Btc-Banker.Com new hybrid cloud, safe and profitable wallet

[BurtW]

btc-banker:  

I have been around a long time here on these forums and you are, by far, the worst PR person I have ever seen.  You are far worse than MPOE-PR and that is really saying something.

Suggestions:

1) Get a new PR person that can handle being called a scammer without resorting to cussing, name calling, etc.  A PR person needs to have a very thick skin.  This new PR person MUST have total command of the English language.

2) Lock and abandon this thread.  Start a new one with the new PR person.

3) NEVER cuss.  ALWAYS capitalize the first person singular subject personal pronoun.  Make EVERY post totally professional, correctly spelled and well written.

4) This is a very technical forum.  No matter who you are there are people here that know more about Bitcoins, elliptical curve cryptography, keys, deterministic wallets, etc. than you do.  Your new PR person must be technically competent.  If they cannot handle or at least understand a trivial request to sign a message with an address that contains 30 BTC then how can they be expect to answer other more technical questions that must be answered in order to have a chance of success in this venture?

5) Since this is a highly technical forum the new PR person should ideally be one of the actual designers or developers of the software used on the web site or, at a minimum, have direct and timely contact with the developers in order to get technical questions answered quickly and accurately.

Why are you offering such an unreasonably high interest rate?  If your service is what it claims to be then there is no reason to spend so much on customer acquisition.  Also, once you get your initial customer base what is your business model? The most popular free hybrid wallet, blockchain.info, would be your direct competitor.  They make money on their mixing services.  How are you guys ever going to make a profit, especially given your very high initial customer acquisition expense?

You must be able to answer these simple economic questions in addition to the technical questions I will soon be asking you.

Despite your immature behavior, offensive language, and obvious lack of any technical knowledge I have decided to look into your service and maybe give it a try.  This is based on the fact that, so far, the web site does in fact appear to behave as I would expect a deterministic wallet to behave.  This shows that someone involved in the project, not you obviously, must be minimally technically competent.  

I will post my results and technical questions soon.

[BurtW]

OK, I tried your web site and here is what I found and here are my first set of questions and requests:

I logged in with a simple password in order to see how the site works.  I used the password "PPT-PR1" (old timers will see the joke there) and got the following generated deterministic addresses:

1BWfPQ2KYyBexzvkXWTrqsre9xzbbTJVMb
1GXVnQkdMVawvJ6ZBwbNCk6h8Q6KKZjtrt
1FqfooZiWYFEKTzvRPpqdW1sE3zJYLfbeU
1C4u9dqJPX6GZVeiY6LP4eNDb1dAT8Zpjp
1HUBgD9asEEGJEiSksegV61pzgL54aRi87
1MMqH8ArjMBegB1WfXGrqyjEvBwyivDuhL
19fTwfPPkwJv1LdU3zsxB6i8bQzdZEHPoE
18urBLFR92FYqKwFZnYb7V1tcPiQrP4jnu
1Eqt3EEwPEQXni2xe9PkJjEufjzFhmKkno
1FP4qtzroxhJyBvvQQgqEizFdpeeJ6nFxp

I tried using "PPT-PR2" and got a different set of addresses, so far so good:

1Fxyi1B1ZJDE8FqoexwNCYbS6u4yGEZ3zy
1FwMHQWtx34gMrGDxnNTmwfjwrFFA5VtfT
1Dp35DxqnjpKxJCwALyBXawHjG33BSwKmH
13Atp9B1vD6wK8zWbWDRfnaqTxZxvWWS93
1Lp43RnouVMtoZp3BPwucB9pFA5aubBBrT
19rwUqepBexsWydRqneKe8C1uGCDynBejb
1AAmqfzwqicjyMqTKSpi3KuoaJfpUNzXpb
16gq7LCJVHusf2hVoUTD6bB3j8LueeQwMT
144wKBBqNZR3Mi1G2U33xPf93Z6utEu169
1LpZod26MfL6cCFXu6TrEypBY2w4Kgs6Lg

The results are repeatable.  In other words anyone else can log in with those passwords and get those addresses.

What is the exact algorithm you are using to convert the password (PPT-PR1 and PPT-PR2 in these cases) into the deterministic sequence of private/public key pairs?

Assuming you are doing this correctly all of the key pair generation must be done client side.  As a first step this script must be open sourced and available for examination.   Is all key pair generation done client side?  If not you are already dead in the water.

The most obvious gaping hole that needs to be filled here is for you to prove that the password never leaves the client.  If I get some spare time I will look into it but in the mean time what can you do to prove to us it does not?

