My point is that you should get your cert signed.

Hmm... I notice that unlike me, you are only taking select pieces of my post out of context to reply to them. I'd prefer if you did what I do and reply to the whole message. Wasn't it you who accused me of "ignoring what people say?"

HTTPS is certainly useful, however. It makes attacks more difficult and mitigates many threats.
Honestly, this is a little off-topic, but a yubikey is not much more secure than 2-factor auth with a cellphone, and I already own a cellphone. Coinbase does this correctly.


I hope that end-users are smart enough to not make hotwallet popular without a cert.
I'll try.
Yeah, that's why Google, MtGox, Microsoft, Bitcointalk.org don't have public signs either, because they're useless. Oh, wait...
It's better than nothing, but it probably won't help traffic to your site very much. A big, red warning is a turnoff for the non-technical.
It was an example. I'm not signing theymos' public key, and I'm certainly not signing Hotwallet's. Especially given that I consider theymos more trustworthy than Hotwallet.


If you can't point out an actual security flaw, please just stop posting on this thread. In fact please delete your posts so far. You've pretty much ruined it already.
[/quote]
Dozens? That's impressive. How many dozen?
No, I will not delete my posts. Especially given the fact that you've only quoted parts of them.

Wow that's a good idea. It could work several ways:

1. The tipper's tip could be split into a bet part and a non-bet part
1. a. The winnings could be sent to the tipper
1. b. The winnings could be sent to the tippee
2. Or, the tip could be sent entirely to the bet
2. a. The tippee could receive all the winnings
2. b. The tipper could receive part of the winnings

The question is, which one of these 4 would result in the most tips, and which one of these 4 would result in the tippee gaining the most money?

Lol...
Really at this point even theymos being the administrator doesn't mean he can re-write history. That's one of the main functions of PGP signatures -- anyone can dig this message up and prove theymos wrote it.

Well, I guess it does communicate that much.
I've already used multiple examples to show that my model is mathematically correct. The "PPT Paying 7.5% Weekly" is just the most simple of these. Additionally, "opportunity cost" or "time value" is factored in to the more complex version of the model. The "PPT Paying 7.5% Weekly" example contains a time value of just over 1%. However, if the time value were 0% (omitted), the value of YARR and related securities would actually be higher. This is why I omitted it -- it's simple and portrays YARR in a better light. But then...
I, based on your suggestions, elaborated and expanded on my representation of the model.
But this thread isn't about my mathematical analyses. If you would like, I can find the time to engage you in a formal mathematical debate. If it were worth it to me, I'd even write up a whitepaper. The idea, however, is simple enough that I do not think it merits a whitepaper.

As for counterparty risk, this is something which is mostly subjective and must be evaluated by each investor. It is, however, simple enough to factor in as a variable; I can show this if you intend to take up my debate offer.

If you say so. I hope you'll notice, however, that instead of ignoring what you're saying, I am splitting up the quote and responding to every last bit of it.
Of course the "No u" is classic. That's why I quoted it: it was an attempt to show how worthless insults are. If I were trying to cheaply troll this thread, I'd be insulting you more. However, it would seem that whether or not I am consciously trying to troll you, it's working. (Judging by the number of names you've called me in this thread.)

I understand that perfectly
So tell me, how does HTTPS prevent man-in-the-middle attacks?
That's a new one
Yep, and neither of us has gotten the scammer tag yet. Hallelujah.
I much enjoy your creations, especially the fact that you have the courage to create something so involved as an insurance company. You should step back for a moment, however, and look at the word "feedback." Not all feedback needs to be positive; negative feedback, when done correctly, is often termed "constructive criticism." My analysis of each insured pirate bond was neutral feedback. When you contested things such as the market price, I was bewildered. The fact exists that at a certain point in time, it was impossible to get shares of YARR on the open market for less than 1.89. Arguing about that seems rather pointless.
Who was it who cried wolf about Bitcoinica? Would you call them "rita repulsa?"
I have other "special skills" which I have successfully sold on bitcointalk.org, including GPG tutoring and programming. Aside from that, I enjoy reading posts from "Answer the question above with a question" to "[Full Disclosure] CVE-2012-2459 (block merkle calculation exploit)."
How about "sniff your login credentials on account creation?" That would work...

I'll shut up when the issue is fixed
Thanks
Have fun with that. lalalala I'm not listening!
Do you need a picture of me skydiving with friends with a shoe on my head?
Actually, my crusade against MPEX interests me more ATM. You know, the options exchange run by a law-breaking, content-stealing Romanian who runs a net loss business and hosts porn?
Well that's great. I'm glad that potential scammers in lending are pointed out preemptively, that BitDayTrade's security flaws are being exposed, and that people have noticed that VanillaWallet is not open-source and MtGox has apparent solvency issues. Surely these haven't been pointed out by the same guy?

Thanks. I'm not going to sign your cert, however. In fact, I haven't even signed theymos' public key.

