[CLOSED] CoinLenders

[theGECK]

Number one on that list is trust. How can I trust putting 10 BTC(a decent sum of money) into CoinLenders if the website looks like it was built in 15 minutes? The choice is not rational or thought out, its automatic.

You shouldnt decide whether you trust someone enough to trade with them/lend to them based on the design of their website.

You really shouldn't, but psychologically we do.

It happens in movies all the time--the protagonist refuses help from a scraggly, "scary" looking man, and goes with the young charmer. Who turns out to be a con artist or ax murderer. And scraggly man comes to the rescue!

Of course you can choose to override your instincts and not be swayed by looks. But most people don't because they've never thought about it.

Craigslist makes money and looks horrible. Also, this article (will update with link when I can find it again) says that the reason scammy websites work so well is because people are more willing to pay a person if the website doesn't look so professionally done. A huge 25 page wall of text with different color fonts to show emphasis shows a personal side and frequently increases sales because it takes the people out of "dealing with a slick company" mode and puts them into "dealing with guy down the street" mode.

With all that said, coinlenders is designed fine, does what it needs to do, and gets out of the way. I'd like to see some things changed, like the ability to hit "enter" after plugging in the CAPTCHA instead of clicking the button, and a way to see the interest payments on the CD instead of just the lump sum amount it's currently valued at, but overall I'm happy. Don't spend too much time designing, I've watched too many people fall into that trap and lose their shirts (and houses, and sometimes families).

[1715264028]

1715264028

[1715264028]

1715264028

[1715264028]

1715264028

[1715264028]

1715264028

[Birdy]

Also if you build a design from scratch you are more likely to leave it vulnerable.
I prefer a secure website over a fancy designed website.

[stenkross]

I'd like to see some things changed, like the ability to hit "enter" after plugging in the CAPTCHA instead of clicking the button

+1

[ffcitatos]

When it comes to discussing the website, I would like to (annoyingly) point out, that HTTPS should be the first priority

[BigBitz]

When it comes to discussing the website, I would like to (annoyingly) point out, that HTTPS should be the first priority

Why?

If I remember rightly it uses a client side Java environment which populates / fuels the pages so the likelyhood of HTTPS representing any additional value to security are................................

[btcminer021]

Got my first interest payment today and i'm loving the site and the concept. If i were to add something it would be i tiny bit of transparency, so the overall health of the business was visible.

Im not sure how this would be done, but i loved the report style from BTCInvest. It would make me feel safer, regarding depositing larger amounts of BTC.

+1 for the transparency. I'd like to see who the loans were sent to, the address, amount, etc.

Would like to have SSL and clean back-end (lender/borrower dashboard?) with pretty graphs showing where my money is now

[The 4ner]

Got my first interest payment today and i'm loving the site and the concept. If i were to add something it would be i tiny bit of transparency, so the overall health of the business was visible.

Im not sure how this would be done, but i loved the report style from BTCInvest. It would make me feel safer, regarding depositing larger amounts of BTC.

+1 for the transparency. I'd like to see who the loans were sent to, the address, amount, etc.

Would like to have SSL and clean back-end (lender/borrower dashboard?) with pretty graphs showing where my money is now

+1 For transparency as well. I feel restricted to certain detail that I should know. If possible this feature should be added and would definitely boom business.

[Ranplan]

Agreed with collegues about transparency.

[ffcitatos]

When it comes to discussing the website, I would like to (annoyingly) point out, that HTTPS should be the first priority

Why?

If I remember rightly it uses a client side Java environment which populates / fuels the pages so the likelyhood of HTTPS representing any additional value to security are................................

Well, some man-in-the-middle can still be done. The attacker cannot get your password, but they can change the site ever so slightly, e.g. the deposit address, and then it is already unpleasant. Disclamer: I am not using coinlender services, so it could be that some sort of MIM protection is already in place.

[🏰 TradeFortress 🏰]

To prevent MITM attacks against deposit addresses, we now sign a message containing a user's deposit address and their username. The bitcoin address used for signing is 1PVmqfC7GcpPVg5jTTGHuv49EwAB8tEqwM

You can verify that your deposit address has not being tampered with by verifying the signed message.

