Bitcoin Forum
December 10, 2016, 10:42:06 PM *
News: To be able to use the next phase of the beta forum software, please ensure that your email address is correct/functional.
 
   Home   Help Search Donate Login Register  
Pages: « 1 [2]  All
  Print  
Author Topic: we need a comprehensive guide for making SAFE bitcoin apps!!  (Read 2141 times)
acoindr
Legendary
*
Offline Offline

Activity: 1036


View Profile
July 13, 2012, 07:17:48 PM
 #21

high tech is not the solution to the problems in your previous emails, but my comment was a bit of a sidetrack (that i wish to drop from this thread after this point is made):

i was strictly talking about an idea of how to hide a hot wallet server, disconnected from your previous points. the above, provided some basic precaution on part of the developer, would not reveal a means into the wallet server.

Oh, gotcha Smiley

Yes, securing hot wallets has been discussed, but I don't know the thread off hand.
1481409726
Hero Member
*
Offline Offline

Posts: 1481409726

View Profile Personal Message (Offline)

Ignore
1481409726
Reply with quote  #2

1481409726
Report to moderator
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
1481409726
Hero Member
*
Offline Offline

Posts: 1481409726

View Profile Personal Message (Offline)

Ignore
1481409726
Reply with quote  #2

1481409726
Report to moderator
1481409726
Hero Member
*
Offline Offline

Posts: 1481409726

View Profile Personal Message (Offline)

Ignore
1481409726
Reply with quote  #2

1481409726
Report to moderator
1481409726
Hero Member
*
Offline Offline

Posts: 1481409726

View Profile Personal Message (Offline)

Ignore
1481409726
Reply with quote  #2

1481409726
Report to moderator
paulie_w
Sr. Member
****
Offline Offline

Activity: 420


View Profile
July 13, 2012, 07:20:28 PM
 #22

imho those kinds of threads should be collected and organized into a wiki per this thread:

https://bitcointalk.org/index.php?topic=93115.0;topicseen
EnergyVampire
Full Member
***
Offline Offline

Activity: 210



View Profile
July 13, 2012, 07:47:40 PM
 #23

Do trading sites like MtGox, BTC-E, BitStamp, Intersango, bitFloor, GLBSE, etc need a hot wallet at all?

acoindr
Legendary
*
Offline Offline

Activity: 1036


View Profile
July 13, 2012, 07:53:09 PM
 #24

Do trading sites like MtGox, BTC-E, BitStamp, Intersango, bitFloor, GLBSE, etc need a hot wallet at all?

It depends on amount of volume. A site like MtGox having the majority of bitcoin exchange probably does, because manually processing transactions would be labor intensive.

But remember it's possible to secure a hot wallet, and this latest theft had nothing to do with a hot wallet all.
kiba
Legendary
*
Offline Offline

Activity: 980


View Profile
July 13, 2012, 07:57:14 PM
 #25


It depends on amount of volume. A site like MtGox having the majority of bitcoin exchange probably does, because manually processing transactions would be labor intensive.

They just need automation.

Quote
But remember it's possible to secure a hot wallet, and this latest theft had nothing to do with a hot wallet all.

It does. Having a balance with mtgox is effectively a hot wallet.

acoindr
Legendary
*
Offline Offline

Activity: 1036


View Profile
July 13, 2012, 08:09:14 PM
 #26

It does. Having a balance with mtgox is effectively a hot wallet.

I meant people seem to think hot wallets are the reason bitcoins are vulnerable, but wallets are only one potential vulnerability. This latest theft was due to sloppy password handling, and 40K USD was stolen in addition to 40K BTC.
World
Hero Member
*****
Offline Offline

Activity: 746



View Profile
July 13, 2012, 08:23:51 PM
 #27

folks,
start putting together a wiki guide for making secure bitcoin apps, from web to desktop to mobile.

who is competent enough to make one? maybe start to collaboratively put that together? it's really important that everyone's knowledge on the subject of security start being pooled and guided so that new people coming into the community with an enthusiasm for making great apps, don't end up like bitcoinica!

so how about it?

https://en.bitcoin.it/wiki/Securing_online_services

Supporting people with beautiful creative ideas. Bitcoin is because of the developers,exchanges,merchants,miners,investors,users,machines and blockchain technologies work together.
EnergyVampire
Full Member
***
Offline Offline

Activity: 210



View Profile
July 13, 2012, 08:24:51 PM
 #28

+1 for this initiative

I like the whole idea of Standard Operating Procedures (SOP), Transparency, Disclosures, Best Practices, etc for sites that take custody of customers funds. Not so much as a requirement for starting the site but as a way for potential/current customers to evaluate the risk involved when dealing with them.

