Bounty for the MyBitcoin.com hacker (~25BTC)

[bittersweet]

I will hold the Bitcoin for a Bounty.

Would you guys be happy if I use my brand new http://BitBills.com Bank Card?   It's totally offline.    Is that secure enough for you all?

Do you trust BitBills, as much as you trusted MyBitcoin? Do you realize that if they store private keys of the cards (and there is no way to know), they can easily access ALL money on ALL the cards they produced? Do you know BitBills owner with his real name, address, phone number and verified it?

[1714967319]

1714967319

[1714967319]

1714967319

[1714967319]

1714967319

[hawks5999]

Right now, no one is reputable, including anyone claiming to be Bruce Wagner or the real live Bruce Wagner.

Being a Hero Member is useless too SgtSpike - nothing personal.

I trust exactly 1 person regarding my BitCoin.

You have it much better than I do, I got one less

I debated stating I trust exactly 0 persons because I could screw up my own bitcoins any time. At least I generally know where to find me. So when I need a single throat to choke, I don't have to reach far.

That said, this thread seems to exemplify the bitcoin community's insatiable desire to lose their money. Only westkybitcoins has proposed an idea that has a modicum of sense to it.

Look people, how many times does this have to be said: Bitcoins are like cash.

How many of you would send $100 in cash to Bruce Wagner to "hold" for you? Nothing against Bruce personally, he's just the most public face and seems to get the most benefit of the doubt. And it's astounding to me that people would send cash to a guy they know only from a forum and some streaming videos to "hold" cash for them. Look, I have good friends that I've known for years. I can walk to their home and have had dinner with their wife and kids. I would not give cash to these people and I will see them every week. People on this forum talk lightly of sending cash to a guy in New York City who has recently lost a quarter million dollars in value due to lack of due diligence. Nothing against Bruce but this is the guy you want to "hold" your cash?
Seriously, until this community starts treating Bitcoin like real money, no one outside this community will. I have a lot of faith in the technology and architecture of Bitcoin, but I have no faith in the community of people that have grown up around it. It's like a collection of lottery winners who don't respect the money they have come into and are broke again in 2 years.

I would have hoped that after the mybitcoin debacle we would have learned a lesson. Unfortunately, I suspect this kind of thing will just rinse and repeat.

[westkybitcoins]

My bounty of 5 BTC has been transferred to an offline, backed-up wallet:

http://blockexplorer.com/address/1EK58cmwLQ3BA4N2Afn8dGqxNsNsNtGJ93

Yes, I saw that MyBitcoin is back up. I'm not convinced this is settled yet though; I'm taking a wait-and-see attitude and leaving the bounty out for now.

[natman3400]

I will hold the Bitcoin for a Bounty.

Would you guys be happy if I use my brand new http://BitBills.com Bank Card?   It's totally offline.    Is that secure enough for you all?

Do you trust BitBills, as much as you trusted MyBitcoin? Do you realize that if they store private keys of the cards (and there is no way to know), they can easily access ALL money on ALL the cards they produced? Do you know BitBills owner with his real name, address, phone number and verified it?

They do make a profit off of BitBills though, so why would they just take everyone's money now and never see another dime when they could keep receiving money by just giving us legitimate BitBills, and NOT taking the money, while also NOT storing the private keys.

[Rassah]

I will hold the Bitcoin for a Bounty.

Would you guys be happy if I use my brand new http://BitBills.com Bank Card?

Do you know BitBills owner with his real name, address, phone number and verified it?

The owner of BitBills appeared in person on The Bitcoin Show, and talked to Bruce, in person, about his BitBills business. Does that count?

[hawks5999]

I will hold the Bitcoin for a Bounty.

Would you guys be happy if I use my brand new http://BitBills.com Bank Card?

Do you know BitBills owner with his real name, address, phone number and verified it?

The owner of BitBills appeared in person on The Bitcoin Show, and talked to Bruce, in person, about his BitBills business. Does that count?

No.

I can't have papers served to an appearance on The Bitcoin Show. BitBills.com has no contact information other than a nebulous 'support@bitbills.com'. They are absolutely not one bit different than MBC in this regard. They have a Free SSL that has zero information about the company.