[BurtW]

Next, I used a real random password and got the following addresses:

1Euy5eERuvQKruwCKFPAVp4b3zceYGWPED
18CdWvazvpDnE9rkFPbfXWY5WnAriQKnHs
1M4QVFTsRzrMwzS2oDvb9QQPreDRo5e7Nq
197vv294WFKqwuR5DKuYf8TW35HGF257of
1AAxexhqc7LTYL7byWGky7oK9uzZ7a8VaT
1NciLKr4hfgYuUgSFjerLwfY1ABi4RXJj3
1DujvmjfQrrLozCjdoCS1MF4NCuUaS2S6A
1LyAYmSH13PA96CYnB33Sfjkq6NcM5rC32
19LahEBYhEHeEi4SmUqGvi1jnQzjzrH9rp
1FadVHYWno5ADEd7umSdW76RsA4o8N6ZzM

I sent 0.1 BTC to the first address and it arrived as you can see here:

https://blockchain.info/address/1Euy5eERuvQKruwCKFPAVp4b3zceYGWPED

Now for the big test.  I tried to send some of my BTC back to myself.  Oops, had to set a transaction password first.

Please explain the purpose and use of the transaction password in great technical detail.

Set a transaction password and tried to send.  Did not work.  Got the error message "No Response", tried again, still does not work.

Why can I not send my BTC out of my wallet?  Is this your revenue model?

I cannot really go any furthure in my testing until this issues is resolved.

[BurtW]

Well one mystery is somewhat partially solved.  One of their revenue streams is charging per transaction.  When I tried to send about half of my BTC back to myself the (unchangable) fee was displayed as follows:

Fee (Includes Miners Fee)
BTC 0.0005

They are charging 0.0004 BTC per transaction.

Why didn't you just tell us that up front?

The raw transaction (that did not work) shows the 0.0004 being paid back to them.  So, at least in part, they are trying to compete using the old https://www.strongcoin.com fee model.

Code:

{
    "hash": "795fe99a90989d1298734946e64d372f829ce0aac22e812ac05b62721889d22a",
    "ver": 1,
    "vin_sz": 1,
    "vout_sz": 3,
    "lock_time": 0,
    "size": 292,
    "in": [
        {
            "prev_out": {
                "hash": "d124bd24209763520756edb9ea39fb3adf38ca5f648904748b9b1b2a07b9d048",
                "n": "11"
            },
            "scriptSig": "3045022100e75232c03369180d633d1853396dbdcc2040cd03be9b077464189d43871ce4e702207106c2b003773dcc334741f4735be7553cbf0e713581b9b703970428fdd9a76401 0480fda9c34eb7c498b106758a466bee880e79d17ac5d1644f7649266f41b007b9ff214677b3312196c3829a3d93ca4037bef47cc5acf48a3a78b91af16752cde3"
        }
    ],
    "out": [
        {
            "value": "0.04950000",
            "scriptPubKey": "OP_DUP OP_HASH160 bbb063b5b7921ba486fd270e565f8e283a56e629 OP_EQUALVERIFY OP_CHECKSIG"
        },
        {
            "value": "0.00040000",
            "scriptPubKey": "OP_DUP OP_HASH160 06bad1c6c8d1179222ab22cec15fd1dc4b82dc08 OP_EQUALVERIFY OP_CHECKSIG"
        },
        {
            "value": "0.05000000",
            "scriptPubKey": "OP_DUP OP_HASH160 989e1415b6d5dd40ac5443ad09a9ba384b2414e1 OP_EQUALVERIFY OP_CHECKSIG"
        }
    ]
}

[BurtW]

Tried again to send the BTC back to myself and, I'll be darned, it worked!!!!!!!!!!!

So, what was the issue?  Did you guys fix something?  Was your transaction processor down for a while?

OK we passed that test.  Here is the transaction:

https://blockchain.info/tx/795fe99a90989d1298734946e64d372f829ce0aac22e812ac05b62721889d22a

We can see the 0.0004 transaction charge was sent to here:

https://blockchain.info/address/1carbQXAt6aUcePdFcfS3Z8JNwMCMDb4V

So far they have collected 0.0848 BTC on 212 transaction (the math is correct!).  This is $54.32 at the current price.

[BurtW]

So far, nice product.  A few minor bugs but that is to be expected.  Now let's get into the meat of the matter.

Assuming my password never leaves the client and all key pair generation is done client side.  How do you guys know which Bitcoin addresses have been generated?   Obviously you will need to know this in order to track your number of customers and the number of BTC on deposit so you can pay the interest to them.

You need to answer that.

