-

[sturle]

Vi har nå støtte for Google Authenticator. Om du skrur det på, må du bruke det hver gang du logger inn. Jeg anbefaler alle sterkt å skru det på. Det er umulig å vite om man har fått virus på maskinen sin, uansett hvor forsiktig man er eller hvilket operativsystem man bruker.

Er API-nøkkelen framleis SHA256 av brukarnamn + passord som vert sendt med som argument til GET, eller har de klekt ut noko betre? 

No skal det seiast at eg, etter å ha jobba med Unix og Linux i over 15 år, alltid utan nokon som helst brannmur eller anna fjas mellom meg og det opne nettet, aldri har sett eit virus på Linux.  Dersom slike faktisk finst, skal ein vere ein sjeldan kombinasjon av uforsiktig og kunnskapsrik for å installere det.

[sturle]

Er API-nøkkelen framleis SHA256 av brukarnamn + passord som vert sendt med som argument til GET, eller har de klekt ut noko betre?  

Ja, jeg har overveid alternativene og står ved valget mitt. Å bygge sikkerhet oppå TLS er security through obscurity. Jeg setter pris på at du vil hjelpe å sikre Justcoin og at du veier inn med din erfaring, spesielt ang. adgangsnivåer for API-nøkler.

Passord er pr definisjon security through obscurity.

TLS sikrar ikkje i det heile mot mange typar åtak og brukarfeil.  Nettopp difor er det lagd fleire standardar for å fungere saman med TLS for å forbetre tryggleiken.  Dei er på ingen måte obskure, men secure by design.  Til dømes signert REST (brukt av MtGox, Bitcurex og Amazon).  Det sikrar mot åtak som TLS ikkje gjev noko vern mot.  Kvar request må vere signert og unik.  Enkelte (Localbitcoins, Bitcoin-Central, Google, Facebook) brukar OAuth 2 til API-autentisering og autorisering, men OAuth 2 er ikkje sikrare enn TLS.  (OAuth 1 kan signere requestar, men har andre problem.)

Kva om ein brukar skriv feil ein gong han skal bruke APIet og hamnar på justcoin.co (førebels ikkje registert) i staden for justcoin.com?  Då har eigaren av justcoin.co API-nøkkelen til brukaren i loggen sin.  So enkelt er det å få API-nøkkelen på avvege.  Ville ein gjennomsnittsbrukar då tenkt at eigaren av justcoin.co no har full tilgong til kontoen, sjølv om brukaren har tofaktorautentisering på web-grensesnittet?  Med signerte requestar kan du ta det heilt med ro.  Dei er verdilause for alle andre.  Det er eitt døme der at TLS ikkje gjev noko vern, medan signert REST er sikkert.

Eg brukte forresten nett på båten mellom Hirtshals og Bergen her om dagen.  Det var gratis og tregt som fy, og all trafikk, inkludert SSL, gjekk via ein proxy som komprimerte bilete og cacha grundig.  No godtek ikkje eg kva som helst av sertifikat, men ein brukar som "måtte" ha tilgong til Justcoin der og då ville kanskje gjort det.  *Poff*.  Med signerte requestar er det derimot trygt, og eg kunne handle gjennom APIet til MtGox utan å vere redd for at brukbar autentiseringsinformasjon kom på avvege.

[bitfair]

I dag har jeg vært en tur i banken og lagt inn litt paper wallets. Jeg har skrevet litt mer om det på Facebook

Det går alltid an å sikre ting bedre, f.eks. å legge halvparten av passordet i en bankboks og halvparten i en annen, men metoden vi bruker nå er bra nok for mengden bitcoin vi lagrer.

Why use passwords instead of just the private key? I mean, there is much more entropy in the private key than in most (even superstrong!) passwords! Also, a password often contains certain mnemonic devices - meaning you might in fact remember it (i.e. not rubber-hose proof), and also decreasing entropy further.

Further, please describe a little more closely how you transfer from your cold wallet to your hot wallet. If you, at some point, are required to type your password into an internet-connected computer, it's all futile.