Compare:
CN = bitbills.com
OU = Free SSL
OU = Domain Control Validated


with
CN = store.apple.com
OU = IS&T Apple Online Store Engineering
O = Apple Inc.
STREET = 1 Infinite Loop
L = Cupertino
S = California
PostalCode = 95014
C = US
SERIALNUMBER = C0806592
2.5.4.15 = V1.0, Clause 5.(b)
1.3.6.1.4.1.311.60.2.1.2 = California
1.3.6.1.4.1.311.60.2.1.3 = US

or

CN = www.paypal.com
OU = PayPal Production
O = PayPal, Inc.
STREET = 2211 N 1st St
L = San Jose
S = California
PostalCode = 95131-2021
C = US
SERIALNUMBER = 3014267
2.5.4.15 = Private Organization
1.3.6.1.4.1.311.60.2.1.2 = Delaware
1.3.6.1.4.1.311.60.2.1.3 = US


If you want me to trust you with bitcoins, then expend the $700 and get a real SSL cert. If you can't afford that, you likely can't afford any of the other security measures required to keep my login information, let alone my bitcoins, safe. Again people, somebody appearing on a streaming video on the internet != trust or credibility. If this community continues to fail in treating bitcoin like real money then no one else will either.

[TraderTimm]

I think educating people about personal security is more useful than foisting wallets on a centralized service right now.

[DrKennethNoisewater]

I will commit 10 BTC to the bounty. However, unless a VERY reputable member steps up to escrow the coins for the bounty, I would rather hold them myself.

would you feel better if we had someone reputable like Bruce Wagner hold on to this bounty wallet?

I would prefer Bruce Willis hold the bounty $

LOL

[BCEmporium]

If you want me to trust you with bitcoins, then expend the $700 and get a real SSL cert. If you can't afford that, you likely can't afford any of the other security measures required to keep my login information, let alone my bitcoins, safe. Again people, somebody appearing on a streaming video on the internet != trust or credibility. If this community continues to fail in treating bitcoin like real money then no one else will either.

Right... so let me see, I want to store it for nearly free but I want high-end security measures...
Also bitbills aren't an e-wallet, they aren't meant to "keep your bitcoins" anywhere but in the QR code printed in the bill.
This is a community of trust, holding tight against an aggressive internet and unfriendly banking service, as Paypal (who can afford those 700USD+whatever; thanks to the high fees they rake of their customers).

[adamstgBit]

If you want me to trust you with bitcoins, then expend the $700 and get a real SSL cert. If you can't afford that, you likely can't afford any of the other security measures required to keep my login information, let alone my bitcoins, safe. Again people, somebody appearing on a streaming video on the internet != trust or credibility. If this community continues to fail in treating bitcoin like real money then no one else will either.

Right... so let me see, I want to store it for nearly free but I want high-end security measures...
Also bitbills aren't an e-wallet, they aren't meant to "keep your bitcoins" anywhere but in the QR code printed in the bill.
This is a community of trust, holding tight against an aggressive internet and unfriendly banking service, as Paypal (who can afford those 700USD+whatever; thanks to the high fees they rake of their customers).

we are talking about a bitbill bank card, not bitbills

[Rassah]

If you want me to trust you with bitcoins, then expend the $700 and get a real SSL cert. If you can't afford that, you likely can't afford any of the other security measures required to keep my login information, let alone my bitcoins, safe. Again people, somebody appearing on a streaming video on the internet != trust or credibility. If this community continues to fail in treating bitcoin like real money then no one else will either.

Right... so let me see, I want to store it for nearly free but I want high-end security measures...
Also bitbills aren't an e-wallet, they aren't meant to "keep your bitcoins" anywhere but in the QR code printed in the bill.
This is a community of trust, holding tight against an aggressive internet and unfriendly banking service, as Paypal (who can afford those 700USD+whatever; thanks to the high fees they rake of their customers).

we are talking about a bitbill bank card, not bitbills

There's no difference between the two other than one is made of metal, and the other has a sticker over the private key.

[hawks5999]

Right... so let me see, I want to store it for nearly free but I want high-end security measures...

Yeah, profitable businesses are hard to run. (no sarcasm)

This is a community of trust, holding tight against an aggressive internet and unfriendly banking service, as Paypal (who can afford those 700USD+whatever; thanks to the high fees they rake of their customers).

