Looks like my plan to open a safety deposit box at least 10km from my home for off-site back-ups may raise a couple of red flags:

There are two branches within about 5km. I want my safety deposit box or house to survive a city destroying
event. Off-site backups mean bimonthly or biweekly access as well.

A little off-topic though.

But.. Patents are evil!

Edit: Specifically, they allow you to prohibit competitors from using the same technique. Not good for a decentralized currency. Also, Artfonz may have prior-art.

You may run into trademark issues using such an obvious derivative of e-bay.

Have you checked out the existing BTC auction sites/classifieds?

I get the impression that 1.2.3 is there so that the Arbitrator sides with Cavirtex when you complain they took all of your Bitcoins. Maybe I am just being cynical.

Bitcoins do have value: they are backed by proof-of-work and a public transaction history. It is possible people won't value them in the future, but for now they have value.

When I was reading 1.2.1 and 1.2.2, I was thinking: Why does it matter what I think they are? If there are legal issues in dealing with a commodity or currency, doesn't it only matter what the regulators think?

There is a good argument for saying it is not a currency: it is not backed by any Government. Most the laws dealing with currency assume currency must be backed by government. Using that logic, Canadian Tire money is not considered a currency either. Both Canadian Tire money and Bitcoin are "Money" (a medium of exchange).

I suspect "Security" has a similar specific legal definition. I don't know why I equated securities with commodities earlier. Edit: I believe commodities have inherent value; ruled out by 1.2.3.

I still think encryption should be disabled by default. One issue I have seen in the forums is that many users are not even aware a file called "wallet.dat" exists; and that portions are secret. Upon learning about it, the first thing demanded is some kind of encryption like GPG.

Of course, with money on the line; you don't ever want the user to accidentally forget the passphrase. Getting a passphrase right is difficult, even if you know what you are doing. That is why I think the user should be assigned a randomly generated passphrase.

I guess I am advocating an "all or nothing" approach. If passwords don't really enhance security because they are too short, why bother?

With exponential growth Bitcoin looks like a scam. I don't plan to exclusively buy and hold. So, if I bought at $3, I may have spent half already leaving me with only 100 BTC. If I buy at $20, the same goods and services would only cost 15 BTC, leaving me with 15BTC.

Having just typed that, the calculation looks even worse. Keep in mind the only way bitcoins will go up to $7000 each is if people actually spend them. Those 10,000 BTC pizzas probably paved the way for eventual dollar parity.

I am helping out the network by relaying transactions. I know the odds of "winning" are something like 1 in 50,000. I plan to move mining to my laptop which draws only 12 Watts (and can be run from solar power if need be). (Edit: Why would I even bother with 670 milihashes/second? (In SI notation case is important))

As for security, I don't think I have any trojans to worry about. In the coming weeks I plan to play "musical computers", reformatting several disks. I am more concerned about making a costly mistake. Two months ago I don't think I knew about the possibility of just using a paper wallet/bitbill.

PayPal does not require you to have a PayPal account to pay a merchant using PayPal's services: all you need is a credit card. If Easy coin really is just a payment processor, you would not need an EasyCoin account to pay somebody using Easycoin: just send them Bitcoin to the address generated for that transaction.

Sounds like you get smaller payouts. On average, you will get money in a pool before solo mining, but the payout is split. If you are solo mining, you may be waiting a long time and never get a payout if the difficulty rises.

It may not be possible due to "know your customer" laws. I recently opened a USD Canadian bank account and they wanted two peices of ID.

The big Canadian banks are:

• BMO Financial Group
  
• Royal Bank
  
• Scotia Bank
  
• TD Canada Trust
  

I get the feeling I am forgetting one..

To accept a transaction with zero confirmations: the merchant should, at the very least, verify the coins exist. To do that they would check the block-chain for the coin creation transaction. I am not sure what kind of hardware you would need to guarantee that it happens within seconds though.

Part of the problem is that browsers treat self-signed certificates as more insecure than plain HTTP.

What should happen is that the browser pops up a warning saying: "Warning: this certificate is self-signed. You should check the the certificate fingerprint (SHA-1 9e8d c573 7f6e 8fa2 b112 fd30 62fa 1af2 305d cc53) matches the fingerprint you received out-of-band (such as in the mail, posted on the premises, etc)." Even if you don't check the fingerprint, the browser should save the certificate and warn you if it changes in the future.

When you go to a website using just plain old HTTP, the browser should pop up a warning (unless you are using IPsec authentication) saying: "Warning: This website is using an unauthenticated connection. Third parties can monitor, intercept, and manipulate any communications between you and the server."

A trusted payment processor. Or, the business can assume the transaction will go through once transmitted with no confirmations for small transactions.

It you read the Terms Of Service for your Internet connection, you will probably find you are not allowed to accept incoming connections (the no servers clause).

Of course, If you are not allowed to host a server, you really only have half an Internet connection. The Internet Protocol is inherently peer to peer. Though, I agree it should be replaced by IPv6.

