[ANN]First online MPEx brokerage now in public beta

[rini17]

https://coinbr.com allows everyone to trade on MPEx without creating MPEx account. Currently supported operations:

• Placing Buy/Sell orders
• Receiving dividends
• Option exercises
• BTC Funding*/Withdrawal** of any amount

All orders have signed MPEx receipts attached and there is detailed transaction/balance history available. Moreover, CoinBr offers referrals - you can earn commissions from trades of people you invite. More information on our page.

NEW(February 1, 2013): Double factor authorization for withdrawals, choice possible between Google Authenticator (google account not necessary) and bitcoin signatures.

If you already have MPEx account, you may be interested in our MPEx parser/JSONRPC proxy source code.

* Initial funding must be at least 1 BTC to unlock trading/referral functions.
** You can withdraw any amount, but withdrawal fee is to be considered.

[scrybe]

A few questions:

Funding page says it may be delayed up to 48 hours, why is this and are any risks associated with this process?

Do funds remain on your system, how are they protected? Will you be acquiring deposit insurance or limiting liquid funds/transfers?

What is the flow for an MPEx order through your site? Please include information on how the BTC flows as well as the order requests an confirmation.

Will I have my MPEx assets in a usable format if your brokerage closes? How about any BTC in my account?

Do you have any securities trading experience or licenses? Am I exposing myself to yet another legal headache, or are you?

You are not asking for any AML/KYC information, have you determined that this is not needed? Have you talked to a lawyer?

[stochastic]

A few questions:

Funding page says it may be delayed up to 48 hours, why is this and are any risks associated with this process?

Do funds remain on your system, how are they protected? Will you be acquiring deposit insurance or limiting liquid funds/transfers?

What is the flow for an MPEx order through your site? Please include information on how the BTC flows as well as the order requests an confirmation.

Will I have my MPEx assets in a usable format if your brokerage closes? How about any BTC in my account?

Do you have any securities trading experience or licenses? Am I exposing myself to yet another legal headache, or are you?

You are not asking for any AML/KYC information, have you determined that this is not needed? Have you talked to a lawyer?

Also should ask,

Do you accept unlimited liability for clients account holdings?

[rini17]

A few questions:

Funding page says it may be delayed up to 48 hours, why is this and are any risks associated with this process?

The funding is processed manually because of technical reasons. MPEx does not provide any explicit feedback when the bitcoins arrive to the account, only implicitly that the balance changed (it may have changed for any other reason). Moreover, if users fund their account indirectly via CoinBr, it may be necessary to move the funds to MPEx first.

Do funds remain on your system, how are they protected? Will you be acquiring deposit insurance or limiting liquid funds/transfers?

For direct deposits, this is non-issue. For funding via CoinBr, funds are moved to MPEx account as soon as any significant amount gathers in the wallet. So that sufficient liquidity is ensured at all times even if all users decide to place buy orders all at once.

What is the flow for an MPEx order through your site? Please include information on how the BTC flows as well as the order requests an confirmation.

At the moment, order is placed immediately when you click "Save". (It may be shown in "Queued" state but it means it waits for next STAT call to process further.) You can GPG-verify the receipt on the order detail page that it was placed exactly with the same parameters as you requested. Maybe later it will be necessary to really queue orders before submitting to MPEx to improve latency, but we'll always strive to place them asap.

Will I have my MPEx assets in a usable format if your brokerage closes? How about any BTC in my account?

We will either pay out to BTC address you provided on registration or move all assets to another broker.  If the closing will be catastrophical and CoinBr will be completely defunct (unlikely, there are continuously updated database backups on multiple physical locations), you will still have MPEx receipts that allow for reconstruction of your account. Sending them also by email is under development.

Do you have any securities trading experience or licenses? Am I exposing myself to yet another legal headache, or are you?

