Launched a Bitcoin escrow on Tor

[pablocokeninja]

Hello guys,

I just launched a bitcoin escrow service on Tor network, i build it just recently due to the high demand on escrows, will be applying multi-sig with time as well.
I would love if you guys audited it or run a quick test on it.
Here is the link for it:
> http://3st4foepy7nlpptnamtz5vcykmfsu4clvrodiqqqmtpp4jdzlgvyo3yd.onion

* I would love any cooperation on making it succeed as well.

[1715495818]

1715495818

[1715495818]

1715495818

[1715495818]

1715495818

[1715495818]

1715495818

[1715495818]

1715495818

[1715495818]

1715495818

[pablocokeninja]

I would love if you guys audited it or run a quick test on it.
Here is the link for it:
> http://j3hrmehirgmftg7fzuyiddnzmetkertmgar2aikhsllkfw5aevwfz4id.onion

I tried to open the link, but my Tor Browser show error message "Onionsite Has Disconnected" with error code 0xF2. I tried "New Tor Circuit for this Site" few times and relaunched Tor Browser, but i still see same error message/code.

Hey,

Doing some maintenance on it at the moment, will be available as soon as possible.
Thanks!

[Husires]

> http://j3hrmehirgmftg7fzuyiddnzmetkertmgar2aikhsllkfw5aevwfz4id.onion

Can you explain more, I mean multi-sig is a good idea but you need to trust the third party if it is 1 out of 3 and also it must be ensured that the webmaster does not know or ْgenerate addresses.

why you only have tor version on the Tor network, It is to avoid DDoS attacks and privacy, which are not necessary for a new website trying to gain trust.

Escrow needs to be trusted by a third party who cannot be anonymous.

[pablocokeninja]

> http://j3hrmehirgmftg7fzuyiddnzmetkertmgar2aikhsllkfw5aevwfz4id.onion

Can you explain more, I mean multi-sig is a good idea but you need to trust the third party if it is 1 out of 3 and also it must be ensured that the webmaster does not know or ْgenerate addresses.

why you only have tor version on the Tor network, It is to avoid DDoS attacks and privacy, which are not necessary for a new website trying to gain trust.

Escrow needs to be trusted by a third party who cannot be anonymous.

Honestly,
I decided to launch it on Tor since it is much more safer and more private for users to transact, even tho we all know that bitcoin transactions are traceable.
I will be buying a domain name and launch it on the clearnet if that would be more suitable.
When launching the multi-sig, i may just partner up with escrow providers in the forum and he will be in charge of the multi-sig.
I set the admin interface to not be able to modify bitcoin address, so basically once bitcoin core sets an address to the user, it is impossible to modify it, i will be encrypting the addresses in the next version of it, so it cannot be modified by anyone. Thanks for the idea.

Also, i may need more help with the website, since it takes a lot of work and i am mainly doing everything myself. I mean just the maintenance took me a whole day (I have a personal life too haha).

[LoyceV]

I decided to launch it on Tor since it is much more safer and more private for users to transact, even tho we all know that bitcoin transactions are traceable.

The problem with that is that you are anonymous too.

When launching the multi-sig, i may just partner up with escrow providers in the forum and he will be in charge of the multi-sig.

In that case: what value does your website add?

I set the admin interface to not be able to modify bitcoin address, so basically once bitcoin core sets an address to the user, it is impossible to modify it, i will be encrypting the addresses in the next version of it, so it cannot be modified by anyone.

For the site owner, nothing is impossible to change.

Also, i may need more help with the website, since it takes a lot of work and i am mainly doing everything myself. I mean just the maintenance took me a whole day (I have a personal life too haha).

I'll check it out when it's back online. Common problems with (new) escrows are the lack of trust and unclear decision making in case of a dispute. I don't think I've ever seen any implementation that completely covers all possible scenarios.

[Husires]

When launching the multi-sig, i may just partner up with escrow providers in the forum and he will be in charge of the multi-sig.
I set the admin interface to not be able to modify bitcoin address, so basically once bitcoin core sets an address to the user, it is impossible to modify it, i will be encrypting the addresses in the next version of it, so it cannot be modified by anyone. Thanks for the idea.