The Bitcoin Protocol is innovative but financial institutions on the other hand have been around for a very long time.

Caveat emptor

kiba
Legendary
*
Offline Offline

Activity: 980


View Profile
July 13, 2012, 08:27:31 PM
 #29

I meant people seem to think hot wallets are the reason bitcoins are vulnerable, but wallets are only one potential vulnerability. This latest theft was due to sloppy password handling, and 40K USD was stolen in addition to 40K BTC.

You're right, I guess. Even if the bitcoin were offline, the thief could have wait and wait until the balances were loaded into mtgox and use to pay customers or the site start operating.

paulie_w
Sr. Member
****
Offline Offline

Activity: 420


View Profile
July 13, 2012, 08:42:18 PM
 #30

folks,
start putting together a wiki guide for making secure bitcoin apps, from web to desktop to mobile.

who is competent enough to make one? maybe start to collaboratively put that together? it's really important that everyone's knowledge on the subject of security start being pooled and guided so that new people coming into the community with an enthusiasm for making great apps, don't end up like bitcoinica!

so how about it?

https://en.bitcoin.it/wiki/Securing_online_services

oh, great start! i see that it was started in may.

may we use this as the base, and expand it as discussed?
h00ters
Newbie
*
Offline Offline

Activity: 22


View Profile
July 14, 2012, 01:34:55 AM
 #31

Don't know what you're goal is, but anything can be hacked with time. Using proper security techniques help, but anything can be by-passed. I.E 2-factor auth, dont use same passwords etc... Simple, logical things...

Tip, Don't believe everyone that says they are a security expert without any proof... I.E Patrick from Bitconica...
World
Hero Member
*****
Offline Offline

Activity: 746



View Profile
July 14, 2012, 08:41:58 PM
 #32

oh, great start! i see that it was started in may.
may we use this as the base, and expand it as discussed?
Mike Hearn was the author
https://bitcointalk.org/index.php?topic=82098.msg904743#msg904743

Supporting people with beautiful creative ideas. Bitcoin is because of the developers,exchanges,merchants,miners,investors,users,machines and blockchain technologies work together.
mistfpga
Member
**
Offline Offline

Activity: 84


View Profile
July 14, 2012, 09:23:08 PM
 #33

Hi Paulie,

the advice you want people to use already exists,

the Open Web Application Security Project

https://www.owasp.org/index.php/Main_Page

you will find professional people, who are very good at what they do.  These people may even be persuaded to work on bitcoin - that place is like a repository of web app security.  if  a company does not follow thier advice...

go check it out. get some people interested...

bitcoin is a blockchain and interaction with this chain.  it is not securing web apps.

sorry to be a miserable git.

steve
paulie_w
Sr. Member
****
Offline Offline

Activity: 420


View Profile
July 16, 2012, 03:44:58 PM
 #34

here's a place to start maybe:

http://blog.ircmaxell.com/2012/07/secure-programmers-pledge.html
Gavin Andresen
Legendary
*
Offline Offline

Activity: 1652


Chief Scientist


View Profile WWW
July 16, 2012, 06:12:43 PM
 #35

Starting with OWASP is good advice.

But if you are holding other people's bitcoins, just securing the app is not enough. You need people who have experience securing money telling you how to create processes to make sure you're not the victim of embezzlement, that you are complying with legal requirements, keeping adequate records, keeping customers' funds separate from the funds used to pay expenses, that regular audits are done to detect problems early, and so on.

The Bitcoin Protocol is innovative but financial institutions on the other hand have been around for a very long time.
+1

How often do you get the chance to work on a potentially world-changing project?
Pages: « 1 [2]  All
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!