I cooperate with people that do have the experience and, as stated on the about page, we're open for working together with more people from community. We can hardly ask for any licenses when MPEx itself is strictly against regulation. You don't expose yourself to bigger legal headache than, for example, when downloading "pirated" intellectual property or playing in unlicensed online casino like SatoshiDICE. Unless you plan to hand yourself in, like Nefario did.

You are not asking for any AML/KYC information, have you determined that this is not needed? Have you talked to a lawyer?

We're aligned with MPEx opinion that Bitcoin (and any securities based on it) is akin to virtual game money and are thus exempt from regulation at the moment. Should any government use irrational suppressive measures, we plan to react similarly like MPEx, too.

Do you accept unlimited liability for clients account holdings?

We assume no liability beyond one implied by law.

[🏰 TradeFortress 🏰]

Bitcoin Credit Ratings

This thread has received a B- rating.

OP provides good explanations, and probably won't run away with your coins. Good business plan.

[MPOE-PR]

What are bitcoin credit ratings (and who are you again)?

[scrybe]

A few questions:

Funding page says it may be delayed up to 48 hours, why is this and are any risks associated with this process?

The funding is processed manually because of technical reasons. MPEx does not provide any explicit feedback when the bitcoins arrive to the account, only implicitly that the balance changed (it may have changed for any other reason). Moreover, if users fund their account indirectly via CoinBr, it may be necessary to move the funds to MPEx first.

Do funds remain on your system, how are they protected? Will you be acquiring deposit insurance or limiting liquid funds/transfers?

For direct deposits, this is non-issue. For funding via CoinBr, funds are moved to MPEx account as soon as any significant amount gathers in the wallet. So that sufficient liquidity is ensured at all times even if all users decide to place buy orders all at once.

What is the flow for an MPEx order through your site? Please include information on how the BTC flows as well as the order requests an confirmation.

At the moment, order is placed immediately when you click "Save". (It may be shown in "Queued" state but it means it waits for next STAT call to process further.) You can GPG-verify the receipt on the order detail page that it was placed exactly with the same parameters as you requested. Maybe later it will be necessary to really queue orders before submitting to MPEx to improve latency, but we'll always strive to place them asap.

Will I have my MPEx assets in a usable format if your brokerage closes? How about any BTC in my account?

We will either pay out to BTC address you provided on registration or move all assets to another broker.  If the closing will be catastrophical and CoinBr will be completely defunct (unlikely, there are continuously updated database backups on multiple physical locations), you will still have MPEx receipts that allow for reconstruction of your account. Sending them also by email is under development.

Do you have any securities trading experience or licenses? Am I exposing myself to yet another legal headache, or are you?

I cooperate with people that do have the experience and, as stated on the about page, we're open for working together with more people from community. We can hardly ask for any licenses when MPEx itself is strictly against regulation. You don't expose yourself to bigger legal headache than, for example, when downloading "pirated" intellectual property or playing in unlicensed online casino like SatoshiDICE. Unless you plan to hand yourself in, like Nefario did.

You are not asking for any AML/KYC information, have you determined that this is not needed? Have you talked to a lawyer?

We're aligned with MPEx opinion that Bitcoin (and any securities based on it) is akin to virtual game money and are thus exempt from regulation at the moment. Should any government use irrational suppressive measures, we plan to react similarly like MPEx, too.

Do you accept unlimited liability for clients account holdings?

We assume no liability beyond one implied by law.

Thanks for the info, quoted for posterity.

Looks like you have the basics covered, I'll look forward to future developments, and might try it out soon.

[AngryCatfish]

Bitcoin Credit Ratings

This thread has received a B- rating.

OP provides good explanations, and probably won't run away with your coins. Good business plan.

Damn I was looking for A++ I guess I'll jeep looking...

[Stephen Gornick]

Currently supported operations:

There doesn't currently appear to be any way to change my password when logged in.   Sometimes minimally viable product site builders will say that functionality exists through the "forgot my password" / reset capability but I don't see that capability either.

Also, there is no multi-factor authentication option for login.