It is good to see someone trying to do something new.
you need to make something better than a site controlled by trusted members of the forum, your audience will be from the forum only, and most of the forum members may not use it because it represents an additional fee instead of contacting escrow members directly.

• your work as a sole, part-time developer means that many backdoors will be present.
• Any hack will cause the site's reputation to be ******.
• Do not forget that you need trust, technical development and presenting something convincing.

I advise you to release a beta version on testnet and when everything is acceptable, you can start thinking about it seriously and looking for a promotional campaign.

[pablocokeninja]

When launching the multi-sig, i may just partner up with escrow providers in the forum and he will be in charge of the multi-sig.
I set the admin interface to not be able to modify bitcoin address, so basically once bitcoin core sets an address to the user, it is impossible to modify it, i will be encrypting the addresses in the next version of it, so it cannot be modified by anyone. Thanks for the idea.

It is good to see someone trying to do something new.
you need to make something better than a site controlled by trusted members of the forum, your audience will be from the forum only, and most of the forum members may not use it because it represents an additional fee instead of contacting escrow members directly.

• your work as a sole, part-time developer means that many backdoors will be present.
• Any hack will cause the site's reputation to be ******.
• Do not forget that you need trust, technical development and presenting something convincing.

I advise you to release a beta version on testnet and when everything is acceptable, you can start thinking about it seriously and looking for a promotional campaign.

Yes, i did release this version as a beta, but i used the mainnet, i may change it to testnet.
The server is hardened enough, and everything is encrypted, except some database fields such as emails and amount, just in case both clients wanted to change that.
I will do my best to make this project better and for the long term, and certainly improving the design.

[LoyceV]

Any hack will cause the site's reputation to be ******.

The server is hardened enough

This is one of those responses that won't age well.

[pablocokeninja]

Any hack will cause the site's reputation to be ******.

The server is hardened enough

This is one of those responses that won't age well.

LOL true, i mean i am not that confident in the security of the server, yet i have done all recommended practices, even everything is expected in this space.

[zeuner]

> http://3st4foepy7nlpptnamtz5vcykmfsu4clvrodiqqqmtpp4jdzlgvyo3yd.onion

How will it establish trust so people will want to put their coins there? Even with clearnet sites, there have been cases where a site disappeared and it was hard to find a person that will take responsibility. This would be even harder for a mere .onion service.

[SFR10]

and i am mainly doing everything myself. I mean just the maintenance took me a whole day (I have a personal life too haha).

So that means the following part, isn't completely true or accurate: 24/7 support

• While we're at it, I'd like to inform you even though the fee that you're charging ^[screenshot] is smaller than most of the other escrow providers in "other platforms", you might want to consider lowering it a bit more ^{[most escrow providers on this forum, have a lower fee and there are still certain users out there that refuse to hire escrow providers because of their fees]}!

When launching the multi-sig, i may just partner up with escrow providers in the forum and he will be in charge of the multi-sig.

In that case: what value does your website add?

Would you mind answering the above question @pablocokeninja? Why should you and your platform be in the equation, when other escrow providers could achieve a similar result without it?
^{- It's a sensitive subject, so I hope you understand why most of us would question every single one of your moves!}

[pablocokeninja]

and i am mainly doing everything myself. I mean just the maintenance took me a whole day (I have a personal life too haha).

So that means the following part, isn't completely true or accurate: 24/7 support

• While we're at it, I'd like to inform you even though the fee that you're charging ^[screenshot] is smaller than most of the other escrow providers in "other platforms", you might want to consider lowering it a bit more ^{[most escrow providers on this forum, have a lower fee and there are still certain users out there that refuse to hire escrow providers because of their fees]}!

When launching the multi-sig, i may just partner up with escrow providers in the forum and he will be in charge of the multi-sig.

In that case: what value does your website add?

