What is your work experience in the security field?

What academical qualifications do you have besides googling concepts?

Who can vouch for your skills or known projects in any white or blackhat forum?

Do you know anything at all about programming a secure site or platform?

Aww neat. It's like the orbiting arrows signify how Mt. Gox lets your account information be sent "around the world". That's clever.

Got a makefile for your *BSD bitcoind build you'd like to share?

Would help the community with more/different OS builds out there.

I am a market anarchist but I think its good that they want regulation of the exchanges. How can that be? Some people will distrust bitcoins, and some others will try to attack it. By seeking to be regulated they are shielding themselves from this types of attacks. Also, its not like the governments were going to let them be. Governments were going to go for them anyways at some points, so you must as well do it on your own.

Dear Bitcoiners,

I'm sorry to hear that some people have had their account stolen, but I was expecting it.

The problem of Mt. Gox is that it grown too fast, without the correct investment in customer safety. The design of the site is not thought for security, and it is evident even from the API. Basic cornerstones like input validation, or safe data exchange are omitted, as if that was a blog and not a sensitive web application. Luckily Mt. Gox makes enough money to pay admins to control the money-flow.


The bigger problem anyhow, is that other exchanges have blatantly copied the design of mt. Gox, along with its flaws, and with a smaller budget. Thus I expect more security breaches. And this is a big problem for the credibility of bitcoins. Thus I invite exchange owners to:


1) Use the right software. IIS is a big no-no Also Linux should frowned upon. Unix is the way to go.

2) Update the software. You cant leave a known root escalation bug for 6 days!!!!

3) Have your code reviewed by a third party.

4) PHP security isnt too difficult, http://phpsec.org/projects/guide/ , still you missed most of the BASIC guidelines.

5) For god sake, you're moving hundred of thousand of dollars. Use a fucking dedicated server for the database. Accessible only by a local IP. If you wonder why I know this, then you should fire your admin.

If you own an exchange and would like to be safer, for a small fee (in the 5 figures) PM me, and I will tell you if your site is flawed, and if it is I can show you how I can have root access on the webserver at least.

JUNE 20TH, 2011      
EFF and Bitcoin
Announcement by Cindy Cohn

For several months, EFF has been following the movement around Bitcoin, an electronic payment system that touts itself as "the first decentralized digital currency." We helped inform our members about this unique project through our blog and we experimented with accepting Bitcoin donations for several months in an account that was started by others.

However, we’ve recently removed the Bitcoin donation option from the Other Ways to Help page on the EFF website, and we have decided to not accept Bitcoins. We decided on this course of action for a few reasons:

1.   We don't fully understand the complex legal issues involved with creating a new currency system. Bitcoin raises untested legal concerns related to securities law, the Stamp Payments Act, tax evasion, consumer protection and money laundering, among others. And that’s just in the U.S. While EFF is often the defender of people ensnared in legal issues arising from new technologies, we try very hard to keep EFF from becoming the actual subject of those fights or issues. Since there is no caselaw on this topic, and the legal implications are still very unclear, we worry that our acceptance of Bitcoins may move us into the possible subject role.

2.   We don't want to mislead our donors. When people make a donation to a nonprofit like EFF, they expect us to use their donation to support our work. Because the legal territory around exchanging Bitcoins into cash is still uncertain, we are not comfortable spending the many Bitcoins we have accumulated. Because of this, we’re giving the Bitcoins that have been accumulated, or that may accumulate in the future, in the account set up in our name to the Bitcoin faucet, so that they can continue to circulate in the community.1

3.   People were misconstruing our acceptance of Bitcoins as an endorsement of Bitcoin. We were concerned that some people may have participated in the Bitcoin project specifically because EFF accepted Bitcoins, and perhaps they therefore believed the investment in Bitcoins was secure and risk-free. While we’ve been following the Bitcoin movement with a great degree of interest, EFF has never endorsed Bitcoin. In fact, we generally don’t endorse any type of product or service – and Bitcoin is no exception.

We appreciate the outpouring of support we have received from the Bitcoin community and we share that community's commitment to privacy and innovation. We also appreciate their frustration with the privacy problems posed by existing on-line payment systems. However, EFF will no longer be accepting or spending Bitcoins.

[1] We understand that we cannot close the account that has been set up in EFF’s name and that returning the donations to the individual donors would be complex and difficult.