[BitcoinMax.com] Closed

[Epoch]

Is anyone concerned, in terms of security, with the current website login of:

username: <forum name>
password: <deposit address>

Just thinking out loud, but taking an example, let's say we know someone sent 45 BTC on or before a specific date/time. We know who it was because they posted 'whoa, I just sent 45 BTC!' here in this forum (I notice there are several members who have posted their deposit amounts looking back at the post history).

The blockchain can be easily searched for all 45 BTC transactions prior to that date (for, say, the period 2 or 3 days prior). There may be several matching hits, but likely not a huge number.

We know the user's bitcoinmax.com name from the forum here. We could then try a login at bitcoinmax.com using that name and the various deposit addresses found from the blockchain matching 45 BTC. Eventually the login would be successful and the 'imposter' would have access to the account.

I may be missing something (and I hope I am), but I'm asking for someone to convince me that the <forum name>/<deposit address> system used by bitcoinmax.com is secure from a hack similar to what I've described above.

[1714028549]

1714028549

[1714028549]

1714028549

[1714028549]

1714028549

[1714028549]

1714028549

[1714028549]

1714028549

[tgmarks]

Is anyone concerned, in terms of security, with the current website login of:

username: <forum name>
password: <deposit address>

Just thinking out loud, but taking an example, let's say we know someone sent 45 BTC on or before a specific date/time. We know who it was because they posted 'whoa, I just sent 45 BTC!' here in this forum (I notice there are several members who have posted their deposit amounts looking back at the post history).

The blockchain can be easily searched for all 45 BTC transactions prior to that date (for, say, the period 2 or 3 days prior). There may be several matching hits, but likely not a huge number.

We know the user's bitcoinmax.com name from the forum here. We could then try a login at bitcoinmax.com using that name, and the various deposit addresses found from the blockchain that matched 45 BTC. Eventually the login would be successful and the 'imposter' would have access to the account.

I may be missing something (and I hope I am), but I'm asking for someone to convince me that the <forum name>/<deposit address> system used by bitcoinmax.com is secure from a hack similar to what I've described above.

What is there to be concerned about?  So someone could possibly be able to see your deposit address, balance, and toggle whether to reinvest or not.  There is no access to your funds through the website.

[BTC-engineer]

Is anyone concerned, in terms of security, with the current website login of:

username: <forum name>
password: <deposit address>

Just thinking out loud, but taking an example, let's say we know someone sent 45 BTC on or before a specific date/time. We know who it was since they posted 'whoa, I just sent 45 BTC!' here in this forum (I notice there are several members who have posted their deposit amounts looking back at the post history).

The blockchain can be easily searched for all 45 BTC transactions prior to that date (for, say, the period 2 or 3 days prior). There may be several hits, but likely not a huge number.

We know the user's bitcoinmax.com name from the forum here. We could then try a login at bitcoinmax.com using that name, and the various deposit addresses found from the blockchain that matched 45 BTC. Eventually the login would be successful and the 'imposter' would have access to the account.

I may be missing something (and I hope I am), but I'm asking for someone to convince me that the <forum name>/<deposit address> system used by bitcoinmax.com is secure from a hack similar to what I've described above.

I already worried about the same thing.
Because I'm not (yet) able to login I don't know if the user can change the password. If you would change the password before you do an transfer it should not be a problem.
Even if someone knows your account data I'm not sure what he really can do without seeing your bitcoins...

[Epoch]

What is there to be concerned about?  So someone could possibly be able to see your deposit address, balance, and toggle whether to reinvest or not.  There is no access to your funds through the website.

I didn't know what is, and what is not, possible to do through the website. If you cannot withdraw (or set/change withdrawal address), then that eliminates one of my key concerns. Thanks.

[BTC-engineer]

new investors that cannot log in yet, need to go back to the OP and read the FAQ.

creating a login is a manual process, and I'm not going to do that unless i see at least 10 coins come in. even then, i'll probably only be doing that once a day (setting up new logins).

Thank's for clarification. I've now first sent my coins and will check tomorrow again.

[ErebusBat]

Also people who post in a public forum of 'I just sent xxBTC' obviously are not too concerned with privacy.

[bitdragon]

if anyone else notices deposits missing, please let me know.
thanks.

my additional funds have not shown up yet

[payb.tc]

if anyone else notices deposits missing, please let me know.
thanks.

my additional funds have not shown up yet

okay then, i decided just for now to completely remove the code which tries to limit calls to blockchain.info, and your deposit showed up.

it'll now take slightly longer (~1 second) for everyone to log in, but it will force the check every time now.

i'll take a further look at the issue later, if i think it's calling blockchain.info too much.

[ErebusBat]

What about a CHECK button that we can use to initiate the check?  That way it doesn't happen EVERYTIME but when we know we have sent money and want it to show we can hit that?

[payb.tc]

latest investors (who have sent at least 10 btc) should be able to log in to bitcoinmax now.

...although some are missing the withdrawal address, but i'm going through and populating those at the moment.

oh, all these new accounts have been created with reinvest=YES, so if you want to change it, please do so in the login area.

BTC-engineer, your username for bitcoinmax has no dash in it.

[xxaudioxx]

thanks payb.tc

[John (John K.)]

thanks payb.tc

+1

[ehmdjii]

how does one get an account?
is it referer based? if so, then i would be happy if i could get an invite!

[tgmarks]

how does one get an account?
is it referer based? if so, then i would be happy if i could get an invite!

You should read the very first post in the thread.

[fuxianhui888]

thanks payb.tc

+1

+2

[payb.tc]

over the past couple of hours, i've come up with an 'earnings report' page which is now in the login area of bitcoinmax.

i'm still doing some debugging on this page, but it should show you exactly how your payments are being calculated so you can verify the accuracy of your earnings each week.

thanks.


edit: i've now also extended this to include an estimate of your Next Payment at the top of every page.

[John (John K.)]

over the past couple of hours, i've come up with an 'earnings report' page which is now in the login area of bitcoinmax.

i'm still doing some debugging on this page, but it should show you exactly how your payments are being calculated so you can verify the accuracy of your earnings each week.

thanks.


edit: i've now also extended this to include an estimate of your Next Payment at the top of every page.

Thanks for this feature!
By the way, you could add a clock to the page too so that we can know what timezone the server makes its calculations on.

[payb.tc]

over the past couple of hours, i've come up with an 'earnings report' page which is now in the login area of bitcoinmax.

i'm still doing some debugging on this page, but it should show you exactly how your payments are being calculated so you can verify the accuracy of your earnings each week.

thanks.


edit: i've now also extended this to include an estimate of your Next Payment at the top of every page.

Thanks for this feature!
By the way, you could add a clock to the page too so that we can know what timezone the server makes its calculations on.

everything is UTC.

my brain is UTC.

you should see my house too, some of the clocks are UTC.

[DutchBrat]

Looks great !

Thanks !!!

[ErebusBat]

Can't wait until I have my BTC for my first deposit.