Or more importantly, for there is no way to require multi-factor authentication for withdrawal:

A plea to exchanges ... lets do 2 factor right!
 - http://bitcointalk.org/index.php?topic=109424.0

[rini17]

Currently supported operations:

There doesn't currently appear to be any way to change my password when logged in.   Sometimes minimally viable product site builders will say that functionality exists through the "forgot my password" / reset capability but I don't see that capability either.

Also, there is no multi-factor authentication option for login.

Or more importantly, for there is no way to require multi-factor authentication for withdrawal:

A plea to exchanges ... lets do 2 factor right!
 - http://bitcointalk.org/index.php?topic=109424.0

Thanks for feedback.

The project focused to start with most often used functions, which, hopefully, password reset isn't. The form for that, using "sign message" function of the bitcoin address you have provided on registration is fully specified and will be done. Until that time, in case the need arises, we can resort to using GPG encrypted e-mail or similar method.

As for two factor authentication, we agree it is important and can't even think to go out of beta without it. The withdrawal form already has some weak protection by one-time token and by the time the withdrawal is processed (while the balance is subtracted immediately, so user has some time to react). We still aren't decided which method to implement with our limited budget - even the thread you recommend did not agree on best way how to do it. It discusses mostly browser session hijacking, against which the browsers are increasingly patched, but not phishing or hacking GMail account.

[MPOE-PR]

Currently supported operations:

There doesn't currently appear to be any way to change my password when logged in.   Sometimes minimally viable product site builders will say that functionality exists through the "forgot my password" / reset capability but I don't see that capability either.

Also, there is no multi-factor authentication option for login.

Or more importantly, for there is no way to require multi-factor authentication for withdrawal:

A plea to exchanges ... lets do 2 factor right!
 - http://bitcointalk.org/index.php?topic=109424.0

Thanks for feedback.

The project focused to start with most often used functions, which, hopefully, password reset isn't. The form for that, using "sign message" function of the bitcoin address you have provided on registration is fully specified and will be done. Until that time, in case the need arises, we can resort to using GPG encrypted e-mail or similar method.

As for two factor authentication, we agree it is important and can't even think to go out of beta without it. The withdrawal form already has some weak protection by one-time token and by the time the withdrawal is processed (while the balance is subtracted immediately, so user has some time to react). We still aren't decided which method to implement with our limited budget - even the thread you recommend did not agree on best way how to do it. It discusses mostly browser session hijacking, against which the browsers are increasingly patched, but not phishing or hacking GMail account.

One poor man's solution to the 2fa problem might be something stolen from gribble: if a withdrawal over a set amount is requested, user receives via email a challenge, which is a gpg string they have to decode. If the user fails to respond with the correct string the withdrawal isn't processed. Maybe have these expire in a set interval (24 - 48 hours?), and also allow the user himself to set the trigger amount (and don't display it anywhere on the user pages, so an attacker can't learn it).

[rini17]

Password reset function is now available, 2FA for withdrawals is next. We plan to provide two methods:

• BTC address sign message (same as password reset)
• HMAC, most likely Google Authenticator - preferable if you have offline wallet backup and want to keep its usage to minimum.

[burnside]

I'm considering using CoinBr to trade MPEx assets.

Can you walk me through the trade process between CoinBr and MPEx?

IE, I place an order.  What steps does CoinBr take to execute that order?  Details please.

Thanks!

[MPOE-PR]

You know, irc won't bite.

[burnside]

You know, irc won't bite.

A lot of the irc servers have policy against publicly quoting the conversation logs.  I don't like that very much.  What is freenode's policy?

Cheers.

[picobit]

If I use such a broker, will assets formally be issued to me, or to the broker?

I guess that MPex will GPG sign that the asset was issued to the broker, so if the broker goes broke, do I have a problem?

[rini17]

I'm considering using CoinBr to trade MPEx assets.

Can you walk me through the trade process between CoinBr and MPEx?

IE, I place an order.  What steps does CoinBr take to execute that order?  Details please.

