payments from outside USA requires a lot of compliance paperwork and lawyer-time for a company, so we will work to integrate Europe payment options after our USA launch.

         Please PM me with your favorite payment options, and we will work with you to offer those options in Camp BX.

Thank you,
      Keyur

244  Economy / Service Announcements / Re: Camp BX Hacker / Security Audit: Results on: June 29, 2011, 04:02:58 PM

Thank you everyone!  We are always going to treat security as our top priority, and McAfee Secure is just one facet of our approach.  We have used multiple tools to scan for vulnerabilities, and peer-code-review sessions are already in progress. 

Someone quoted LulzSec exploits in this thread, so I wanted to point out that all of LulzSec exploits were directly from the OWASP top-10 list, and thus were preventable if there had been proper security processes in place.
http://www.pcworld.com/article/231303/lulzsec_anonymous_hacks_were_avoidable_report_says.html


We are happy to report that Camp BX is on track for July 5th launch.  We will share more details shortly.

Thank you again,
      Keyur

245  Economy / Service Announcements / Camp BX Hacker / Security Audit: Results on: June 29, 2011, 01:39:08 AM
Hi everyone,
      The results are in!  https://campbx.com/testnet/main.php

We were tested for >1,000 known vulnerabilities specific to our platform and services by McAfee Secure (formerly McAfee Hacker-Safe), who are ranked #1 in security industry for threat detection.  This is the same auditing service used by well-known brands like Costco, Petco, and Roush Racing for their e-commerce websites.


Here is an executive summary of our results:

OWASP top-10 web vulnerabilities:
    A1: Injection - Pass
    A2: Cross-Site Scripting (XSS) - Pass
    A3: Broken Authentication and Session Management - Pass
    A4: Insecure Direct Object References - Pass
    A5: Cross-Site Request Forgery (CSRF) - Pass
    A6: Security Misconfiguration - Pass
    A7: Insecure Cryptographic Storage - Pass
    A8: Failure to Restrict URL Access - Pass
    A9: Insufficient Transport Layer Protection - Pass
    A10: Unvalidated Redirects and Forwards - Pass

Distributed Denial-of-Service attack: Pass with no noticeable slowdown in response time

All vulnerabilities are classified on a scale of 1-to-5, with 5 being Urgent and 1 being informational.  Camp BX final scorecard is:
Sev 5: zero
Sev 4: zero
Sev 3: zero
Sev 2: zero
Sev 1: 29
(Sev 1 includes information like "DNS Server detected", "NTP Server detected", "SSL Certificate mismatch on Testnet.CampBX.com"...)


This makes Camp BX is  the first Bitcoin platform certified for compliance with 7 information and data security standards!  

We have also achieved all requirements for the McAfee Secure Trustmark, and on our livenet launch Camp BX platform will proudly wear this badge.  A HUGE thank you to Alex and Yuriy for burning the midnight oil to fix all issues identified, and ensuring that we are able to achieve this crucial certification prior to our launch.


Going forward Camp BX will be re-tested daily for all known vulnerabilities.  We realize that security is a process, and we have put together alerts and escalation procedures in place to ensure that anything higher than Sev 1 is fixed within 72 hours.


Thank you and good night,
      Keyur

246  Bitcoin / Bitcoin Discussion / Re: Camp BX Hacker / Compliance Security Audit on: June 27, 2011, 05:29:50 AM
well, youre light years ahead of mtgox already if your actually doing security audits.
This is how we do stuff, not live tesing with other peoples money.
more power to you my friends.

I think your name could have been better, but hey I suppose thats beside the point.



Thank you NS! 

Stay tuned for the results!
      - Keyur



247  Bitcoin / Bitcoin Discussion / Re: Camp BX Hacker / Compliance Security Audit on: June 27, 2011, 05:26:42 AM
Quote
Elggawf,
      I apologize if some of the answers came across as shady - that was never the intention.