I'm sorry, I just don't buy that a business (yes business) offering services online (bitbills is selling those cards online) can't afford US$700. I'll just restate - if you can't afford this simple security measure, you can't defend against an aggressive internet. Why should I trust you with my bitcoin? Because you went on somebody's streaming video program on the internets that has been viewed 700 times on YouTube? Golly, ok, let me send you my 25,000 BTC right now.

This whole pollyanna thinking about a community of trust is precisely whey BitCoins keep getting stolen. If you were a scamming, dishonest fraudster you'd be hard pressed to find an easier score than the BitCoin community of trust.

[adamstgBit]

Right... so let me see, I want to store it for nearly free but I want high-end security measures...

Yeah, profitable businesses are hard to run. (no sarcasm)

This is a community of trust, holding tight against an aggressive internet and unfriendly banking service, as Paypal (who can afford those 700USD+whatever; thanks to the high fees they rake of their customers).

I'm sorry, I just don't buy that a business (yes business) offering services online (bitbills is selling those cards online) can't afford US$700. I'll just restate - if you can't afford this simple security measure, you can't defend against an aggressive internet. Why should I trust you with my bitcoin? Because you went on somebody's streaming video program on the internets that has been viewed 700 times on YouTube? Golly, ok, let me send you my 25,000 BTC right now.

This whole pollyanna thinking about a community of trust is precisely whey BitCoins keep getting stolen. If you were a scamming, dishonest fraudster you'd be hard pressed to find an easier score than the BitCoin community of trust.

so whats happening here ...
should we drop the bounty idea?

[BCEmporium]

You're forgetting (or probably totally unaware) of a "security" PayPal has and regular online banking in general have that no bitcoin based service in the world has.
You try to brutte-force PayPal from your home IP and in minutes you've a SWAT team and a forensics team dropping by your front door; you try to brutte-force a bitcoin service and... well... if a blue police car shows up, you're probably unlucky.

The "lucky" part is that most of us around are "hackers" (from all branches from White to Black) but this is no place for noobs or people asking for "common-life security"-; it's sort of the wild west of Economics; be safe or be dead.

Rewinding a bit, so you know Paypal's office address. Now what? If they rip you of, by their "random ToS violation lottery", you will you do what? Go there make noise? They will call the cops on you and put you out of the front door... and they CAN not only afford the "best security" but also the "best lawyers" - either way you're toasted.

Also I don't see why someone would put 25K BTC on someone's hands... online wallets are designed for store some change in case of you need to send btc somewhere and aren't at home or where you store your main wallet.

[hawks5999]

You're forgetting (or probably totally unaware) of a "security" PayPal has and regular online banking in general have that no bitcoin based service in the world has.
You try to brutte-force PayPal from your home IP and in minutes you've a SWAT team and a forensics team dropping by your front door; you try to brutte-force a bitcoin service and... well... if a blue police car shows up, you're probably unlucky.

The "lucky" part is that most of us around are "hackers" (from all branches from White to Black) but this is no place for noobs or people asking for "common-life security"-; it's sort of the wild west of Economics; be safe or be dead.

Rewinding a bit, so you know Paypal's office address. Now what? If they rip you of, by their "random ToS violation lottery", you will you do what? Go there make noise? They will call the cops on you and put you out of the front door... and they CAN not only afford the "best security" but also the "best lawyers" - either way you're toasted.

Yeah, and I keep exactly $0.00 in PayPal for that reason and only pay via (disputable) credit cards through them when no other choice is available. The point here is that if the Bitcoin community intends to promote BitCoin as a secure, private, [ano | psuedo]nymous currency and we are all security minded hackers then Bitcoin and it's ecosystem needs to be at least as secure as the competing financial instruments out there. So far, all the security minded hackers are getting pwned every couple weeks. If we, self-selected, security minded hackers can't keep ahold of our coins then our economy will not grow much beyond the <35,000 members of this forum.

I'm counting on security improving over time. However, this idea of a "community of trust" hinders advancement of security and devalues Bitcoin.