If transaction volume keeps going up exponentially, bandwidth caps are going to be an issue as well.

Let's assume bitcoins are worth $7000 USD each in two years. The difference between buying at $3 and $20 is not that big a deal. I don't want a valuable wallet.dat on any of my machines until I am ready.

If I make over 10 transactions before the value drops to $0 USD each, the difference between buying at $3 or $20 is moot as well.

I am currently mining at about 670khash/s from a live CD. I am not sure what I would do if I actually processed a transaction by mistake. Likely make an offline wallet and send the coins to it.

Edit: Another reason I have been in no great hurry to purchase Bitcoins is market volatility. I started valuing Bitcoins at the 30 day weighted average price. Since the spot price is now 25% below that, I should be snapping them up

Yeah, I was excited until I read the VIRTEX TERMS OF SERVICE.

If Bicoins are not a currency or commodity security, what are they exactly? A novelty? Why should I trust an exchange that considers Bitcoins a novelty?

The line about no inherent value can probably be re-worded as well.

The sections that concern me more:
That link does not even reference the terms of service. Clauses like this are common ernough that I have been considering writing a robot that would periodically (daily) crawl all of the websites I use and check if the "Terms Of Service" have changed. If they have, the bot would generate an e-mail with the diffs.

The word "indemnify" means I have to pay for their lawyers. I am also expected to cover any undisclosed indemnity agreement they have entered into as well.

The account draining clause is quite steep. It is not clear what happens to any bitcoins, since the agreement only talks about Canadian dollars (Article 16).

The "don't sue" clause.

I don't have a secure place to store my bitcoins at the moment. By "secure" I mean secure from attackers and data-loss.

I have been putting off setting up my computers properly for about 6 years now. Everything is predicated on getting the fileserver working with verified back-ups. I am optimistic I can be up and running by the 14th.

I found out about bitcoin months ago and decided I liked the concept.

Recently (about 2 months ago), I took a second look; planning to buy some. I think the price as about $3 USD then. I still don't have any bitcoin. I want to have all of my ducks in a row first.

About one month ago I started signing my e-mail using gpg. Now that I have a public key, I can participate in a web-of trust. People can also send me encrypted e-mail (though I have not actually been able to reply with encrypted e-mail yet).

I investigated getting a safety-deposit box for my "savings" wallet; over 10km away from my house. While I was at it, I bought an external hard-drive so that I can keep an off-site back-up for my fileserver in there as well. I also bought a USB key for holding an encrypted copy of my wallet.

I also plan to use full-drive encryption on my laptop computer, and start using better password management. Password management will include a list of websites I have an account with and passwords stored in my safety deposit box. Since the information is kept in one place, I can then change those passwords periodically. For low-value passwords, I will likely start using a browser keyring as well.

Before investing in mining hardware, I plan to focus on network connectivity first. In particular, I plan on IPv6 connectivity, and hopefully finding a reasonably priced connection I am actually allowed to use. Because I no longer trust my ISP, all HTTP traffic will be sent down an encrypted tunnel. If I really am a multi-thousandaire after a year of holding bitcoins, I will likely invest in "big iron" boxes that would be mining only to protect the network.

Edit: I also plan on spending Bitcoin. I don't do online banking or use a credit card, so my transaction fees are quite high. Even if bitcoins are worthless in a year, I expect bitcoins to pay for themselves after only 10 transactions.

TL;DR: I am risk-adverse and am taking my time. I would not be surprised if I am considered an "early adopter" in two more years.

I had a thought: The user should not choose the password. the average user does not know how to choose secure passwords.

The user should be presented with a random 24 character base58 passphrase (128bits of entropy) and told to write it down twice. One copy should be kept off-site somewhere such as a safety-deposit box. After the user clicks "OK" without reading the message, the user should be prompted to enter the passphrase they just copied down. If they fail to enter the passphrase, they should be reminded that losing the passphrase is equivalent to deleting their money permanently*.

Of course, some (most) people will find such a long passphrase inconvenient. I think encryption should be optional. Though, I think a better approach would be support for multiple wallets: One with no encryption for petty cash/impulse purchases, and another for a wallet that is only accessed occasionally to pay bills. A savings wallet should not be stored on the computer at all; though the address for the savings wallet should be.

*Edit: I don't mean the nag screen should be permanent...
Edit: only one copy (the off-site one) of the passphrase would need to be written down if a smart-card is used to store an "easy to use" copy unlocked with a short pin.

As an unconfirmed user, this is good to know.

Don't have any Bitcoin to may name yet, but I am slowly working on it.

Some people believe that governments can help people pool their resources to achieve thing they or the free-market wouldn't achieve alone. It is obvious that with the unclear status of bitcoin everyone can use their discretion.

You choose if you want to report it as capital gains, hobby income, or commodity trading. If the Government comes around and makes some kind of ruling on the issue, you can re-file your taxes with the corrected numbers. Refiling may be more painful if you actually owe a large sum of money you did not declare already.