Moving on, assuming that you have figured out an honest way to do that, my next test is that I created another account using a new random password and put some BTC in one of the addresses.  I will report back tomorrow if I get paid the proper amount of interest on the account.

After depositing another 0.15 BTC to bring my total up to 0.2 BTC I will also expect to get about(?) 0.006 BTC on my public accounts posted above.  See my first two deterministic addresses (now 0.1 BTC each):

https://blockchain.info/address/1Euy5eERuvQKruwCKFPAVp4b3zceYGWPED
https://blockchain.info/address/18CdWvazvpDnE9rkFPbfXWY5WnAriQKnHs

Another couple of questions (that will be answered some time tomorrow) are:  how does the interest get paid? and how does the interest get calculated?  We shall see.

[BurtW]

Nice to see you are still here.

You guys need to fix this to show your actual numbers, or take it down:

6594 members with over 1905.6817307692 bitcoins are trusting us!
6595 members with over 1905.7258461538 bitcoins are trusting us!
6597 members with over 1905.8140769231 bitcoins are trusting us!
6599 members with over 1931.8677884615 bitcoins are trusting us!
6608 members with over 1934.6846153846 bitcoins are trusting us!
6614 members with over 1935.9365384615 bitcoins are trusting us!
6981 members with over 1964.3635384615 bitcoins are trusting us!

Anyone can see it is totally fabricated.  If you are going to make up amounts of BTC then at least do it right.  It does not help you gain trust to use these fabricated numbers - it hurts you.  I highly suggest you remove it.

Yes, looking forward to seeing how the whole interest thing works tomorrow.

Please forward all of my questions and concerns to someone who is technically knowlegable, find out the answers to all of my questions (bolded so you can find them easily) and post the answers here.

[BurtW]

I will answer now only what i know -the transactions password need to secure the account, because you have right "in other words anyone else can log in with those passwords and get those addresses"  - yes, can login but without your transactions password can only watch the coins on this addresses.

This answer does not satisfy me.  I need a more technical answer.  Please forward this question to your more technical people and get a more detailed answer.

3. tomorrow your 3% profit will be in a virtual "purse" and from here you will choose a btc address to which you withdraw this money instantly - this address can be one of your 10 deterministic created address or a other, external address, the withdrawal will be instant, you need only request. 

Makes sense. Will check back tomorrow.

[BurtW]

4. the withdrawal will be made from one of our btc account - our company has many btc accounts, for sure we dont store all our coins in only 1 account,
the software choose, randomly i think one of our account, this account can contain very various amount of bitcoins, maybe from 0,10 btc up to 50 btc - thats why is useless signin message from this account and this is my answer now to MrWDunne, he called our service scam without to test it, only because the comany not signed a message.

Can't wait to see my interest, how much it is, where it comes from, etc.  I will tell me loads of information about your service.  I think I am done for today.  See you tomorrow.

[BurtW]

New members and bitcoins deposited are counted instantly. - that mean if you create a new account or you deposit a random amount this will be counted instantly in this statistic, try it.

I did.

[MrWDunne]

Request: Please leave the forum

[BurtW]

Got my full 0.006 BTC interest for today.  Transaction here:

https://blockchain.info/tx/829c2fc86154516f5183003f0d71deda20b4e7cd5849cdf442693d7c4789aca1

Coins came from here:

https://blockchain.info/address/1Mn6MsEbQZyXfAMQe6WYHS1mBuZmyNwXLk

Knock yourself out with taint analysis.  I found nothing that jumped out at me so far.

Obviously if they paid out 3% on the claimed 1934.6846153846 BTC on deposit they would have had to pay out:

1934.6846153846 x 3% = 58.040538461538 BTC @ $646 = $37,494.18 just for today.

Of course we already know the number of customers and the "amount trusted" are both just total bullshit.  Personally I am going to overlook this for now as it is really just a "sales gimmick" and is the least of our worries at the moment.

Conclusion so far:  It is impossible for this to be a classic Ponzi scheme.  The coins held in your deterministic wallet are under your control at all times.  They cannot use the coins on deposit to pay the interest.  If they moved the coins from your deterministic wallet it would show up in the blockchain.  Their sales department is lying about the number of customers and the amount they have on deposit but hey, that is what sales departments do.

I am now delving into their code to see if there are any security holes in it such as backdoor transmition of the private keys or the password/seed to the deterministic key pair chain.  By looking at their code I have already determined their algorithm for converting the password into the key pair chain.  So far it looks OK - just a lift from readily available open source code.