[BCEmporium]

Well, hawks, this has been a year to tell the grandsons 

I came to bitcoin by May 10, stop mining around September 10. BTC was pretty much worthless back then and now has this huge value. By January you still see people betting when (or even if) btc would reach 10 USD... Adapt a security designed to store a few cents to one enough to hold millions of USD within so few time is a hard to do task. Nevertheless, the "pwnds" derive from people themselves, by over-centralize the bitcoin in a few places, like MtGox for exchange or MyBitcoin for storage.
Some lessons to be learned; from MBC to remain on topic, is that we come to figure the "small lie, big lie" rule. Apparently they retrieved Bidingpound's password whereas claim to have a password storage system that hashes it within SHA-256. And this is yet another issue to be taken, auth at mbc was lightning fast for such algorithm... an error of us all to overlook that suspicious server behavior. If bidingpound would spoke sooner we would look it more closely and push Tom to do things the right way or deem his site as unsafe... but that's a whole bunch of "if's". Lessons to be learned.

[nighteyes]

The "lucky" part is that most of us around are "hackers" (from all branches from White to Black) but this is no place for noobs or people asking for "common-life security"-; it's sort of the wild west of Economics; be safe or be dead.

Thank you....and I wouldnt want it any other way personally....the socialists among us want everyone to play nice. The capitalists are looking to emphasize the risk/reward. If a person had a stack of cash in their hand, the socialist wants the thief not to take that cash....why cant we all get along? ......whereas the 'capitalist' wants him to take that cash because that incentivizes the victim not to be so stupid....its a brutal code of honor.
My 2 cents- the majority is going to be capitalist but appreciate diversity :-) so sometimes they are going to have to play along and go one step back(in their view).

The part that doesnt make sense to me is that this theft happens every day to the US dollar but there is no big stink about it. You dont hear the socialist complain that there will be no trust in the US dollar with all the corruption there....talk about a cesspool.

[llama]

Bitbills here, want to address a few things.
I won't address the security of our products or their manufacturing process, as we've covered this elsewhere.

On the topic of our SSL certificate, we find it hard to believe that a community as skeptical as Bitcoin holds much faith in the security theater that is the modern Public Key Infrastructure. Recent events have shown that none of the "authorities" can be absolutely trusted. We believe that a CACert, WOT based certificate is better than any commercial offering, but due to requests from the community we've moved to a commercial solution. If anybody has any doubts about whether the public key is truly ours, I'd be happy to personally send them a postcard with a copy of our public key.

Regarding bitcoin storage, there is absolutely no perfect solution. There are advantages to home-grown storage solutions, but also to solutions that do include an element of trust. While there's certainly a risk of a webwallet turning criminal, there's also a risk that you accidentally left the bitcoin client open when you backed up your wallet and corrupted your coins. Indeed, others have lost nearly as many bitcoins as Bruce did to MBC simply because they didn't encrypt their home-stored wallet.dat file, or made some other small mistake. At some point, people need to honestly ask themselves whether its more likely that a reputable bitcoin service will turn out to be a massive conspiracy, or that their flash drive will get stolen.

There's a very good historical precedent here: traditional currencies. There's no theoretical reason why somebody couldn't store their entire net worth in their basement as cash, but they don't do it. Why? Trusted banks provide services that they need, and probably more security too. Being a digital currency, bitcoin doesn't have many of the problems that banks solve (e.g., bitcoin has no need for huge storage vaults or ACH). But bitcoin is not a miracle currency. For example, offline transactions between parties untrusting of each other are not generally possible with bitcoins, but with Bitbills this becomes possible.

I'm sorry I didn't have time to make this post shorter, but here's the big idea: every method of using bitcoins has risks, and sometimes trusting somebody else just a little bit is actually the least risky solution. Choice is better than no choice.

On a different, but related note, we're working very hard on a new product that we think will be a huge step forward for bitcoin storage: trustless bank cards. Details are forthcoming.

[julz]

On the topic of our SSL certificate, we find it hard to believe that a community as skeptical as Bitcoin holds much faith in the security theater that is the modern Public Key Infrastructure.

While control of the PKI system is in the hands of too few..  I still appreciate the traceability that an EV certificate would give.

We know any old certificate will do the encryption job just fine - what is needed is something that gives a bit more than just 'domain control' as far as verifying *who* the party on the other end of the cert is.

I'd also like to see more contact information and info about the company and principals on the bitbills site.

