Hello,

I'd strongly suggest against putting your bitcoin wallets in hosted virtual machines / virtual private servers (VPSs), as the owner of such infrastructure has full access to the VMs and can copy your wallets and use the funds at any point.

You don't really need the wallets until you want to pull out the BTCs, if you ever want to. So the wallet doesn't have to exist on the VM. Just let the bot run on the VM and make sure to restrict the API key to disallow it from withdrawing any funds.

It might be cheaper to buy a RaspberryPi per person and run them from home.

mitty,

Thank you for the estimates on the delivery. I looked into the difficulty increase at 30% and it chances of recovering money for a 600 GHs card look very dim, so I'll consider this 50GHs rig a loss and move on, rather than throw more cash at the problem and watch it burn. And yes, they still take the 10% transfer fee, to move you from one product queue to another.

I was looking a few other vendors who are promising deliveries of 400 GHs rigs in Oct & Nov, and some people have ordered 20 rigs! In the near future, those running the network will be filthy rich people and/or organizations, which makes me feel uneasy. What if governments decided to kill Bitcoin by simply driving up the difficulty, then when it's too high for anyone to buy a rig and run it at home, they shutdown their systems. This will ultimately all transactions unverifiable and Bitcoin dies!

Unfortunately I paid via bank wire transfer.

I'm not sure when this order will ship, but do you think that upgrading to the Monarch is a better option? The Monarch is 400 GHs and will be delivered in March.

I got a reply from BFL:

"Thank you for contacting Butterfly Labs. According to the terms you agreed to on checkout, all sales are final. Now that shipping of orders has begun, refunds will not be processed. Your order will be shipped per your position in the order queue."

If I do order the Monarch, there's no firm deadline on it, and we all know how good BFL is with deadlines (rolls eyes). It's quite tempting to be honest, but if the Feb promised deadline becomes June 2015, then it's useless, just like what happened to my Single SC 60 GHs, which I ordered in April 2012, and only got it last week. Huge hit on the RoI forecast.

Are you offering 2 things here? To buy my order for 15, or to sell yours for 20-25?

Also, which exchange do you use, so that I know the BTC-to-USD conversion rate.

I reduced my asking price from $2150 to $1950 (-$200).

Unfortunately, I paid via bank transfer :/

Greetings,

I have a 50 GHs Single SC already paid for and the order is in processing by BFL, made in July, and the order number is 100072501. It hasn't yet been shipped. It can be upgraded to the Monarch.

My asking price is $1950. It can be paid via BTC or SWIFT bank wire transfer. When stating the price in BTC, please specify which exchange you use to know the conversion rate. (mtgox is higher than btc-e, for example).

Payment is to be delivered in advance in full. I will ask BFL if it's possible to either transfer the order to your BFL account, or change the shipping address to yours. If neither is possible, I will ship it to you for free via DHL Express (air).

If you wish to upgrade to the Monarch, and it's not possible to move the order from my BFL account to yours, you'll have to pay me in full in advance, and I'll pay BFL to upgrade the order. We'll calculate the total cost at that time.

If we're to conclude this transaction, we'll use John K's escrow service: https://bitcointalk.org/index.php?topic=141672.0.

21st-century

• An on screen key-board should be available to enter passwords should the user wish to avoid potential key-loggers on their machine. The location of the keys should be randomly generated to make recording mouse movement impossible leaving the only option of recording the screen.

If you suspect that your machine has a keylogger, you shouldn't be using it in the first place.

• An expiration for cookies should be user specifiable.
• Accounts should automatically log out after x minutes.

What's the difference? If you're logged out, your session/cookie is no longer valid.

• Complexity of passwords should be such that brute forcing the login form or the hash is computationally impossible.

While you could enforce minimum password length, enforcing complexity results in Sticky-Note Security: Users won't remember the passwords & instead write them down & paste them on their monitors or write them in their phones.

• Security alerts emailed to users after x amount of invalid attempts.

Why annoy the user with failed attempts? The attacker can be block listed for 15 minutes (based on IP/Browser/Cookie).

• User definable limits on withdrawal.

What difference does it make? If an attacker gained access to the account, s/he could change that limit.

• Only services on the exchange that need to be accessible should be.
• Vigorous logging of activity should occur.
• The exchange should audit the clients for the potential of them being exploited by a side-channel attack.

Elaborate please.

• Exchange internal and external network should be audited and secure.

By whom?

smartcardguy,

Should the salting scheme be disclosed to the public?
Disclosing it would certainly provide the attacker with easier cracking, but using salting would generally mean rainbow tables are pointless, no?

BitCoin is divisible to the 8th decimal point and could be expanded in the future. Integer-only transactions won't work.

EmilyClark,
Whatever is mentioned here can be used by *any* online service, as it is not specific to bitcoins.

We're not asking them to disclose what security breaches are there. Only when they plan to roll such updates, how often, ...etc.

smartcardguy,

Account lockout is very frowned upon since it can be used for denial of service. I used to do it to certain abusers on Hotmail before when it employed that method.

Enrolling/trusting certain machines can be useful but also dangerous because if your session/cookie is hijacked, then no password is required and you're immediately impersonated. Personally, I only login from my own devices (laptop or phone) and not anyone else's, but I still wouldn't want to allow for the chance of having a cookie stolen allowing access to my account and enabling other systems as authorized systems.

Regarding passwords & hash salting, BlowFish has a very small footprint on memory (4kB) but dictionary attacks are extremely slow because that's how the crypto was designed (details on Wikipedia). I have a friend who was brute forcing passwords on graphics cards; he was doing 4000 million pwds/sec of MD5, but only 200 pwds/sec on blowfish. See the difference?

smartcardguy,
Please don't quote the whole thing. Just add what you want directly.

It's a standard procedure to be audited when you're making $1 million/month out of transaction fees. Keep in mind this is a legal company and it receives/sends funds through banks, so everything has to be audited and verified.

Dimsum,
MtGox makes a lot of money per month from transactions and fees, and it's being audited, so they cannot make false claims without being prosecuted (by investors, customers and the Japanese government).

bbjansen,

I have explained in other threads that while MtGox has been breached, it wasn't due to lack of security on their site but from an auditor's infected machine.

Honestly, since now MtGox has been breached, they'd tighten their security even more and that's an extra reason for me to trust them & stick with them.

Updated the list.