Thanks!

I think this has enough details:

At the moment, order is placed immediately when you click "Save". (It may be shown in "Queued" state but it means it waits for next STAT call to process further.) You can GPG-verify the receipt on the order detail page that it was placed exactly with the same parameters as you requested. Maybe later it will be necessary to really queue orders before submitting to MPEx to improve latency, but we'll always strive to place them asap.

[burnside]

I'm considering using CoinBr to trade MPEx assets.

Can you walk me through the trade process between CoinBr and MPEx?

IE, I place an order.  What steps does CoinBr take to execute that order?  Details please.

Thanks!

I think this has enough details:

At the moment, order is placed immediately when you click "Save". (It may be shown in "Queued" state but it means it waits for next STAT call to process further.) You can GPG-verify the receipt on the order detail page that it was placed exactly with the same parameters as you requested. Maybe later it will be necessary to really queue orders before submitting to MPEx to improve latency, but we'll always strive to place them asap.

It is not.  I read the thread before posting, thanks.

Details.  Please.  Where is the GPG key stored?  Where does the passphrase come from?  If you want users to trust the platform, you're going to have to be a little more transparent.

Cheers.

[rini17]

I'm considering using CoinBr to trade MPEx assets.

Can you walk me through the trade process between CoinBr and MPEx?

IE, I place an order.  What steps does CoinBr take to execute that order?  Details please.

Thanks!

I think this has enough details:

At the moment, order is placed immediately when you click "Save". (It may be shown in "Queued" state but it means it waits for next STAT call to process further.) You can GPG-verify the receipt on the order detail page that it was placed exactly with the same parameters as you requested. Maybe later it will be necessary to really queue orders before submitting to MPEx to improve latency, but we'll always strive to place them asap.

It is not.  I read the thread before posting, thanks.

Details.  Please.  Where is the GPG key stored?  Where does the passphrase come from?  If you want users to trust the platform, you're going to have to be a little more transparent.

Cheers.

GPG key is stored on backend servers (one at the moment, there will be more soon for higher availability) that are physically safely located - not even colocated, they don't need very fast connection. Passphrase is held in memory and must be entered by hand when server starts. The software used is open source.

If I use such a broker, will assets formally be issued to me, or to the broker?

The assets are yours, by all definitions broker is someone who only facilitates the trade.

I guess that MPex will GPG sign that the asset was issued to the broker, so if the broker goes broke, do I have a problem?

I described the precautions in this thread already. MPEx issues GPG signed message - receipt that an asset was bought/sold and CoinBr makes the receipt immediately available to you on order page - like in the screenshot. (It will be also sent by email, this is under development, together with GPG-signed daily account statements). It can be used as a proof that this trade was done on your behalf.

We use CoinBr MPEx account exclusively for client's transactions, and if client goes broke it only affects his account in CoinBr database, nobody else. For speculation (like the loans I took) and testing different personal account is used.

Thank you both for inquisitive questions. I'm looking forward to you requesting such transparency from other exchanges or MPEx brokers/passthrough operators.

[burnside]

GPG key is stored on backend servers (one at the moment, there will be more soon for higher availability) that are physically safely located - not even colocated, they don't need very fast connection. Passphrase is held in memory and must be entered by hand when server starts. The software used is open source.

I was worried about that.  Quoting that page:

Warning: This MPExAgent version does not support any authentication! Anyone who has access to the listening port, can freely issue MPEx commands in your name. Try it only behind firewall. Patches to support HTTP authentication (should not be hard to add, twisted supports it) or other means are welcome.

If anyone gets CLI on your box all of your brokerage's shares are pwned.  Only hedge I see against this would be some kind of agreement from MPEx to roll back trades if that situation were to occur.  Do you have such an agreement?

Thank you both for inquisitive questions. I'm looking forward to you requesting such transparency from other exchanges or MPEx brokers/passthrough operators.

Absolutely.

Cheers.