Keep in mind that answers to seemingly simple questions come after long discussions with lawyers, scanning through policy fine print, and back and forth communications with government agencies like Department of Banking and Finance.  These answers represent a competitive advantage for a business.  I have to straddle a fine line between sharing and open-sourcing the business to competition.

If communication with government agencies like the Department of Banking and Finance has taken place, Camp BX/Bulbul Investments LLC would be in compliance with U.S. Code CHAPTER 18—BANK SERVICE COMPANIES § 1861

(2) the term “bank service company” means:

(B) any limited liability company—
(i) which is organized to perform services authorized by this chapter; and
(ii) all of the members of which are 1 or more insured depository institutions.

(4) the term “depository institution” means, except when such term appears in connection with the term “insured depository institution”, an insured bank, financial institution subject to examination by the Director of the Office of Thrift Supervision or the National Credit Union Administration Board, or a financial institution the accounts or deposits of which are insured or guaranteed under State law and are eligible to be insured by the Federal Deposit Insurance Corporation, the Federal Savings and Loan Insurance Corporation, or the National Credit Union Administration Board;

These provisions essentially state that a “limited liability company” “must be eligible to be insured by the FDIC” to obtain insurance. As Bulbul Investments LLC is not registered at the "Department of Banking & Finance" in Georgia, it is inconceivable that Bulbul is eligible to participate in FDIC insurance, or in compliance with State of Georgia - Department of Banking and Finance regulations.

Grant asked on June 22, 2011, 05:17:30 pm in thread Camp BX Platform in Beta: Margin Trading, Short Selling, and Advanced Orders (http://forum.bitcoin.org/index.php?topic=20777.0;all)

“So, basically if i deposit upto $250,000 to your exchange and you become insolvent (for whatever reason that could be) i am guaranteed my deposit by your government ?

Can you point me to some documents that proof your registration ? (might be i overlooked it, but i looked through your site and couldn't find anything)”

Whereas elggwf asked on June 23, 2011, 12:35:26 am in the same thread

“What do you mean by you're "FDIC insured" - did you get the FDIC to insure all your USD holdings? What about the BTC holdings, will those be insured too?”

and neither Grant nor elggwf received an answer; so I will make a very clear statement: the information on Camp BX website under "Is my money safe" is simply not true, which also applies to the information under “Legal compliance”:

“The foundation of our operations is an active and prominent compliance program, and we are committed to maintaining full compliance with State of Georgia - Department of Banking and Finance regulations.”

Camp BX might have an exchange that is far superior to Mtgox (of which I am not capable of making any judgement upon), but regarding providing accurate and relevant information in a timely manner, I fail to see any material difference.




Dennis,
       You seem painfully new to USA rules and regulations, but I will make one final attempt to elaborate.

We keep our cash deposits in a bank account that is insured by FDIC.  If the bank fails (there were 140 bank failures in 2009) then your money is safe.  However in USA there is no insurance for business solvency.  If the business goes under, than that is the risk you take with your investment.

In other words, we are a business not a bank.  Banks don't accepts Bitcoins so far.

Take care,       
     Keyur


248  Bitcoin / Bitcoin Discussion / Re: Camp BX Hacker / Compliance Security Audit on: June 27, 2011, 12:02:15 AM
I have no idea how the previous post had many crossed over lines; i shall resubmit the entire post as I could not edit it successfully.

I must type parts of message again; will update soon.

“Try http://corp.sos.state.ga.us/corp/soskb/CSearch.asp

Keep in mind, other public records take time to update.

I think there is a misunderstanding about the role of FDIC in international customers.  FDIC insures bank accounts, not businesses.  Our accounts are insured by FDIC.

