Please do not rely on .com or any domain likely to be seized by a government outside of the jurisdiction in which an exchange actually operates.  For instance, if you use peatio.com, you should expect to needlessly be part of a bulk domain seizure by the US government.  All of your subexchanges are likely to be pulled offline at some point.  The USG does not typically respect other countries' sovereignty where doing so would diminish its own.

Just as importantly, many of your prospective customers will worry that your exchange may go offline, which may send them elsewhere.

If you still prefer the marketability of .com, there is a workaround you may favor:  for anyone going to xy.peatio.com, immediately redirect them to a true .xy domain or to an offshore top-level domain you can trust ("xy.peatio.ok"), where .xy represents each country.

The redirections must be visible so that your customers will always know the true URL, so that when your .com is pulled, they know what to do.

The redirections should properly support https:// or they will encourage man-in-the-middle attacks.  (For that matter, anyone going to the http:// version of any of your sites should simply be told to try again with https://.  It is always insecure to passively redirect non-SSL to SSL connections.  Most sites violate this critical rule.)

rUTpfjKqFkrV7oJBLnBbrVUVEx5n5zVPra

A fine point ... but perhaps best not to characterize this paper or its terminology as Microsoft's.  A copy is available at their website, but two of the three researchers, including the lead author, are with the School of Engineering and Applied Sciences at Harvard University.

Can you elaborate on why you feel valuable work could "allow participants to sell the same work twice"?  I think that's probably inaccurate: instead, I think the work must be provably FRESH (created during the current block cycle and not earlier).

I don't think the work has to be inherently worthless IF there is some way to prove it wasn't done earlier.  If we can refine the exact requirements we may be able to see a way to merge much more useful work with bitcoin.

Note: I certainly enjoyed the reference but it does not seem to explain this point.  It merely states:

I'm telling you, that idea of an "Internet" will never work if you ever open it up to the masses.  You will someday have hundreds of millions of people all thinking they can establish connections to each other at will, worldwide!  We're not just talking about "E-mail" and "Usenet" nonsense, which are also impossible with too many users, just by themselves.  You will wind up with people on radiotelephones actually expecting to be able to watch videotapes!  It will never scale, can't be done.  It is IMPOSSIBLE.  It is an O(n^2) problem at least.  Forget these silly fantasies.  Just call me when you'd like more text files and I will bring them to you, clear across town, on another state-of-the-art 5.25 inch floppy diskette.  Stay with what works, Alex.  Stay with what works.

Seems you're so far ignoring cached/pooled & queried/polled data options available to programmers (you say you are one).

Let's not incorrectly assume that every client must see every transaction.  Many clients haven't even been invented yet, such as for many mobile devices and for those on slow or expensive connections.  So what you said about problems "by design" need not apply to them.  ("By design" is a Microsoft term used to excuse the company from doing proper software design and actually resolving problems.  "By design, this bug has existed in all versions of Windows since Windows 3.1 and we have no intention of fixing it.")

Any client which can't handle the entire block chain can simply establish a secure, low-speed connection to a trusted client which can.  For example, at your request, your mountaintop phone-based computer with an expensive satellite Internet connection can simply ask (poll) your desktop back in the city for the current balance of your wallet, and for the current number of confirmations there are for the handful of payments it has personally sent or received.  So a mobile or dial-up client only needs to query a well-connected one for a FEW pieces of data on an OCCASIONAL basis.

Let's also not pretend the Internet can't grow if needed to accommodate a critical financial infrastructure -- although a massive bandwidth increase shouldn't be needed, as just discussed.

As far as distributing all or part of the massive block chain history is concerned, a cached (mirrored) copy from the cloud (provided by, say, Akamai) would suffice, provided it remains possible to connect to individual clients at random to acquire copies of the latest blocks.  The latest blocks validate the prior blocks (not just the reverse), so Akamai could not simply invent a false block chain to distribute for fun & profit.

To the original poster:

I think we should clarify there is no evidence here that Instawallet is acting like Mybitcoin.  Please consider updating the title of the thread or adding a note to the first post.

What has been suggested is that attempts to view/use more than one Instawallet at a time can confuse the site, the browser, or both.  That should be brought to the attention of the Instawallet operator immediately, especially by someone who can provide an exact example.

