doesnt matter

if you lose all of this invsetment and everyone wants their btc back

will you raid bitfunder user balances to repay this loan

ukyo answer

You didn't state if the private investment opportunity was legacy market or bitcoin. Would be helpful to know.

I am paying 0.06% weekly this isnt the best returns

also if you go backrupt will u pay back this loan with bitfunder funds

The problem is right here. You can say that BTC0.15 per 100MH/s is a great price right now (network at ~250TH/s), but when the network reaches 1500TH/s, 100MH/s is worth then 0.15*250/1500 = BTC0.025, an 83% devaluation.

How come weexchange does not include transaction fee for withdrawals? When I withdraw with 0 transaction fee my transaction takes forever to make its way into the blockchain.

Yes, this has happened to me constantly. After I cancel an order, I have to reload a fresh page in Chrome, then I will be able to post another order. Some bug here.



Also, I have requested that server time be posted somewhere on the top of the page, or users are given an option to set times to display in their local timezones...


hopefully these suggestions help =)

Hmm...  a couple of things, maybe.

You could send a text message via Twilio if the user has a mobile phone on their account, and have the user respond with a confirmation code.  Once that code is sent, the password reset email could be forwarded to the client.  This has the benefit of being able to automate.

Or you could require users to sign a message using the bitcoin address associated with the account.  If that's successful, the email can be sent to reset the password.


edit:  I hate security questions and answers, because the same ones seem to be used for every site, which isn't very secure.  Chances are good that if the attacker got access to the user's email address, he did it via the security questions and a little googling.    I always enter a random string into the answer field and save it in my password manager. 

Here's the rundown:

- Password ... can be reset via forgotten password process.  (sends an email with link... the usual)
- PIN ... write it down!
- Google 2FA ... we display the QR code and secret key before you turn it on.  Either write it down or print it.
- Permanent withdrawal address locks ... do not turn it on unless you really want permanent.

I have a lot (A LOT) of requests pending right now for reset and lock removal requests.  I think I'm around 3-4 days behind.  This is because ~3 days ago a hacker obtained control of a user's email account, requested a PIN reset, and thus used the user's email to take total control of the BTC-TC account.  I've been investigating and trying to find a way to prevent this going forward.  The user was a gmail user, they could have used 2FA on their email and prevented it.  But that is not my focus because other email providers do not have 2FA.  My focus has been trying to figure out a way to prevent reset requests from ending in compromised accounts.

This is especially true with PIN and 2FA reset requests.  It makes me sick to think that someone would turn on 2FA, then because that user's email gets compromised I might hand over full account control via reset request.  Ugh.

The alternative for me is to not allow reset requests.  And I don't think that's a good idea either.

I think instead what I'm going to do is setup an interface on the site where you can request PIN/2FA/Withdrawal Lock resets.  When you submit the request, it will go into a queue.  That queue will have a 30 day countdown.  At intervals during the countdown, emails will be sent out and updates posted in the portfolio page regarding the pending action.  Then at the end of 30 days whatever the requested action is will be taken.

I will also most likely offer an accelerated countdown to users willing to post an escrow of 150% of the value of the contents of the account, to be held for the countdown period in place of the account itself.

However inconvenient this may be, it should take care of 90% or more of the compromised email account issues.  Hackers simply won't be able to quickly profit anymore.

Can anyone else think of improvements on this plan?

Cheers.

Same here, i have also problem on Weexchange with 2-Factor. They have strange interface for that. Hope support will get me out of trouble, but i am already waiting for about 14 days

Does this one (http://www.maxoutput.com/authenticator/) is good to use with 2-factor ?
It work with bitfunder, then I would add 2-factor on weexchange and now I can't login again, weexchange is very "unstable" like a "beta website" 

The only thing that remains to do is the shares that are still in the issuer's account to not receive any dividends.

I took a look at Bitfunder, but am not that familiar with the details of listing shares of miners (specifically what the costs / caveats / issues are of being listed).

1. Are there additional costs associated with this? (Listing fees, mgmt fees, etc)
2. Are there any restrictions on shares? (Lockout timeframes, sale fees, who can buy/sell, etc)
3. How is EOL handled for the fund? (Yield < Power costs)
4. For a mining pool, how are hardware failures handled? (Direct dilution across the pool, specific person is SOL, share retirement, etc)

Sorry if these are elementary questions. I have experience with stock options (employee and "general"), RSUs, stocks, bonds, etc, but have never worked with something like this in the bitcoin space, and don't feel informed enough about it to vote "+1" or "-1".

Thoughts?

Hi Everyone,

Just a quick reminder to everyone; please enable 2-factor authentication at bitfunder. There have been reports of people having lost shares due to some cross-browser script. A fix has already been applied by Bitfunder to prevent this but still. Without 2FA you can only buy and sell shares but not transfer them to another user. This is for your own protection. This incident happened some time ago already but apparently some sites have news articles about it now.

Cheers!

Am I the only one finding your excuse for not refunding victims here a little disingenuous?

The 'htemp' hack has been documented by many people, and the root cause was a clear defect in your security model.  But you won't own up to the failure because somebody might pretend to be hacked?  You have a clear trail for anyone who had funds transferred to the 'htemp' account.

I don't see how you can justify not compensating victims in this case.  Considering the huge fees you are collecting on trades you should take a day's income and make your mistake right for the victims.  If you want to require 2FA for compensation in the future, that is a different matter.