4 ms·

Personally, I sold some Bitcoins on TradeHill and was able to withdraw some cash using Dwolla, but then TradeHill complained about fraud on Dwolla, and removed

Personally, I sold some Bitcoins on TradeHill and was able to withdraw some cash using Dwolla, but then TradeHill complained about fraud on Dwolla, and removed that as a withdrawal option. The only way to get my cash out was to have them mail me a physical check. I put in the request about 6 months ago to have a physical check mailed to me, and it never arrived. Emails to their customer support assured me that they had mailed the check, but this is highly unlikely because I have a locked mailbox and have never had mail go missing before. They wanted to charge me a stop check fee and reissue a check. Personally, after that experience, I chose not to do business with TradeHill. They are not entirely honest with their customers, and I'm sure there is something going on behind the scenes related to fraud or perhaps the owners are skimming profits off the top. I do business only with MtGox now, who has proven to be a mostly trustworthy exchange, despite their past security flaws which allowed data loss.

SkyMarshal 15y ago
I wouldn't touch MtGox with a ten foot pole after their breach last year. I had created an account there but never funded it, and my account was one of the ones in the breach. I had stupidly used the same login info for my Twitter and FB accouts, and both were stolen and the password changed by the hackers (I assume they ran a script against the entire MtGox database). Fortunately they didn't bother to change the reset email address, so I got them back immediately with a password reset. Security flaws are like roaches - where there's one big fat obvious one (plaintext or weakly hashed pwd database in this case), there at least ten more behind the walls. MtGox is clearly being run by a bunch of amateurs when it comes to security.
- freshhawk 15y ago
  I was surprised there was no mention of this in the article. Have people forgotten about this already? I immediately wrote MtGox off forever in my mind after that fiasco.
- Jach 15y ago
  On the other hand, having a big security problem wakes everyone up to the fact that there's a problem. MtGox did hire security consultants; whether they hired good ones is another matter but it's not like they fixed the one issue and everything stayed the same. Do you touch any MS products? At least MtGox thus far hasn't allowed arbitrary code to run on your machine! MtGox is still the easiest way to deal with BTC <-> USD. I don't trust them enough that I have a lot of either currency in the account at one time but I didn't have a lot before the breach either.
  - SkyMarshal 15y ago
    >Do you touch any MS products? Heh, no actually. 100% non-Apple *nix. :) Actually if I were going to trade BTC, the only one I would probably consider right now would be Intersango.com: https://bitcointalk.org/index.php?topic=63877.0 https://bitcointalk.org/index.php?topic=63877.0
- illumin8 15y ago
  Right, the breach was terrible, but I like to think that the fast food restaurant that gave everyone food poisoning one week is probably the safest restaurant to eat at next week. I know it's not popular to do business with someone that leaked all of my account information, but Sony PSN leaked my account information and I'm still playing games on my PS3... so... Anyway, I use Lastpass now and have a randomized password for each site, so a compromise at MtGox couldn't do any real damage. I don't leave cash or BTC in there.
  - SkyMarshal 15y ago
    I switched to LastPass too after my debacle, but was never comfortable with storing all my passwords in a such potential vector. LastPass may as well just rename themselves, CmonHackMeIDoubleDogDareYa.com. Then I discovered KeePass2, and switched that. It also does generated passwords. It stores everything locally, but you can sync the datafile to a secure backup service like Tarsnap, SpiderOak, or Wuala (maybe, not 100% sure about Wuala).
drivebyacct2 15y ago
>who has proven to be a mostly trustworthy exchange, despite their past security flaws which allowed data loss. Nothing, and I mean nothing about how MTgox handled their problems should inspire confidence or lead you to conclude they are trustworthy. They were caught in lies and shoved their fingers in their ears to lost of typical and easy security suggestions and as far as I know, went forward with an inanely stupid hashing policy for "better" security than bcrypt.

SkyMarshal 15y ago

I wouldn't touch MtGox with a ten foot pole after their breach last year. I had created an account there but never funded it, and my account was one of the ones in the breach. I had stupidly used the same login info for my Twitter and FB accouts, and both were stolen and the password changed by the hackers (I assume they ran a script against the entire MtGox database). Fortunately they didn't bother to change the reset email address, so I got them back immediately with a password reset. Security flaws are like roaches - where there's one big fat obvious one (plaintext or weakly hashed pwd database in this case), there at least ten more behind the walls. MtGox is clearly being run by a bunch of amateurs when it comes to security.

freshhawk 15y ago
I was surprised there was no mention of this in the article. Have people forgotten about this already? I immediately wrote MtGox off forever in my mind after that fiasco.
Jach 15y ago
On the other hand, having a big security problem wakes everyone up to the fact that there's a problem. MtGox did hire security consultants; whether they hired good ones is another matter but it's not like they fixed the one issue and everything stayed the same. Do you touch any MS products? At least MtGox thus far hasn't allowed arbitrary code to run on your machine! MtGox is still the easiest way to deal with BTC <-> USD. I don't trust them enough that I have a lot of either currency in the account at one time but I didn't have a lot before the breach either.
- SkyMarshal 15y ago
  >Do you touch any MS products? Heh, no actually. 100% non-Apple *nix. :) Actually if I were going to trade BTC, the only one I would probably consider right now would be Intersango.com: https://bitcointalk.org/index.php?topic=63877.0 https://bitcointalk.org/index.php?topic=63877.0
illumin8 15y ago
Right, the breach was terrible, but I like to think that the fast food restaurant that gave everyone food poisoning one week is probably the safest restaurant to eat at next week. I know it's not popular to do business with someone that leaked all of my account information, but Sony PSN leaked my account information and I'm still playing games on my PS3... so... Anyway, I use Lastpass now and have a randomized password for each site, so a compromise at MtGox couldn't do any real damage. I don't leave cash or BTC in there.
- SkyMarshal 15y ago
  I switched to LastPass too after my debacle, but was never comfortable with storing all my passwords in a such potential vector. LastPass may as well just rename themselves, CmonHackMeIDoubleDogDareYa.com. Then I discovered KeePass2, and switched that. It also does generated passwords. It stores everything locally, but you can sync the datafile to a secure backup service like Tarsnap, SpiderOak, or Wuala (maybe, not 100% sure about Wuala).

drivebyacct2 15y ago

>who has proven to be a mostly trustworthy exchange, despite their past security flaws which allowed data loss. Nothing, and I mean nothing about how MTgox handled their problems should inspire confidence or lead you to conclude they are trustworthy. They were caught in lies and shoved their fingers in their ears to lost of typical and easy security suggestions and as far as I know, went forward with an inanely stupid hashing policy for "better" security than bcrypt.