(This thread may have enough detail already -- experiments might be hazardous to your balance!)

Many new web services exhibit issues when multiple tabs/windows are opened in the same browser, or when the 'Back' button is used, or when a 'Submit' button in a form is pressed repeatedly.  I recently noticed a certain Google service acts erratically or hangs (without any error message) after I open a second browser tab and log into a different Google service with a different user name.  If you have dozens of tabs open, it's hard to avoid these situations.

Where irrevocable transactions are concerned, this sort of issue could conceivably lead to a loss of Bitcoins or payment from an unintended wallet.

Right.  And I was asking about how those exchangers handle it.  Bitcoin itself takes the place of a Pecunix or Liberty Reserve currency, but still needs viable exchangers.

(All 3 currencies are non-revocable.)

Tradehill is correct that the Dwolla blog suggests transactions are free of chargeback concerns.

But unfortunately, Dwolla's (current at least) "Terms & Conditions" -- which includes clauses overruling anything they might say anywhere else -- states the following, in sharp conflict to the Dwolla blog entry:


Dwolla wants to depend on ACH (Automated Clearing House), which is inherently reversible.  MtGox & Tradehill want to depend on Dwolla.  And we want to depend on them for fast, convenient transactions.

There is a problem here which may ultimately force us to revert to bank wires, bank checks, money orders, and other cashlike transfers.  To buy a non revocable currency might take a non revocable transaction.

Does anyone know how exchanges for Pecunix, Liberty Reserve, etc. handle this issue?

One way might be to limit the size of transfers for new customers of exchanges ... while absorbing a certain amount of new-user fraud as inevitable.  I would be sad to see that happen, because it would raise exchange fees, reducing one of the great advantages BTC exchanges have over traditional markets.

As a compromise, higher fees could be assessed only on revocable deposits: users would pay more for convenience & speed.  Exchanges could thereby self-insure or obtain insurance against losses to fraud, without eliminating rapid transfers.



Sources:

Dwolla blog, http://www.dwolla.org/blog/retail-merchants-rejoice-web-kiosk-online/ which currently says "Remember, these are cash-based transactions! No credit card fees, chargeback concerns, or signing necessary!"

"Terms & Conditions" link on the registration page at https://www.dwolla.com/register.aspx#

From a short-term speculative point of view, yes.  But those starved of BTC recently who are focused on using them to conduct commerce may have been pleased to get a discount of up to $3.50 on their purchases.

Also many buyers may have layered their initial orders with smaller amounts at slightly discounted prices and larger amounts at lower prices, the latter of which may not be reached.

It seems the repeatedly delayed, unpredictable, and slow start to trading has avoided (or postponed) a frenzied drop in value that could have rapidly become self-reinforcing for a while.

Sadly, all the calculations are intentionally pointless.  It's "make work" for computers.  Basically a lot of random numbers are created then thrown away.  It's fishing the ocean of numbers for the smallest fish (hash) still left to find.

I'm very pro-bitcoin, but disappointed that its visionary developers haven't yet come up with a way to pair an actually useful computation with the fantastic amount of hardware and electricity we've amassed.

The project itself is extraordinarily valuable, however.  The proof-of-work concept that powers and regulates it has in fact brought about a practical worldwide cryptocurrency and that is an astonishing feat.

And in the future when mining becomes unprofitable for power-hungry GPUs and shifts to optimized, low-power devices, we may see the system self-adjust the frenzy downwards to a much less wasteful level.  Or we may see a transition into a useful substitute for hashing which yields profits while simultaneously maintaining the reliable flow of BTC.  Otherwise the costs of all the electricity and periodic hardware replacement may make bitcoin more expensive than some other alternative, which might then overtake it.

CPU mining looks great at first because you think, "Ah, I can do that more easily: I've already got one!  Just a free software installation."  Then 15 hours later (or hopefully 1.5) you come across a thread casually mentioning the time to find your first block with a CPU could run into years.

It's disappointing it worked out this way.  GPUs are better at some things (hashes & spewing heat for the winter) and worse at others, so it's conceivable bitcoin's proof-of-work system could have been designed differently to keep more people in the game longer.  Bitcoin is turning more into a Pro-to-Peer network than P2P in some ways, with some businesses apparently devoting entire floors to racks of miners.