Please quote this post.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

The Bitcoin signing address for CoinLenders is 1PVmqfC7GcpPVg5jTTGHuv49EwAB8tEqwM - it is exposed on server 1.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iF4EAREIAAYFAlGetscACgkQx0EjQi5nw9+3IAD8Dbb5RduIWQtP8oA3120T1h09
kLhAwYD+AoDCZZkpomoA/1JyERMjWVtjsbB3aqEa/ilqExQ5PSocAwyJfk6ZawFf
=K4QJ
-----END PGP SIGNATURE-----

[Birdy]

To prevent MITM attacks against deposit addresses, we now sign a message containing a user's deposit address and their username. The bitcoin address used for signing is 1PVmqfC7GcpPVg5jTTGHuv49EwAB8tEqwM

You can verify that your deposit address has not being tampered with by verifying the signed message.

Please quote this post.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

The Bitcoin signing address for CoinLenders is 1PVmqfC7GcpPVg5jTTGHuv49EwAB8tEqwM - it is exposed on server 1.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iF4EAREIAAYFAlGetscACgkQx0EjQi5nw9+3IAD8Dbb5RduIWQtP8oA3120T1h09
kLhAwYD+AoDCZZkpomoA/1JyERMjWVtjsbB3aqEa/ilqExQ5PSocAwyJfk6ZawFf
=K4QJ
-----END PGP SIGNATURE-----

Quoted.

[bradyon]

To prevent MITM attacks against deposit addresses, we now sign a message containing a user's deposit address and their username. The bitcoin address used for signing is 1PVmqfC7GcpPVg5jTTGHuv49EwAB8tEqwM

You can verify that your deposit address has not being tampered with by verifying the signed message.

Please quote this post.

OK, understood and successfully executed.

Perfect!

This is my new funding address to coinlenders, 1EmaZR4Po3Pj6bPWrGZ761yhKx6QBc4GKi

Just in case somebody wants to fund my projects,  lol

[420]

what's MITM

[AlexC]

To prevent MITM attacks against deposit addresses, we now sign a message containing a user's deposit address and their username. The bitcoin address used for signing is 1PVmqfC7GcpPVg5jTTGHuv49EwAB8tEqwM

You can verify that your deposit address has not being tampered with by verifying the signed message.

Please quote this post.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

The Bitcoin signing address for CoinLenders is 1PVmqfC7GcpPVg5jTTGHuv49EwAB8tEqwM - it is exposed on server 1.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iF4EAREIAAYFAlGetscACgkQx0EjQi5nw9+3IAD8Dbb5RduIWQtP8oA3120T1h09
kLhAwYD+AoDCZZkpomoA/1JyERMjWVtjsbB3aqEa/ilqExQ5PSocAwyJfk6ZawFf
=K4QJ
-----END PGP SIGNATURE-----

Quoted.

[ffcitatos]

To prevent MITM attacks against deposit addresses, we now sign a message containing a user's deposit address and their username. The bitcoin address used for signing is 1PVmqfC7GcpPVg5jTTGHuv49EwAB8tEqwM

Damn, TradeFortress, you are good - fixing everything in no time!

However, I am still surprised that you don't just do the HTTPS thing. It is easy and cheap, is it not?

[ninjaboon]

To prevent MITM attacks against deposit addresses, we now sign a message containing a user's deposit address and their username. The bitcoin address used for signing is 1PVmqfC7GcpPVg5jTTGHuv49EwAB8tEqwM

Damn, TradeFortress, you are good - fixing everything in no time!

However, I am still surprised that you don't just do the HTTPS thing. It is easy and cheap, is it not?

some SSL certs are cheap, like this site for USD 4.99 a year
https://www.cheapssls.com/comodo-ssl-certificates/positivessl.html?years=5

[🏰 TradeFortress 🏰]

SSL is coming.

[🏰 TradeFortress 🏰]

what's MITM

If your internet is not secure (public wifi hotspot, stealing neighbors, etc), an attacker could change the contents of the web page you are browsing - they could replace the deposit address on coinlenders with their own address. This attack is pretty impractical (due to the low amount of users, srsly, how many do you expect to catch using CL), but now with address signing you can be sure that the address hasn't being tampered with (if it passes verification).

[sleger]

Like I already said, we do quite a few very short term (week or two) loans where it's 62% APR (assuming full usage).

What is the typical default rate on these short term loans ? (10, 20 % ?)

[takagari]

My CD's are wacked, or I'm a trillionaire?

Your CDs
81,276,934,810,368,907,154,936,125,233,180,775,526,540,566,118,166,571,736,299,339,413,679,243,264.00000000 BTC - 20.000% APR. Starts 2013-05-07, ends 3000-08-05.
162,553,869,620,737,814,309,872,250,466,361,551,053,081,132,236,333,143,472,598,678,827,358,486,528.00000000 BTC - 20.000% APR. Starts 2013-05-07, ends 3000-08-05.