7 ms·

Ruxum: Wall Street-Level Security Comes to Bitcoin

37 points by jsherry 15y ago

evilswan 15y ago
In light of recent years' events, I hope "Wall Street-Level Security" is taken to mean "Not very secure".
- nbpoole 15y ago
  > Just passed a 47,000 point security check by an independent 3rd party. Our platform is also now PCI DSS compliant. Daily tests starting now https://twitter.com/#!/ruxum/status/86827701381496833 https://twitter.com/#!/ruxum/status/86827701381496833 In other words, https://secure.trust-guard.com/certificates/www.ruxum.com https://secure.trust-guard.com/certificates/www.ruxum.com Personally, I don't consider that to be "Wall Street-Level Security."
  - chadp 15y ago
    That is one thing, some other here https://x.ruxum.com/security https://x.ruxum.com/security
    - nbpoole 15y ago
      Yes, with a lot of vague, generic statements. "Security measures have been built into the design and setup of our infrastructure." tells you absolutely nothing. Neither does "Disasters are never nice events and we hope they don’t happen. We also expect one will happen and have plans to recover when it does." (although it's not strictly a security issue either).
  - ebaysucks 15y ago
    Getting a Truast Guard SSL security certificate is not that hard to do.
SlyShy 15y ago
You can sign-up using the invitation code "techcrunch", but there are only five hundred open spaces. https://x.ruxum.com/users/sign_up https://x.ruxum.com/users/sign_up
rheide 15y ago
Another centralized institution profiting from the decentralized-ness of Bitcoin. Perhaps it's the direction Bitcoin will have to grow in, in order to stay alive/popular.
jerf 15y ago
Goals aren't results. Ruxum has the goal of bringing "Wall Street-level" security to BitCoin trading. We won't have a good idea of whether they've succeeded until they've come under sustained attack by intelligent hackers for long periods of time, and stood up. (And note I said "good idea" even so, not "proof".) I also read the security policy at https://x.ruxum.com/security https://x.ruxum.com/security . It's nice and all, and does sound to be off on a better track, but being really, really secure is hard. I'm not saying they haven't succeeded, I really don't know (or much care). I'm just commenting on how phrasing it as if it's a done deal, rather than a goal, is cognitively hazardous.
tptacek 15y ago
Their security claim appears to revolve around signing up with "Trust Guard": http://www.trust-guard.com/ http://www.trust-guard.com/ I can sum up my take on this by saying I've never heard of "Trust Guard".
- rdtsc 15y ago
  It doesn't matter, they have the word 'trust' in their name, so they must be trustworthy.
- mrkurt 15y ago
  That's because they're classified. Classified means trust.
- Xk 15y ago
  They have an XSS on https://secure.trust-guard.com/ https://secure.trust-guard.com/ (enter a username like <img src=g onerror=alert(1)> -- yes, it won't work with chrome's XSS filter)... somehow I'm inclined to believe they are not so great. (An attacker could exploit that in a number of ways. Here's a simple one: create a site with a domain name that looks really similar. http://secure.trustt-guard.com http://secure.trustt-guard.com or something, it doesn't matter. When a user visits, autosubmit a form to https://secure.trust-guard.com https://secure.trust-guard.com with the malicious payload; the first thing it does is hide the error message and incorrect username. The user then enters username/password and attacker reads the values and sends it back to his site.) What's worse, I can't find any way to report this. Does anyone see a link?
  - zwp 15y ago
    > They have an XSS Oh dear. The (short) audio clips on their site are... interesting. Trust Guard's emphasis/value appears to be sales conversions, not security per se. https://www.trust-guard.com/category-s/3.htm https://www.trust-guard.com/category-s/3.htm First sentences from the two co-founders: "We really really try to help our customers increase their conversion rate" "People spend a lot of time and a lot of money getting people to their site then they don't do the things that increase conversion"
travem 15y ago
Assuming that their claim is true it wouldn't protect the value of bitcoins in the event of a similar incident to Mt. Gox occurring in a different exchange, would it? The value would still crash dramatically.
- ebaysucks 15y ago
  Depends on whether they have an automated circuit breaker in place.
ebaysucks 15y ago
I'm building my own Bitcoin Exchange as we speak and I can tell you, these security measures are nice (we had most of them planned too, plus some) but real Wall Street level security is only affordable in a more mature market.
- adrianwaj 15y ago
  Have you seen this? https://github.com/macourtney/Dark-Exchange https://github.com/macourtney/Dark-Exchange edit: this is not my repo!
  - ebaysucks 15y ago
    This is a github repo I think we missed. Have shared it with the team. We are making some chenges to the bitcoin client to make our centralized exchange more secure, but a distributed exchange is a promising model too. We ended up not pursuing that route as we didn't find a user friendly way of decentralizing the deposits and withdrawals. Will get back to you later to discuss your repo and maybe we can work together in the near future. Good luck with your project!
deleted 15y ago
[deleted]
ScottBurson 15y ago
This is the second new Bitcoin exchange I've seen recently. The first was CampBX: http://campbx.com/ http://campbx.com/ (Don't ask me why a business that's trying to get itself taken seriously as a financial exchange would choose a name containing the word "camp".) Anyway, for the moment, as far as security goes, these new exchanges don't necessarily need "Wall Street-level" security; they just need to be perceived as probably being more secure than Mt. Gox, which, given recent events, shouldn't be difficult. But to attract traders, they also need liquidity, which they don't have much of yet.
noonespecial 15y ago
"Wall Street Level" means insured against loss. Bcrypt is good security practice. Taking responsibility for the money you hold for people is "Wall Street Level".
dguido 15y ago
Contrast this with TradeHill which recently announced a two-factor login option powered by DUO Security. I'll take a guess and say that tptacek at least knows who runs DUO :-). https://www.tradehill.com/ https://www.tradehill.com/ http://www.duosecurity.com/about http://www.duosecurity.com/about