Hope this helps,
      Keyur”

Bulbul Investments LLC is registered as a Limited Liability Company, which affords "limited personal liability for the debts and actions of the LLC". Regarding FDIC, as you state, "FDIC insures bank accounts". I read this as the bank accounts that Bulbul Investments LLC hold are insured in the bank where the account of Bulbul is held. Despite funds held in accounts by Bulbul being insured, if Bulbul were to apply for bankruptcy, any deposits to Camp BX that are not in the account would not be redeemable due to the limited personal liability, and depositors to Camp BX are unsecured creditors - is this a correct understanding or not?

The Georgia Code - Corporations and Partnerships - Title 14, Section 14-11-201 states: "(a) A limited liability company may be formed under this chapter for any lawful purpose. If the purpose for which a limited liability company is formed makes it subject to a special provision of law, the limited liability company shall also comply with that provision."

As Bulbul Investments LLC operates an exchange market, I am under the impression that Bulbul is subject to other "special provision(s) of law", which again I am under the impression would require further licenses. Would you care to elucidate on this point? As Camp BX will potentially hold/transfer millions of USD, further information on the subject matter would allow for a better understanding of the risks involved when trading on Camp BX.

I transferred 500 Euro to Mtgox which literally arrived on the eve of the crash/hack. Of course the funds are not more than I can afford to lose, however the risk factor when trading on Bitcoin exchanges has been perfectly exposed (of course the risk factor always existed) and I am considering whether to withdraw completely as, with hindsight, I consider myself foolish to have transferred sums to an entity with a very unclear legal framwork, however novel and benign the concept of Bitcoins is.

The problem with the crossed over lines occured when I attempted to type "provision(s)" with [].

Dennis,
       Sorry to hear that you were among those affected by the Mt. Gox incident.

What you describe sounds like SIPC, not FDIC. Unfortunately Bitcoins and Camp BX are not covered under SIPC.  You can do additional research at:
http://www.sipc.org/

Hope this helps,
     Keyur

249  Bitcoin / Bitcoin Discussion / Re: Camp BX Hacker / Compliance Security Audit on: June 26, 2011, 09:37:47 PM
this looks promising.

i'd much rather have my money compliant to all the various things that money needs to be compliant with, than potentially anonymous but in the hands of amateurs.

if i want anonymity, i'll do BTC > BTC transactions over Tor.

if i want a bank or an exchange, i'll go with staid and boring and all tied up with legal niceties.

i'm looking forward to your launch.  i'll be there.


These were exactly our thoughts when we made the business plan, Jamie!  Thank you and look forward to having you at Camp BX!


250  Bitcoin / Bitcoin Discussion / Re: Camp BX Hacker / Compliance Security Audit on: June 26, 2011, 09:06:01 PM
Quote
Dennis,
      We have updated the company name in the footer - Camp BX is our product name.  You can verify the registration now!

Thank you,
     Keyur

A Camp BX search does still not generate any reccords at "Department of Banking & Finance" in Georgia http://dbf.georgia.gov or at "Georgia Business Licenses Directory" http://publicrecords.onlinesearches.com/Georgia-Business-Licenses.htm or at the FDIC "Bank find" http://www2.fdic.gov/idasp/main_bankfind.asp.

Try http://corp.sos.state.ga.us/corp/soskb/CSearch.asp

Keep in mind, other public records take time to update.

I think there is a misunderstanding about the role of FDIC in international customers.  FDIC insures bank accounts, not businesses.  Our accounts are insured by FDIC.

Hope this helps,
      Keyur

251  Bitcoin / Bitcoin Discussion / Re: Camp BX Hacker / Compliance Security Audit on: June 26, 2011, 08:52:06 PM
<!------------------------------------------------------------- Charts END!! -->

Smiley

That's one of our programmers celebrating a little milestone ;-)



252  Bitcoin / Bitcoin Discussion / Re: Camp BX Hacker / Compliance Security Audit on: June 26, 2011, 08:41:56 PM
Quote
Elggawf,

      I apologize if some of the answers came across as shady - that was never the intention.