I apologise for being rude - I realise these things are difficult - but these "security precautions" you have described sound more like "security theater" to me.

[bitfair]

I might be overly paranoid (and, handling other people's money, you might want to be too), but I'm not entirely sold on the security of brainwallets in the first place. And even though your phone is offline in the exact moment you type the password, you are still typing your password on a device that regularly connects to the internet, and is used for other things in other contexts. If your phone indeed was compromised and frequently connects to the internet, typing the password while standing in a vault with no connection would only offer a modicum of additional security.

I think Armory has some interesting use-cases involving offline signing of transactions, I would suggest taking a closer look at it. Also, you might want to consider a Trezor (http://www.bitcointrezor.com/).

From the post on Reddit, I also got the impression that both partners needed to add some knowledge (simultaneously) to the password to make it correct. What happens if (heaven forbid!) one or both of you suffers any kind of accident?

[bitfair]

Thanks for answering, I'm very happy you're upfront with addressing concerns from fellow (more paranoid) bitcoiners.

Last question, I promise: are bitcoins liable for sales tax in Norway?

Most things are liable for sales tax in Norway, even gold (e.g. smuggling gold into Norway is big business - the street-price of gold is 25% above everywhere else). Are bitcoins exempt, and do you have any definite official confirmation stating so or do you have good lawyers advising you that it is exempt (with a reference to a specific law/paragraph that obviously applies)?

If you are uncertain, you are running an extremely large risk which could end in large losses for your customers and personal bankruptcy for the proprietors (not to mention criminal charges). Getting in trouble with the tax authorities in Norway is extremely serious...

[klausbl]

Last question, I promise: are bitcoins liable for sales tax in Norway?

Most things are liable for sales tax in Norway, even gold (e.g. smuggling gold into Norway is big business - the street-price of gold is 25% above everywhere else). Are bitcoins exempt, and do you have any definite official confirmation stating so or do you have good lawyers advising you that it is exempt (with a reference to a specific law/paragraph that obviously applies)?

Hi Bitfair,

We are committed to do everything according to law and regulation, which includes accounting and tax law. Our accountant is in dialogue with the tax authorities in Norway. We are also working with a lawyer for advice on how to deal with the uncertainty in regulations.

Even if bitcoins were liable to sales tax in Norway, we do not sell bitcoins. We are an exchange. A more relevant question for us would be whether our commission is tax liable or not.

Klaus
CEO

[bitfair]

I admire your valiant attitude, and your courage. Norway is a particularly difficult jurisdiction for this kind of activity, and taking into account the small potential customer-base (albeit larger now that you accept foreign customers) I imagine you are, to a large degree, ideologically motivated.

Even if bitcoins were liable to sales tax in Norway, we do not sell bitcoins. We are an exchange. A more relevant question for us would be whether our commission is tax liable or not.

There is no doubt that the commission is subject to sales tax. And even if you are not selling bitcoins, you may still be held responsible to a certain degree.

I think Norwegian legislation is a bit of a double-edged sword for bitcoin. Either it will be considered a currency/financial product and sales tax does not apply, but in that case all the legislation that regulates financial products applies to it. Or it will be considered a regular product, in which case sales tax must be applied, but a whole lot of other onerous legislation does not apply.

I hope you issue an update when there is more clarity around the question.

Best of luck!

[sturle]

There is no doubt that the commission is subject to sales tax.

If Bitcoin is money, there is no (sales) tax on the commission either.  Just as there is no tax on bank fees or interest.  (Because if there was sales tax on fees, the bank could just lower the fees and adjust the interest.  And vice versa.)  Either there is 25% sales tax on sale of bitcoins, or there are no taxes on sale or exchange of bitcoins, including commission and fees.

[bitfair]

There is no doubt that the commission is subject to sales tax.

If Bitcoin is money, there is no (sales) tax on the commission either.  Just as there is no tax on bank fees or interest.  (Because if there was sales tax on fees, the bank could just lower the fees and adjust the interest.  And vice versa.)  Either there is 25% sales tax on sale of bitcoins, or there are no taxes on sale or exchange of bitcoins, including commission and fees.

