4 ms·

> Without understanding more about the technical details, this feels like unless a user is using an app to re-key immediately at the time of transfer that it's

> Without understanding more about the technical details, this feels like unless a user is using an app to re-key immediately at the time of transfer that it's significantly less secure than normal cash. We will have a security overview doc up soon, we ran out of time to have it ready today. Long story short, there are pending key rotation states and the latest holder can always re-key the note again. But it is indeed distinct from cash; we can't just state a note has value like governments do, by fiat. We have to provide users with sufficient information to assess the veracity of that claim relative to the functions of Bitcoin and the information we provide on the note. > But they have to do that here too, or is the assertion that they don't need to back up the user key necessarily? Not necessarily; in the condition where a user is confident they are the only ones that can claim, they can place the notes in a safe the same way they might printed Bitcoin keys or Opendimes (I would recommend a fireproof safe).

throwaway92394 4y ago
> We will have a security overview doc up soon, we ran out of time to have it ready today. I mean this respectfully - why would you release a cryptographic method of transferring money - without going into detail of how it actually works? That's kinda the entire point of cryptocurrency, that we have a way to be mathematically confident the money is safe - but you didn't tell us the math. Especially on HN were a lot of the audience is technical enough to want to and be able to verify it to some degree. I see you have patent US10896412B2, which honestly I have to ask how this is any different from any other hardware wallet? > A physical cryptocurrency may comprise a physical medium and an attached processor. I read some of the details (admittedly not all) and I'm still unsure how this is different from any other hardware wallet. AFAIK this is just a hardware wallet that exposes it's public key, then exposes it's private key when you cut the wire? Then we still need your signature to transfer the crypto, which is so double spend is prevented? Also, if your servers go down or you're hacked or rm -rf dir/ * happens, will all the notes become unusable? Are we relying on you to maintain servers indefinitely?
- ccamrobertson 4y ago
  > I mean this respectfully - why would you release a cryptographic method of transferring money - without going into detail of how it actually works? That's kinda the entire point of cryptocurrency, that we have a way to be mathematically confident the money is safe - but you didn't tell us the math. Especially on HN were a lot of the audience is technical enough to want to and be able to verify it to some degree. As noted, the app will be open source as will the (brief) Bitcoin script for audit. For the sake of simplicity 2-of-2 multisig that downgrades to 1-of-2 multisig over time should capture the essence of how these notes work. > Also, if your servers go down or you're hacked or rm -rf dir/ * happens, will all the notes become unusable? Are we relying on you to maintain servers indefinitely? Nope. Users can always claim funds after the expiration date of January 3rd 2029 using the user key stored on the note.
  - throwaway92394 4y ago
    > For the sake of simplicity 2-of-2 multisig that downgrades to 1-of-2 multisig over time should capture the essence of how these notes work. > Users can always claim funds after the expiration date of January 3rd 2029 using the user key stored on the note. Interesting, thank you. That does seem more reasonable to me. Best of luck with your project.
  - braingenious 4y ago
    >Nope. Users can always claim funds after the expiration date of January 3rd 2029 using the user key stored on the note. Wait what? If your service gets hacked or goes away, the funds will be usable seven years from now? How is this statement different from “You’ll find out whether or tech stack works years from now “?
    - janandonly 4y ago
      This kind of "smart-contracts" can be made and tested today on the Bitcoin network. Instead of picking a block-height of 7-9 years in the future, you could pick one on the next 20 minutes.... The code (if not put in a Taproot transaction) is "naked" visible on the blockchain, so no "trust" is needed.
yupper32 4y ago
What do you mean you ran out of time? Was this a race?
- spicybright 4y ago
  The fact they couldn't wait a few days to make a post here makes me think "move fast break things" at best, and a flat out scam at worst. Would the security details have ever been worked on if people weren't commenting here? Are they going to take orders before putting it up? Are they aware of how prevalent crypto scams are and how vitally important it is to distance yourself if you want to be taken seriously? This kind of impulsivity is exactly what I don't want from people dealing with money.
  - tmp_anon_22 4y ago
    > This kind of impulsivity is exactly what I don't want from people dealing with money. You're going to be really disappointed to hear how most fintech startups, and non-startups, and non-fintech software companies, and non-startup companies, operate then. Yeah its bad, but lets not act like the bar was ever high to begin with.
    - spicybright 4y ago
      I'm not saying that's the bar across all companies, that's ridiculous. I'm saying my bar is someone has to prove they are competent for me to trust them with my money. And given how many crypto scams there have been, one's bar should be higher than your normal startup, unless you don't care about losing money put into it. It's the same way I don't let a friend borrow money if he's generally irresponsible or burned me in the past just because he guarantees he can double it by the end of the month. I don't know if you're implying this, but it seems like you think because every company has to start somewhere it means they inherently deserve trust and little criticism to help them along?
    - audleman 4y ago
      They are trying to build a physical/digital bearer instrument. Not a company, pure cash in your pocket. Of course the standards for security are higher.