Keep in mind that answers to seemingly simple questions come after long discussions with lawyers, scanning through policy fine print, and back and forth communications with government agencies like Department of Banking and Finance.  These answers represent a competitive advantage for a business.  I have to straddle a fine line between sharing and open-sourcing the business to competition.

 
Quote
The foundation of our operations is an active and prominent compliance program, and we are committed to maintaining full compliance with all pertinent rules and regulations for the trading platform.

    Spirit of our program is to do the right thing, not just the legal thing. Attempts to bypass account maximum limits will result in a refund of all funds and a ban for the violating account/s. We have hard-coded additional rules in our trading engine to thwart illegitimate usage of the platform and money laundering.

    Please help us strengthen our compliance program, and immediately report any suspicious trading acitivity you notice on our platform to the helpdesk.

I'm sorry, but this "Legal compliance" statement does not contain any substance. Under what name is Camp BX registered in the State of Georgia? Camp BX is, as far as I can see, not registered. Likewise under which name are deposits insured with the FDIC. The "Camp BX user agreement" does contain more substance as it states that "This Agreement shall be governed by and construed in accordance with the laws applicable in the State of Georgia."

If Camp BX has a business model that acts in accordance with the law it can be envisaged that Bitcoin will grow as more businesses will accept Bitcoins.





Dennis,
      We have updated the company name in the footer - Camp BX is our product name.  You can verify the registration now!

Thank you,
     Keyur

253  Bitcoin / Bitcoin Discussion / Re: Camp BX Hacker / Compliance Security Audit on: June 26, 2011, 07:39:06 PM
Gotta say, I wasn't that impressed with their site. I signed up and found that their code transformed my username to all lowercase characters. Why would anyone do such a thing? 

I tested the website, and was only mildly impressed.  I didn't think the user interface was all that great (and just hated the color scheme).

On the other hand, though, Keyur has been unbelievably receptive and responsive to feedback.  And they seem to be putting security, reputation, and trustworthiness at the top of their agenda, with just a few feature advantages. 

I would LOVE to see another successful exchange, so I'm keeping an open mind on this one, and wishing them the best of luck!

Thank you for trying us out JF.  We have few more exciting features in pipeline that we will roll-out over next six months.

We will also get the API rolled out after launch so you don't have to deal with the UI!


Thank you,
     Keyur
254  Bitcoin / Bitcoin Discussion / Re: Camp BX Hacker / Compliance Security Audit on: June 26, 2011, 07:37:03 PM
Keyur-

Quote
We do not allow naked shorts

Quote
To clarify, we DO NOT borrow from user accounts and only the user can move the coins out of his/her wallet.  There is a dedicated "house account" funded by us for shorts.

Quote
Hope this makes sense

Yes. Thanks much.



Befuddled,
     You had some excellent questions, so we have also updated the FAQ section to reflect these clarifications. 

Thank you!
      Keyur
255  Bitcoin / Bitcoin Discussion / Re: Camp BX Hacker / Compliance Security Audit on: June 26, 2011, 07:20:20 PM
Short selling? Color me suspicious. Are you going to allow naked short sales?

Bitcoin is so tiny and thinly traded (by FX or any other standards) big-money interest hostile to Bitcoin can come in effectively drop the price to zero. Easily. All they have to do is capitalize a stand-alone entity with, say, $1B US. Then continuously take an gradually ever-growing short position. Bitcoin will never be worth much. If, over time, their short position goes underwater to an extent that exceeds their capital, they can either add more, or declare BR. If the Fed were behind it, they can just print to the extent necessary so they never have to cover.

If naked short sales are not allowed, then anybody selling short would have to "borrow" them from someone else first, and I guess that someone would be the accounts of those who hold balances at campbx. I recommend nobody hold your bitcoin balances in campbx, unless campbx has an option to disallow their borrowing for short selling.

Please disabuse me of these notions if I am in error. I don't see anything good for Bitcoin coming from allowing short sales.




