To be a bit more precise about my position, I don't think it's a Ponzi because it doesn't fit the pattern of a Ponzi very well -- at least, not yet. However, I cannot imagine anything legitimate that it could possibly be.

Update: Also, I can't imagine it being wise to invest in something when you have absolutely no basis on which to estimate the level of risk involved.

Umm, no. The crux of sockpuppetry is the use of deception to obscure the source of a message. Organizing a group of people to get a message out is not sockpuppetry. Impersonating a group of people to get a message out is.

Wow. No. A thousand times, "no". What matters is what actually is true.  All claims are not equal, nor does a claim gain any status simply because somoene believes it. Some are *right* and some are *wrong* and that this the difference that matters most.

A person who actually is right should work to spread their ideas, regardless of whether they "may be seen as lies by others". This is because correct information allows people to avoid and minimize harm.

A person who is wrong is not excused by their incorrect statements being "the truth for [them]". Spreading a falsehood will do precisely the same damages whether the spreaders believe the falsehood or not.

What you're doing is equivalent to analyzing whether it is acceptable to yell "Fire" in a crowded theater but ignoring the very important issue of whether the theater actually *is* on fire. Nothing matters more to the analysis and the conclusion.

There is no hypocrisy whatsoever in living in the world as it actually is while arguing that it should be different. In any event, the tyrannical and corrupt reign of government over money has nothing to do with the legitimate function of government in operating police and courts to deal with actual cases of theft and fraud.

This. Unfortunately.

Runs on banks really isn't a problem. Banks can just resume doing what they used to do -- have a clause in the savings agreement that allows them to declare an emergency and defer withdrawals in exchange for paying their customers an increased interest rate. So long as the bank is fundamentally solid and the problem is just liquidity, you can even find other banks who will buy your deposits at the bank suffering from a run. They know they'll get paid the amount, plus more than normal interest, when the bank recovers its liquidity.

The problem is if a bank makes bad investments such as loans that will never be repaid. Insufficient equity is much more devastating than insufficient liquidity.

In the mid 80's, some Libertarians who believed that fractional-reserve banking was a fraud opened an "honest" bank. They stored your money in their vault and had 100% reserves. Of course, they couldn't pay any interest and even had to charge a small storage fee. Not surprisingly, their service wasn't very popular at all. (Though, in fairness, part of this is because the government insures bank deposits. Heck, in today's economic climate, they might actually do some business for people with amounts over the FDIC limit.)

If it's done right, the party generating the address for you has no access to the private key, only the public key.

It works like this:

1) You generate a random 256-bit integer less than the SECP256k1 generator. You keep this secret. (Effectively, an ECDSA private key.)

2) You compute the corresponding EC point on the SECP256k1 curve. You share this with whoever is finding the vanity address for you. (This is the ECDSA public key that corresponds to the private key you generated in step one.)

3) The person working out the vanity address for you tries various 256-bit integers also less than the SECP256k1 generator. They compute the corresponding EC point and add it to the EC point you sent them (from step two). They then hash this and see if it produces the desired vanity address. They repeat this over and over until they find a 256-bit integer that works. They give this integer to you. (And the world, it need not be kept secret.)

4) You add the 256-bit integer they found to the 256-bit integer you generated in step 1 and reduce it modulo the SECP256k1 generator.

5) You now have the private key, and they don't. (And you can prove that they cannot generate the private key from just the information you gave them unless ECDSA is fundamentally broken.)

In ECDSA, you convert a private key to a public key by multiplying by the generator. Division is impossible.

The vanity address generation scheme above works because: (A+B)*G = AG + BG

You generate A and AG, but give them only AG.

They try various different B's, calculating the AG+BG for each one to find the right one for the vanity address.

They give you B. You can now compute A+B (the secret key corresponding to the public key AG+BG) but nobody else can since they do not know A.

Computing A from AG would mean breaking ECDSA fundamentally. All you gave them is AG, an ECDSA public key. If they could figure out the private key to your new account (A+B), they could also figure out A. So if they could figure out the private key to your vanity account, they could also figure out the private key you created in step 1. But all you gave them was the corresponding public key. So any compromise of the vanity account would mean they could compromise a private key given only its corresponding public key.

Yes, exactly. A hope of a profit is way better than a sure loss.

Sure, but risk minimization has risk too. There's no perfect solution, but some that are obviously very bad. "Minimize risk at all costs" is one of the worst.

Safes cost money. Guards cost money. If you mean loan it out to make interest, then there's risk associated with that.

That seems impossible to me. I don't see how people could possibly cheat.