37 points by jsherry 15y ago

evilswan 15y ago

In light of recent years' events, I hope "Wall Street-Level Security" is taken to mean "Not very secure".

nbpoole 15y ago
> Just passed a 47,000 point security check by an independent 3rd party. Our platform is also now PCI DSS compliant. Daily tests starting now https://twitter.com/#!/ruxum/status/86827701381496833 https://twitter.com/#!/ruxum/status/86827701381496833 In other words, https://secure.trust-guard.com/certificates/www.ruxum.com https://secure.trust-guard.com/certificates/www.ruxum.com Personally, I don't consider that to be "Wall Street-Level Security."
- chadp 15y ago
  That is one thing, some other here https://x.ruxum.com/security https://x.ruxum.com/security
  - nbpoole 15y ago
    Yes, with a lot of vague, generic statements. "Security measures have been built into the design and setup of our infrastructure." tells you absolutely nothing. Neither does "Disasters are never nice events and we hope they don’t happen. We also expect one will happen and have plans to recover when it does." (although it's not strictly a security issue either).
- ebaysucks 15y ago
  Getting a Truast Guard SSL security certificate is not that hard to do.

SlyShy 15y ago

You can sign-up using the invitation code "techcrunch", but there are only five hundred open spaces. https://x.ruxum.com/users/sign_up https://x.ruxum.com/users/sign_up

rheide 15y ago

Another centralized institution profiting from the decentralized-ness of Bitcoin. Perhaps it's the direction Bitcoin will have to grow in, in order to stay alive/popular.

jerf 15y ago

Goals aren't results. Ruxum has the goal of bringing "Wall Street-level" security to BitCoin trading. We won't have a good idea of whether they've succeeded until they've come under sustained attack by intelligent hackers for long periods of time, and stood up. (And note I said "good idea" even so, not "proof".) I also read the security policy at https://x.ruxum.com/security https://x.ruxum.com/security . It's nice and all, and does sound to be off on a better track, but being really, really secure is hard. I'm not saying they haven't succeeded, I really don't know (or much care). I'm just commenting on how phrasing it as if it's a done deal, rather than a goal, is cognitively hazardous.