Befuddled,
     We do not allow naked shorts - you have to put 52% coins towards the trade.  Also the trade maximum size is capped.  So $1B government money will not do any good here.

To clarify, we DO NOT borrow from user accounts and only the user can move the coins out of his/her wallet.  There is a dedicated "house account" funded by us for shorts.  This account is risk-managed based on liquidity available in the market to limit our risk exposure.

Hope this makes sense,
      Keyur



256  Bitcoin / Bitcoin Discussion / Re: Camp BX Hacker / Compliance Security Audit on: June 26, 2011, 06:24:59 PM
Very impressive, professional site. A few questions:

1. As mentioned above, will you add physical information about the exchange's whereabouts? Mt. Gox is known to operate from Cerulean Tower in Tokyo, but they do not list any address or phone number in public.

2. When (or, if at all) will you accept wire transfers as deposit and withdrawal method ($USD, Swiss franc, EUR, JPY)?

3. Do you have an automated system for instant withdrawals and deposits of bitcoins from/into the system via unique, 24 hour disposable wallets like Mt. Gox?


Thank you JD!

1) Wednesday

2) Launch time is pressure time, so we intend to keep things streamlined at launch and not scatter the team's energy. We will explore allowing other modes of payment (including wire transfers) after launch.

3) That was the first feature we implemented!  You can try it out for yourself if you have some testnet coins lying around at http://testnet.campbx.com
Keep in mind that coins need 5 confirmations from the network to show up in the wallet, which can take a while on testnet due to limited mining activity.  It should be much faster on livenet.

Hope this helps,
       Keyur

257  Bitcoin / Bitcoin Discussion / Re: Camp BX Platform in Beta: Margin Trading, Short Selling, and Advanced Orders on: June 26, 2011, 06:17:29 PM
I miss a json api.

Dinox,
      The API is ready, but we are planning to roll it out after the launch.  Stay tuned!

Thank you,
     Keyur
258  Bitcoin / Bitcoin Discussion / Re: Camp BX Hacker / Compliance Security Audit on: June 26, 2011, 06:04:47 PM
Sounds promising. Just noticed we can get your server versions from the whois. Please modify this httpd.conf for me!

Angelo,
    We have already modified this few days ago!  You can check the HTTP headers. 

The updated information may take a while to propagate to whois records.


Thank you for trying us out!
      Keyur

259  Bitcoin / Bitcoin Discussion / Re: Camp BX Hacker / Compliance Security Audit on: June 26, 2011, 06:02:37 PM

Bar a few growing pains, I'm really liking what I see here so far. I still haven't gotten around to getting my password to work, but they seem responsive to critique and if they can hit the ground running with trust and avoid shady half-answers (a few of Keyur's earlier responses in the first thread didn't inspire much confidence, for the most part he seems to be rectifying that though).

Elggawf,
      I apologize if some of the answers came across as shady - that was never the intention.

Keep in mind that answers to seemingly simple questions come after long discussions with lawyers, scanning through policy fine print, and back and forth communications with government agencies like Department of Banking and Finance.  These answers represent a competitive advantage for a business.  I have to straddle a fine line between sharing and open-sourcing the business to competition.

Thank you,
      Keyur

PS: You may have to reset the password once since we made couple of tweaks to the password validation policy after your registration.  


260  Bitcoin / Bitcoin Discussion / Re: Camp BX Hacker / Compliance Security Audit on: June 26, 2011, 05:56:16 PM
Keyur, got any insight on deposit/withdrawal methods that you guys are planning to integrate?
Another question, will you be getting any sort of exchange or MSB licencing?  (I have no idea whichever is applicable in the case of Bitcoin exchange)


Serge,
      Only method available at launch will be Dwolla.  We will work with the user community after that to prioritize which method they would like to see next.

Thank you,
    Keyur

Pages: « 1 2 3 4 5 6 7 8 9 10 11 12 [13] 14 15 »
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!