GPUs themselves may be left rather behind by ASICs (application specific ICs) created for btc hashing ... or just by the overall growth of the network (in which case slower, standardized-but-customizabe FPGAs could outcompete GPUs due to their much lower electricity costs).

All is not lost, as some posters on these boards claim they have moves afoot to provide ASIC devices to the masses.  I say "claim" because ASICs are fabulously expensive to develop and one wonders whether they will go through with their plans of creating them, or whether they may later decide to keep the results to themselves after all that investment.

If you read the various updates at the MtGox support site, plus some emails that people posted on the forums here, as I recall you'll see them mention they may ask you about previous transactions or your balance.  Therefore it's not wise to tell everybody here you have $XYZ in your account, if anyone here might be able to guess your MtGox userid from your forum userid !

Perhaps you should edit your post to remove specifics about the length and type of password you used, too, because those things might not be visible to someone looking at just the hashed & salted user & password list, even though it was leaked webwide.

(Once something's hashed, its length & other qualities can be completely obscured.  However, MtGox implied they could determine the strength of the old passwords, which is a little perplexing unless they stored additional information beyond hashes or actually bothered to try cracking each one themselves.  I haven't seen the leaked document so can't comment further on what's in it.)

In any event, you could try preemptively contacting MtGox directly saying whatever you can remember about your account, when you opened it, what transactions you did, what your balance was, what IP address or ISP you use...  That's your best and maybe only way to show you're the rightful owner.

[The below posting actually ends very optimistically.]


Regarding your comments, I felt the same way and got away with it for the longest time, but the reality is this:

You will be right about being safe every time you go online
. . . until you are wrong !

I realized this when I more than once halted a partial intrusion (in the days before bitcoin), using a diligently adjusted outbound firewall.  The moment unwanted code runs on your machine, or might have, you may be toast -- and often won't know it.  (That's true with or without antivirus software, especially when up against stealthy wallet stealing code that could hurt you months after it runs a single time.)

Keeping every piece of software from every vendor up to date on Windows is just not very practical (and it's expensive, and so tedious).  Since then I have switched to Linux, where major distributions make it easy to update virtually all your software (including applications) at no cost, in one operation, without having to go to any websites or do much work at all.  But I don't pretend that I can be completely secure even now.

Since it only takes one infiltration to compromise your system, and since you could lose files or gain an undetectable rootkit, it makes sense to only keep low-value wallets (and no lists of critical bitcoin-related passwords) on daily-use machines, at least UNTIL a dramatically new level of security is available.  (Keep the rest on a non-networked machine for now.  An alternative might be to install a simple, trusted OS which has your Bitcoin client but nothing else, and on top of that to run a fully virtualized copy of Windows/Linux for daily use, provided you can ensure the guest OS can't directly touch most of your hardware.)


Appearances to the contrary, I think there actually are feasible, user-friendly solutions to the problem ... of beginners ... using Bitcoin clients ... with big wallets ... on possibly infected computers.  Coming up, I will discuss them in some detail with the developers or in the appropriate forums.

I've enjoyed reading hundreds of posts here in recent months.  Now with the bitcoin security mess I realize I have important contributions to make, so I registered to post.

To start off right I registered with a long, complex password with all 4 character groups (lowercase, uppercase, numbers, symbols), which will be unique for this site.

Then I logged in ... under plaintext http: .

Huh?

It's time to for all bitcoin-related sites to lock down their username/password registrations, logins, and password change pages, because we have seen more than anything else in my recent memory how aggressively people will collect user credentials on one site (MtGox) to try using them on other sites (MyBitcoin/Gmail/Tradehill/etc.) when money gathering is a motivating factor.

It's also time for anyone who registered here ages ago to consider whether they've reused their passwords elsewhere.


(There's probably no clear need for all pages on non-financial sites like this one to be run under SSL while logged in, since the overhead could be an issue.  But at least logins!)

150+ MHash/s might be good if you can achieve something similar on a less expensive device.  The analyses I've seen so far (brief reading only) implied the FPGAs they had checked could yield an excellent hash rate per watt but not per dollar sunk in the hardware.

As soon as you get out of the sandbox, please repost in the appropriate forum, or you could try PM someone over there now to come look at your existing post.  Your expertise and attitude is valuable.