As it is - I've chosen to trust bitbills for a small amount.  
In the wake of the mybitcoins fiasco however, I'm not so comfortable recommending bitbills to friends/family.

I already have the argument that keeping a copy of the private key would put at risk a legitimate profitable business model... the extra argument I need to nudge me across the line to being comfortable recommending bitbills - is obvious traceability to a registered business.
(even if it's just a sole trader - that's fine.)

Being coy about who you are is not a great idea when trust is such an important part of your business model.
Your website's lack of transparency in that regard is not confidence inspiring.

[hawks5999]

Bitbills here,

Prove it.

(Ok, that's sorta dickish, but it's still a valid demand.)

On the topic of our SSL certificate, we find it hard to believe that a community as skeptical as Bitcoin holds much faith in the security theater that is the modern Public Key Infrastructure. Recent events have shown that none of the "authorities" can be absolutely trusted. We believe that a CACert, WOT based certificate is better than any commercial offering, but due to requests from the community we've moved to a commercial solution. If anybody has any doubts about whether the public key is truly ours, I'd be happy to personally send them a postcard with a copy of our public key.

Nice of you to believe that. However, as long as this is the experience of anyone trying to order:


then it really doesn't matter what you believe. Skepticism, like charity, begins at home. You can call it security theater, but what you have right now looks like a bad 6th Grade production of Our Town.

Regarding bitcoin storage, there is absolutely no perfect solution. There are advantages to home-grown storage solutions, but also to solutions that do include an element of trust. While there's certainly a risk of a webwallet turning criminal, there's also a risk that you accidentally left the bitcoin client open when you backed up your wallet and corrupted your coins. Indeed, others have lost nearly as many bitcoins as Bruce did to MBC simply because they didn't encrypt their home-stored wallet.dat file, or made some other small mistake. At some point, people need to honestly ask themselves whether its more likely that a reputable bitcoin service will turn out to be a massive conspiracy, or that their flash drive will get stolen.

Not even close. I've had numerous flash drives over many years. Never once have had one stolen. I honestly ask you to name a reputable bitcoin service. We can all name several that turned out to be somewhere between conspiracy and woefully incompetent. I understand BCEmporium's point about scaling from $.01 to $30.00$20.00$10.00$7.50 in value and the attendant change in security requirements. But, at this point, the relationship between bitcoin service providers and the community looks an awful lot like battered woman syndrome.

BSP: C'mon, baby, just trust me. I promise I won't hurt you again.
BitCommunity:  ...  ... ... OK! What's your address?!

There's a very good historical precedent here: traditional currencies. There's no theoretical reason why somebody couldn't store their entire net worth in their basement as cash, but they don't do it. Why? Regulated banks provide services that they need, and probably more security too. Being a digital currency, bitcoin doesn't have many of the problems that banks solve (e.g., bitcoin has no need for huge storage vaults or ACH). But bitcoin is not a miracle currency. For example, offline transactions between parties untrusting of each other are not generally possible with bitcoins, but with Bitbills this becomes possible.

A minor fix for you, did you catch it? And with that fix, I'll add: the reason Gold is going through the roof (Hey what's that down there? Oh that's $1,700/oz) is that people are beginning to store their entire net worth in their basements in the form of Gold. The primary reason for that is because deregulation in the financial sector has led to almost immediate and continuous bubble-bust cycles and ridiculous things like BOA writing devastating CDSs on European Sovereign Debt. Before I'm labeled a socialist, I don't think bitcoin services should be regulated by national governments. But there needs to be a body that regulates and enforces standards or we will have the same bubble-bust cycle with less confidence (bitcoin has no backstop).  FFS, we are a peer to peer community that is developing our own currency. I'm sure we could come up with a democratized process of self-regulation and enforced transparency on service providers that goes beyond appearing on The Bitcoin Show.

I'm sorry I didn't have time to make this post shorter, but here's the big idea: every method of using bitcoins has risks, and sometimes trusting somebody else just a little bit is actually the least risky solution. Choice is better than no choice.

On a different, but related note, we're working very hard on a new product that we think will be a huge step forward for bitcoin storage: trustless bank cards. Details are forthcoming.

Translation: C'mon, baby, just trust me. I promise I won't hurt you again.