tptacek 15y ago

Their security claim appears to revolve around signing up with "Trust Guard": http://www.trust-guard.com/ http://www.trust-guard.com/ I can sum up my take on this by saying I've never heard of "Trust Guard".

rdtsc 15y ago
It doesn't matter, they have the word 'trust' in their name, so they must be trustworthy.
mrkurt 15y ago
That's because they're classified. Classified means trust.
Xk 15y ago
They have an XSS on https://secure.trust-guard.com/ https://secure.trust-guard.com/ (enter a username like <img src=g onerror=alert(1)> -- yes, it won't work with chrome's XSS filter)... somehow I'm inclined to believe they are not so great. (An attacker could exploit that in a number of ways. Here's a simple one: create a site with a domain name that looks really similar. http://secure.trustt-guard.com http://secure.trustt-guard.com or something, it doesn't matter. When a user visits, autosubmit a form to https://secure.trust-guard.com https://secure.trust-guard.com with the malicious payload; the first thing it does is hide the error message and incorrect username. The user then enters username/password and attacker reads the values and sends it back to his site.) What's worse, I can't find any way to report this. Does anyone see a link?
- zwp 15y ago
  > They have an XSS Oh dear. The (short) audio clips on their site are... interesting. Trust Guard's emphasis/value appears to be sales conversions, not security per se. https://www.trust-guard.com/category-s/3.htm https://www.trust-guard.com/category-s/3.htm First sentences from the two co-founders: "We really really try to help our customers increase their conversion rate" "People spend a lot of time and a lot of money getting people to their site then they don't do the things that increase conversion"

travem 15y ago

Assuming that their claim is true it wouldn't protect the value of bitcoins in the event of a similar incident to Mt. Gox occurring in a different exchange, would it? The value would still crash dramatically.

ebaysucks 15y ago
Depends on whether they have an automated circuit breaker in place.

ebaysucks 15y ago

I'm building my own Bitcoin Exchange as we speak and I can tell you, these security measures are nice (we had most of them planned too, plus some) but real Wall Street level security is only affordable in a more mature market.

adrianwaj 15y ago
Have you seen this? https://github.com/macourtney/Dark-Exchange https://github.com/macourtney/Dark-Exchange edit: this is not my repo!
- ebaysucks 15y ago
  This is a github repo I think we missed. Have shared it with the team. We are making some chenges to the bitcoin client to make our centralized exchange more secure, but a distributed exchange is a promising model too. We ended up not pursuing that route as we didn't find a user friendly way of decentralizing the deposits and withdrawals. Will get back to you later to discuss your repo and maybe we can work together in the near future. Good luck with your project!

deleted 15y ago

[deleted]

ScottBurson 15y ago

This is the second new Bitcoin exchange I've seen recently. The first was CampBX: http://campbx.com/ http://campbx.com/ (Don't ask me why a business that's trying to get itself taken seriously as a financial exchange would choose a name containing the word "camp".) Anyway, for the moment, as far as security goes, these new exchanges don't necessarily need "Wall Street-level" security; they just need to be perceived as probably being more secure than Mt. Gox, which, given recent events, shouldn't be difficult. But to attract traders, they also need liquidity, which they don't have much of yet.

noonespecial 15y ago

"Wall Street Level" means insured against loss. Bcrypt is good security practice. Taking responsibility for the money you hold for people is "Wall Street Level".

dguido 15y ago

Contrast this with TradeHill which recently announced a two-factor login option powered by DUO Security. I'll take a guess and say that tptacek at least knows who runs DUO :-). https://www.tradehill.com/ https://www.tradehill.com/ http://www.duosecurity.com/about http://www.duosecurity.com/about