Once electricity costs become a prime concern later on, FPGAs/ASICs may especially shine.  That is a relief to me because I am disappointed at the extraordinarily amount of intentionally useless* & wasteful* computational processing that this project encourages people to undertake across the globe, and the possible impact on the environment since most of our high-powered computers are ultimately ... coal-fired.


*At the same time, financial transactions done the bitcoin way may be one of the most useful & valuable services those people could ever help facilitate.  It's just disturbing that a more useful computational project has not been adopted to serve as proof-of-work (though I've read a proposal for just that in these forums.  (That was probably the discussion proposing a new coin project "Bitcoin Plus" aka "BCP" which would accept one-way conversions from original BTC.  No relation to bitcoinplus.com by the way.)

Also, the actual bitcoin genesis block was partly hand-tweaked, so to speak.  For one thing, it has a text message embedded in its coinbase parameter, unlike succeeding blocks.  This may be irrelevant however.  I haven't looked into running a standalone testnet.

Then there is the more recent example of the Namecoin project's genesis block...

Regarding the questions on Crossfire, I've read in passing that Windows drivers do not permit disabling Crossfire, and if that's still true your mining speed is likely to be somewhat slower than if using Linux.

Linux drivers do, and of course tend to allow a great deal more customization in general.

Bitcoin is an excellent reason to consider making the move.  Plus you could buy extra coins or GPUs with all the money you'd save that would have gone to paying for software upgrades and new equipment every time your OS maker redesigns things on a profitable whim.

Lending is about growing trust with third parties, not so much about the type of money involved.

So if you withdraw cash from an ATM off of your credit card (therefore, a loan), the bank doesn't care whether they could ever trace the serial numbers on those particular bills later on.

With bitcoin, even though the money can be almost anonymous, the users don't have to be.  If you so chose, your brokerage could know all your relevant details, and you could know theirs, and if you failed to send them bitcoins you lost in a bad short trade, or to meet margin calls, or whatever, in many countries they would be able to pursue collections through the legal system just as they could enforce their contracts with those paying in older currencies.  (Contract law is about agreeing to do something beneficial to both parties, and the law doesn't reject agreements just because they might be unusual.  That is, except where politicians may react by restricting the legal rights of bitcoin holders.  In that case, your broker must fall back to a "sorry, no more business with you" stance.)

Amazingly, since senders and recipients can actually undeniably prove whether or not bitcoins have been sent and received as promised (see below), your broker would have to wait at most a few hours before beginning collections, rather than the 90 days it can take for some banks and money order companies to confirm & process claims.

(However, even though it's possible, I'm not advocating running to authorities to enforce bitcoin contracts.  We should solve these problems mostly with technology.)


Now back to your regular bank that totally loses track of their paper bills once they hand them over the counter to you.

Tracing that money might be easier with bitcoin, since there's a globally available database tool called Block Explorer that anyone can use to see certain aspects of the entire history of every "coin".  To a very foolish criminal, a bitcoin bank could conceivably say "You're actually still holding the money we gave you, so you can pay it back!" -- something impossible with paper currencies.  However a careful user's privacy is only slightly compromised.

(This also could allow you to verify YOUR bank is still holding YOUR money separately for you as agreed, but only if things were set up with that in mind.  I don't want to mislead anyone into thinking you can do this with today's companies like mybitcoin.com, which tend to pool the funds they receive.  Once funds are transferred even once after you deposit them, they can* become vastly harder to trace unless your "bank" takes steps to help you do so.)

*For completeness I should add that there is a peculiarity in the bitcoin client which may leave unexpected traces if someone sends funds directly back to themselves after receiving them.  This is processed differently from standard transfers to other parties.

It's good to be able to take brief short positions, although that is probably not the ultimate direction of this market, despite all the recent news.

Fortunately, it appears possible already.  Have you looked at https://bitoption.org/ ?  All bitcoin markets are in their early stages but already the machinery exists to buy put options.

Their FAQ explains how that's possible: "Is this Escrowed trading?  YES. You are guaranteed to be able to execute once you've purchased a contract."

Of course you said "reliably" and there you may disagree, because the site has so far relied on using the MtGox exchange.  But since these are separate businesses (AFAIK), they'll change that if enough of their users don't regain faith in MtGox.