Not to my knowledge.

There are a variety of reasons, but those most common is to protect themselves from devaluating currencies.

No, you don't stuff money in a mattress unless you're an idiot. If, for example, dollars are losing value, MtGox should hold as little of their reserves in dollars as possible. There's no reason they have to hold your value in the same demomination as you are going to claim it, and that's usually a very foolish thing to do. If Mt. Gox did that, they'd have to charge you a storage fee or eat losses from inactive accounts.

Mt. Gox should hold sufficient value, in some form ,t cover client deposits. Butthey shouldn't hold reserves in any particular currency of store of value unless that particular currency or store of value makes sense for them.

No, that's totally different because this "taint" is visually obvious and can't appear on a bill while it's sitting in your pocket. A better analogy would be if the FBI regularly published a list of serial numbers of currency that would no longer be honored. Banks would refuse to accept bills on the list, and soon so would grocery stores and so on. That hundred dollar bill you got from the bank, now sitting in your wallet, could appear on that list at any time because the person who deposited it at the bank right before you withdrew might have stolen it.

Think about what using currency would be like in such a world. Could you even have ATM machines? In fact, it would be the death of cash -- forcing people to use cash only for small amounts of money they could afford to lose. Such "tainting", if it hit the Bitcoin world, would similarly be the death of Bitcoin if it caught on in any significant way.

That gives you the worst of both worlds. No automated withdrawals are ever possible, and an attacker can just wait until a transaction is approved to snatch the keys out of memory.

That's what happens when someone steals from a hot wallet. They get all the money that was available for automated transactions, plus any additional funds in wallets whose keys they were able to find in transient storage.

The correct solution is really never to use a hot wallet at all. There is no reason a key ever needs to be on a machine with Internet access. Methods to sign something with a key while preventing theft of the key or signing of bogus data are well understood since certificate authorities worked them all out. The irony is that CAs frequently ignore these well-understood security practices too.

One way is to a have a machine that is physically secure whose sole purpose is to sign transactions. It can talk over a serial port to a machine with Internet access. The software on the physically-secure machine controls the signing of transactions and is the only machine that can actually process a withdrawal. Any thief could, at most, compromise the machine at the other end of the serial port and would be limited to the commands that exist over the serial link. He could never extract a key that can sign Bitcoin transactions nor can he process a transaction that doesn't meet your security requirements. Yet transactions that do meet those requirements can process without human intervention.

I sincerely hope you kept a copy of the wallet. Otherwise, any funds that get deposited in those accounts will be lost forever. Without the private keys from the wallet, there is no way to recover the funds deposited in the account.

If the wallet is online and available for withdrawal, then a thief who compromises the machine can take all the coins in the wallet, whether your normal withdrawal path is automated or not. If the point of the human security check is that the coins *cannot* be withdrawn without the approval, then it's not a hot wallet. If the security check is just a human saying "yes", then it can still be a hot wallet, but a compromise of the machine will include the ability to bypass the withdrawal authorization.

It's probably due to people using a progressive betting strategy. This doesn't reduce your edge, but it does change the flow. What will happen is that instead of having a small trickle of profit, you will have a small trickle of loss with the occasional spike of huge profit. You will need to increase your reserve, but you should be quite happy to do that.

Do you have a cite for this? Because the last time I asked if this was the case, Mt.Gox said no. I pointed out the practical problems with such a policy and they denied they had any such policy.

And I don't see how they could possibly have such a policy. For example, if they retain the right to claim some coins are tainted and not as good as others, presumably they have to extend to others that same right. If I send them Bitcoins I don't consider tainted and they reject them, what do they do? Send me those Bitcoins back? What if I now consider them tainted? (Which is, IMO, justifiable. Since Mt.Gox has now declared them tainted.)

If Bitcoins are not fungible, lots of things start to break.

If they have to be manually approved, it's not a hot wallet. The gist of a hot wallet is that a release of coins is automated.

I used to debate Libertarian nut cases who think that all fractional reserve banking is fraud. My usual response is to ask them if they really think there actually exists anyone who thinks that when you deposit money in a bank, they put your money in the safe so that you can withdraw it when you want to. I guess I'll have to find a new argument, because it now appears there is at least one such person.

Then it wouldn't be a hot wallet at all.

According to my research, his real name is most likely one of the following:

Ends Thorns
Dents Horns
Tends Horns
Sends Thorn
Sends North
Shorn Dents

If you were advising Martin Luther King, he would have given an "I have a plan" speech, and African Americans would still be drinking from their own water fountains.