Would you mind answering the above question @pablocokeninja? Why should you and your platform be in the equation, when other escrow providers could achieve a similar result without it?
^{- It's a sensitive subject, so I hope you understand why most of us would question every single one of your moves!}

I am doing my best with the support, yet it just got started so i will dedicated a lot of time to it when a lot of users come in.
Well, basically it is an automated escrow service, so the users can just start escrow on their own, without any hassle and i will be improving it much better with time, i am doing my best to find a suitable solution for multi-sig to ease it up for the users.
I will be lowering the fee in the future, it is just at the start and to make the website better in a short period of time, basically get more funding from the fees.
Would love to join the board if you're a trusted member in the community by the way.

[LoyceV]

basically it is an automated escrow service, so the users can just start escrow on their own, without any hassle

Since your site is back online, I could check it out. The fact that your Canary expired a year ago doesn't inspire confidence:

Published by: xD500
Published on: 12-01-2021
Next Publish: 12-02-2021

But even if I would trust you, both the FAQ and the "Escrow process" descriptions don't inspire much confidence either. This is all it shows about the process:

5. Buyer releases the escrow transaction when he receives item(s)/service(s) or start a dispute if not received.

How are disputes handled? How do you prevent an experienced scammer from scamming an innocent newbie? How can you ever be sure about a trade if you only see the financial side of it?

Common problems with (new) escrows are the lack of trust and unclear decision making in case of a dispute. I don't think I've ever seen any implementation that completely covers all possible scenarios.

I can think of a few scenarios that can emerge. To start:

This is a common practice. I have both bought and sold physical coins, and bitcoin miners using escrow. In all cases, everyone involved wanted the shipment to be sent directly to the buyer by the seller. As an escrow agent, I had facilitated the sale of physical goods, and all parties had always wanted the goods to be sent directly from the seller to the buyer.

How does that protect the buyer if the seller sends a fake? Or how that it protect the seller if the buyer claims he received a fake?

How can you prevent this? If both parties are honest, they don't need an escrow. The escrow is only needed when one of the parties isn't honest, which should be the assumption in all steps taken by escrow.

[pablocokeninja]

basically it is an automated escrow service, so the users can just start escrow on their own, without any hassle

Since your site is back online, I could check it out. The fact that your Canary expired a year ago doesn't inspire confidence:

Published by: xD500
Published on: 12-01-2021
Next Publish: 12-02-2021

But even if I would trust you, both the FAQ and the "Escrow process" descriptions don't inspire much confidence either. This is all it shows about the process:

5. Buyer releases the escrow transaction when he receives item(s)/service(s) or start a dispute if not received.

How are disputes handled? How do you prevent an experienced scammer from scamming an innocent newbie? How can you ever be sure about a trade if you only see the financial side of it?

Common problems with (new) escrows are the lack of trust and unclear decision making in case of a dispute. I don't think I've ever seen any implementation that completely covers all possible scenarios.

I can think of a few scenarios that can emerge. To start:

This is a common practice. I have both bought and sold physical coins, and bitcoin miners using escrow. In all cases, everyone involved wanted the shipment to be sent directly to the buyer by the seller. As an escrow agent, I had facilitated the sale of physical goods, and all parties had always wanted the goods to be sent directly from the seller to the buyer.

How does that protect the buyer if the seller sends a fake? Or how that it protect the seller if the buyer claims he received a fake?

How can you prevent this? If both parties are honest, they don't need an escrow. The escrow is only needed when one of the parties isn't honest, which should be the assumption in all steps taken by escrow.

Oh my bad in the Canary, i missed typed the year, things like that happen yet i will be updating it right away.
In the disputes part, i will work handle them professional, where there is direct messaging between the seller and the buyer, explaining their issues and will do our best to resolve or to find a suitable solution for both.
Direct communication is the secret on resolving disputes, and there's always a prove on who did wrong, you just have to find it.
For an example, if the seller sends a fake product, you can ask the buyer to show prove of it, and you can investigate it in one way or the other.
There is also tracking numbers if the seller did claim he hasn't received his product, and if he claimed it to be fake, we will ask him for his prove.
I will be creating a list in which sellers and buyers handle responsibility for their products or services, such as if the seller did send a broken item to buyer, he will be taking the responsibility of that, and we will find to whom we refund or release the payment.
Basically, disputes can be resolved with the right communication.