If you are interested:  https://www.btc-banker.com/extjs/electrum.js

[BurtW]

Hey, is anyone here a JavaScript expert?  I need help with something I am looking at.  I know Java like the back of my hand but JS is something else to muddle through.

[MrWDunne]

Because you are a scammer. His withdrawal did not work and he reported it so you re-enabled it.

You cannot even sign a message, and this fool is about to make an expensive mistake.

[MrWDunne]

all withdrawal work fine, instantly - he has not seted his transaction password for withdrawal, thats why not worked
maybe you are scammer, fucking idiot, only a scammer call all time scammer - very probable you scam and thats why you see scammer all time.

I see a scammer here because you offer 3% interest per day, lie about the numbers of users you have, can't even sign a fucking message from an address with 30BTC. Offer no idea of how you are going to make a profit (regardless of the fact that so far you claim to have given away 836 BTC)

[MrWDunne]

all this what you say are not your problem and no evidence for scam ... you only talk shit because u have nothing to do ...get a life !

This is painful.

Prove it, go on. Prove that anything you have said so far is true.

Sign a message.

You put a message up asking people to vouch, not one of your 1600 users did, even though this magical service is earning them 3% per day.

You just revealed that your systems send the Bitcoin, that means your customer addresses are accessible, and you could sign a message from them or empty them.

This whole thing is painfully obvious.

As for why I do this, I do this so other people don't get ripped off. You jackass.

[BurtW]

thanks your fair analysis - hope today i will come back to you with the technical answers.

"Obviously if they paid out 3% on the claimed 1934.6846153846 BTC on deposit they would have had to pay out:
1934.6846153846 x 3% = 58.040538461538 BTC @ $646 = $37,494.18 just for today."

the statistic is real and we still need paid more more less daily for the 3% profit, and i explain you why:
the btc number is a total, a grand total - in this total is counted example if a member deposit daily 1 btc- but he withdraw the coin tomorrow and deposit it again, day by day, so if he send 30 time 1 btc in a moth to his btc-banker bitcoin address the statistic will show 30 btc in total but we pay only for 1 btc profit

Thank you for this response.

So, as I said, these number are in the best case very misleading or more likely total bullshit.  So, as I said, it should be fixed to show the actual amount currently on deposit and the current actual number of active accounts (something you would need to have access to in order to pay out the correct interest to the correct accounts) or be taken down.  So, as I said, these numbers do not help your case at all and, in fact, hurt your credibility.  So, as I said, it is a marketing ploy.  So, as I said, you guys really should remove it.  

I am glad we are all in total agreement with respect to these numbers.

But, as I said, I do not care about these two numbers as I have bigger fish to fry.

Still looking for a JavaScript expert to verify one thing for me before I post my findings from your code.

[BurtW]

SCAMMER

My 0.1 BTC was moved off my "safe" deterministic address:

https://blockchain.info/address/1Euy5eERuvQKruwCKFPAVp4b3zceYGWPED

last night while I was asleep, see:

https://blockchain.info/tx/d48826b2515072a73f43c2515403fd96c8c252f6cc6e7018f151a0846000528a

The coins were moved here:

https://blockchain.info/address/17nz37jqtQsvVWoi2AKzhuNrkLhH4D2AtN

then here:

https://blockchain.info/address/17DNktmPsUAbD4pXcewGMHk9yQmJNZ2kUH

then mixed.

At just about the same time, 2014-06-05 10:25:22, my other 0.1 BTC were also moved:

https://blockchain.info/tx/859e9b8777641af8c889e4be8c280f0a8194368bf557d3b40331041a502fed0f

Coins are still here:

https://blockchain.info/address/19ZUbFwYEk67oLzUXYMnmjTda8qCzWWrHe

When they need them to pay interest to someone else they will move them and mix them from there.

[MrWDunne]

You deserved to get scammed.

The warning was in big red letters on page one. We explained several times as to why this service is a joke. He couldn't even sign a message or speak proper English.

I hate to say I told you so.

[BurtW]

You deserved to get scammed.

The warning was in big red letters on page one. We explained several times as to why this service is a joke. He couldn't even sign a message or speak proper English.

I hate to say I told you so.

Get off your high horse.  I knew I was going to spend that money.  It was a service to all those people who were in doubt.  I can afford to spend 0.2 BTC that I bought at less than $2/BTC.  Your method of screaming works for some.  My method proves it to everyone.

Got anything to say for yourself there btc-banker?  At least come back and tell us how much you got in total so we can wonder at your hacker skillz.  We know you got my 0.2 BTC, was anyone else playing.

Or, he is gone not to return, either way we all win.