throwaway92394 4y ago

> We will have a security overview doc up soon, we ran out of time to have it ready today. I mean this respectfully - why would you release a cryptographic method of transferring money - without going into detail of how it actually works? That's kinda the entire point of cryptocurrency, that we have a way to be mathematically confident the money is safe - but you didn't tell us the math. Especially on HN were a lot of the audience is technical enough to want to and be able to verify it to some degree. I see you have patent US10896412B2, which honestly I have to ask how this is any different from any other hardware wallet? > A physical cryptocurrency may comprise a physical medium and an attached processor. I read some of the details (admittedly not all) and I'm still unsure how this is different from any other hardware wallet. AFAIK this is just a hardware wallet that exposes it's public key, then exposes it's private key when you cut the wire? Then we still need your signature to transfer the crypto, which is so double spend is prevented? Also, if your servers go down or you're hacked or rm -rf dir/ * happens, will all the notes become unusable? Are we relying on you to maintain servers indefinitely?

ccamrobertson 4y ago
> I mean this respectfully - why would you release a cryptographic method of transferring money - without going into detail of how it actually works? That's kinda the entire point of cryptocurrency, that we have a way to be mathematically confident the money is safe - but you didn't tell us the math. Especially on HN were a lot of the audience is technical enough to want to and be able to verify it to some degree. As noted, the app will be open source as will the (brief) Bitcoin script for audit. For the sake of simplicity 2-of-2 multisig that downgrades to 1-of-2 multisig over time should capture the essence of how these notes work. > Also, if your servers go down or you're hacked or rm -rf dir/ * happens, will all the notes become unusable? Are we relying on you to maintain servers indefinitely? Nope. Users can always claim funds after the expiration date of January 3rd 2029 using the user key stored on the note.
- throwaway92394 4y ago
  > For the sake of simplicity 2-of-2 multisig that downgrades to 1-of-2 multisig over time should capture the essence of how these notes work. > Users can always claim funds after the expiration date of January 3rd 2029 using the user key stored on the note. Interesting, thank you. That does seem more reasonable to me. Best of luck with your project.
- braingenious 4y ago
  >Nope. Users can always claim funds after the expiration date of January 3rd 2029 using the user key stored on the note. Wait what? If your service gets hacked or goes away, the funds will be usable seven years from now? How is this statement different from “You’ll find out whether or tech stack works years from now “?
  - janandonly 4y ago
    This kind of "smart-contracts" can be made and tested today on the Bitcoin network. Instead of picking a block-height of 7-9 years in the future, you could pick one on the next 20 minutes.... The code (if not put in a Taproot transaction) is "naked" visible on the blockchain, so no "trust" is needed.

yupper32 4y ago

What do you mean you ran out of time? Was this a race?

spicybright 4y ago
The fact they couldn't wait a few days to make a post here makes me think "move fast break things" at best, and a flat out scam at worst. Would the security details have ever been worked on if people weren't commenting here? Are they going to take orders before putting it up? Are they aware of how prevalent crypto scams are and how vitally important it is to distance yourself if you want to be taken seriously? This kind of impulsivity is exactly what I don't want from people dealing with money.
- tmp_anon_22 4y ago
  > This kind of impulsivity is exactly what I don't want from people dealing with money. You're going to be really disappointed to hear how most fintech startups, and non-startups, and non-fintech software companies, and non-startup companies, operate then. Yeah its bad, but lets not act like the bar was ever high to begin with.
  - spicybright 4y ago
    I'm not saying that's the bar across all companies, that's ridiculous. I'm saying my bar is someone has to prove they are competent for me to trust them with my money. And given how many crypto scams there have been, one's bar should be higher than your normal startup, unless you don't care about losing money put into it. It's the same way I don't let a friend borrow money if he's generally irresponsible or burned me in the past just because he guarantees he can double it by the end of the month. I don't know if you're implying this, but it seems like you think because every company has to start somewhere it means they inherently deserve trust and little criticism to help them along?
  - audleman 4y ago
    They are trying to build a physical/digital bearer instrument. Not a company, pure cash in your pocket. Of course the standards for security are higher.