I stand corrected: you are right, there is no sales tax on commission for "financial services".

[klausbl]

I stand corrected: you are right, there is no sales tax on commission for "financial services".

We just received a letter from Skatteetaten, replying to our accountant's inquiry about tax and bitcoin:

Slik det fremstår for skatteetaten antas formidling av kjøp og salg av bitcoin å være et gyldig betalingsmiddel, og dermed unntatt merverdiavgift etter mval. § 3-6 bokstav d.

[bitfair]

We just received a letter from Skatteetaten, replying to our accountant's inquiry about tax and bitcoin:

Slik det fremstår for skatteetaten antas formidling av kjøp og salg av bitcoin å være et gyldig betalingsmiddel, og dermed unntatt merverdiavgift etter mval. § 3-6 bokstav d.

That's great news, congratulations to you and your team for getting that clarification!

If I were you, I'd write up a press release and send it to Itavisen/Digi/DN/Finansavisen/+++. It's pretty big and important news, in my opinion, and would get some publicity both for Bitcoin and yourself.

[Badonkadonk]

so, buying something for btc online means you dont have to pay toll ?

[Kupsi]

so, buying something for btc online means you dont have to pay toll ?

You have to pay VAT (sales tax) when you buy something with BTC in Norway. But you don't have to pay VAT when you buy BTC, and the commision at Justcoin is exempt VAT.

In Norway you have to pay VAT when you buy gold, so this is good news.

[MayDee]

In Norway you have to pay VAT when you buy gold, so this is good news.

There is no VAT on gold coins with a face value here in Norway. These coins go under the same rules as Bitcoin. If you buy gold bars you have to pay VAT.

[Herodes]

I stand corrected: you are right, there is no sales tax on commission for "financial services".

We just received a letter from Skatteetaten, replying to our accountant's inquiry about tax and bitcoin:

Slik det fremstår for skatteetaten antas formidling av kjøp og salg av bitcoin å være et gyldig betalingsmiddel, og dermed unntatt merverdiavgift etter mval. § 3-6 bokstav d.

Gratulerer, bra jobbet. Hadde det vært anledning til å gjengi brevet i sin helhet, gjerne med kontaktperson til skatteetaten? Var dette en såkalt 'bindende svar' henvendelse, eller en generell henvendelse. Ellers er dette meget gode nyheter for bitcoins utbredelse.

Jeg håper at ikke bare din exchange, men alle som driver med bitcoin i Norge kan dra positivt nytte av dette!

[cande]

great contribution,

i will try out your service later this week,

cheers!

[MayDee]

Bitcoin Vs. Fiat’s Best: The Norwegian Kroner

https://www.goldsilverbitcoin.com/bitcoin-vs-fiats-best-the-norwegian-krone/

[aenemic]

Heisann! Av en eller annen grunn ser min UI og min kompis UI noe forskjellige ut. Når jeg skal legge til norsk bankkonto får jeg beskjed om å legge inn IBAN/SWIFT, mens han kun får opp Kontonummer.

Jeg trenger vel ikke IBAN/SWIFT om jeg skal knytte opp en norsk konto?

[sturle]

We just received a letter from Skatteetaten, replying to our accountant's inquiry about tax and bitcoin:

Slik det fremstår for skatteetaten antas formidling av kjøp og salg av bitcoin å være et gyldig betalingsmiddel, og dermed unntatt merverdiavgift etter mval. § 3-6 bokstav d.

Er det mogeleg å få ein kopi av det brevet?  Kan du scanne det inn og leggje det ut ein stad?

[klausbl]

Er det mogeleg å få ein kopi av det brevet?  Kan du scanne det inn og leggje det ut ein stad?

Hei Sturle. Vi har planer om å publisere brevet i sin helhet, riktignok ikke på nåværende tidspunkt. I mellomtiden kan du eller andre gjerne besøke oss og lese gjennom brevet. Vi har kontor i Tordenskiolds gate 3 i Oslo. Fint hvis du tar kontakt på forhånd: klaus@justcoin.com.