Lol
If hotwallet becomes popular, "do[ing] a man in the middle attack on you to a website you've never even been to before" can become a viable way to make money. Especially if its owner says "oh just ignore that warning."
I'll come back to this last bit; I g2g.

Since when am I harassing anyone?

Lol calm down. I have 0.1 bet for shits n giggles (not only am I not a betting man, but I have no mouth to put my money in, so to speak) and I'm offering free escrow/proxy for this bet.

wat

I show you the math behind a unique hedging scenario and you tell me to "fuck off?"

wat

It mattered a lot. I would have bought every single one of them. There's only 3 scenarios:

I buy a PPT for 0.4 BTC and place a 0.5 BTC bet here
1. Pirate pays. I get 1 BTC from the PPT and give 0.5 to Matthew. 0.1 BTC profit
2. Pirate doesn't pay. I get 0 BTC from the PPT and get 0.5 from Matthew. 0.1 BTC profit.
3. Either the issuer of the PPT or Matthew defaults. 0.4 loss.

Given that #3 is very unlikely IMO, it would have been a win-win scenario.

Shit, I missed it. All the PPT's on GLBSE dropped below 50%, and I missed it.

For the suspicious, theymos' signature checks out.
Also, I love the comment about bitlane.

Screw that
I'm sure pirate's investors will be very happy if matthew helps pirate pay them back.

Maybe you can use some of your 10K BTC winnings from that bet! Think about it, one post from the Oatmeal, and the value of ALL of your BTC will soar!

As if "BitCoin" were an entity capable of doing so

He donated 50 BTC to the forums and made a couple hundred posts. I think that's irrelevant to the subject at hand, though.

Again, proxies. I'll proxy it for free, theymos will proxy for 6%, etc etc.

Holy shit. If I had hundreds of thousands of BTC, I'd sell $33K of them and make a donation. The exposure on the Oatmeal would surely drive the price up and I'd regain that $33K many times over

"No, u"
Insults like that carry no useful information and add nothing to this thread.
The warning contains information pertinent to all websites, and I've never been to Hotwallet before. You're handling other people's money. Real money.
Hell no. That's saying "just trust me." I will never "just trust" anyone, especially not in Bitcoin land.
Cool. I couldn't care less about my "tattletale" reputation. I "tattle" on potential scammers in the Lending forums too. Look how many people have MNW on ignore, yet they trust his word in a 5000+ BTC bet. The important part is...
I don't scam people, nor am I careless with their money.
That's the only part of my rep I care about.
Bad idea
No, it means you're the same person who said he was hotwallet the day before. In a nutshell, it's basically me "signing" your cert.
You're handling other people's money. Real money. And security should come first. Even before domain names.

I understand that perfectly. However, security should come first, because you're handling other people's money.
Those red flags are popping up all over the place. They're not just "face-value" warnings though. It's not just "oh, this could be a man-in-the-middle attack." Rather, it's "oh, this service is using SSL improperly. I wonder if other aspects of its security are done correctly? Passwords? Storage of BTC?"

Look at all the holes in BitDayTrade. Did you see the Reddit post exposing its flaws? It claimed to use bcrypt, but that was a lie. A lie which was only brought to light when other security flaws were discovered. This is why I have no money on either platform.

Don't take spectators exposing security flaws as personal insults. Take them as suggestions, and use them to improve your service. It's called feedback, and feedback is the main reason that developers even have this pre-release stage that Hotwallet is currently in.

I am quoting Google Chrome's warning. It should be self-explanatory for a web-dev such as yourself.usagi seems to love referring to me by name, rather than the substance of my posts. I do find humor, however, in the fact that I was quoting Google Chrome, a fairly reputable () web-browser.
The fact of the matter is that the blue part up there is misleading. Have you ever used GPG? It's the same concept. The problem is thus:
1. I create a keypair and a malicious version of hotwallet
2. I sign my malicious end and claim that the signature is from hotwallet.
3. I, the third party, intercept the information you supply.
4. Well, who are you to know any better?

SSL only works when a trusted third party signs your keypair. Then this happens:
1. I create the malicious stuff
2. I sign my malicious end
3. You check with the trusted third party (e.g. Verisign). They say "oh no, that's not really Hotwallet's keypair!"
4. You don't lose any personal info or bitcoins.

I find it humorous that usagi attacked others for their lack of HTTPS knowledge without implementing it correctly. And yes, the warning still appears:

I'd hire an HTML guy before PR. Seriously, the site looks awful

That's fair. Nefario has a rep there too, just not as much.

Also i cant find user "ciuciu" on the wot so I cant judge whether they are more or less trustworthy in this regard.
right here http://bitcoin-otc.com/viewratingdetail.php?nick=ciuciu&sign=ANY&type=RECV
I rated him a while back because of his deposit service. He's fairly trustworthy, a forum donator, and has been vouched for by multiple established members including hashking. Why do you need him to be trustworthy, though, when he states verifiable facts?
Yes.