5 ms·
How is this different than MtGox? I don't trust MtGox, but at least they've made mistakes and have spoken publicly about how they've fixed those mistakes. On t
by drivebyacct2 14y ago
How is this different than MtGox? I don't trust MtGox, but at least they've made mistakes and have spoken publicly about how they've fixed those mistakes.
On the other hand, are these guys storing my wallet safely? How about my balance (please god, don't store it as a float)? How about my password? If they're not launching with two-factor auth I won't even give it a chance (and likely ever, honestly).
I've gotten progressively more and more pessimistic about these sorts of sites even though I like the idea of BitCoin as a currency. If security isn't heavily discussed and visible (2FA, do it!) at the launch, it will be hard for me to take this seriously.
- politician 14y ago"Coinbase now offers Two-Factor Authentication" http://blog.coinbase.com/ http://blog.coinbase.com/
- mootothemax 14y agoAnd what happens if someone gains access to your server or social engineers their way in with your hosting company? As far as I can tell, this has been the biggest problem with such services so far.
- politician 14y agoI'm not affiliated with coinbase; sorry if that was unclear.
- drivebyacct2 14y agoFantastic fantastic! Maybe I'm a nerd, but I'd be repping that on the front page.
- magic_haze 14y agoHaven't signed up, but http://blog.coinbase.com/ http://blog.coinbase.com/ does mention 2FA is supported through SMS or an app called Authy. In case the founder sees this, was there any reason why Verisign's VIP app (which has native apps on more devices and seems to be the de-facto standard for banking sites) was not used?
- barmstrong 14y agoI hadn't seen it - thanks I'll check it out!
- icebraining 14y agoYou mean Symantec's VIP app. Personally, I have no idea why they didn't just use Google Authenticator and implemented OATH/TOTP on their own servers. Relying on a third-party for authentication seems a very bad idea, specially when there's an open algorithm that is essentially just feeding a secret and the current unix time to an HMAC-SHA1.
- esbwhat 14y agoWhat's wrong with storing it as a float? I'm not saying you're wrong, I just genuinely don't know. If you could explain/point me to relevant literature I'd be grateful.
- drivebyacct2 14y agoQuick Google, sorry it's easier than me offering an incomplete explanation: http://stackoverflow.com/questions/3730019/why-not-use-double-or-float-to-represent-currency http://stackoverflow.com/questions/3730019/why-not-use-doubl... And I really don't mean to pick on you, but that this isn't better known is why I worry when I see random sites popup offering financial services.
- esbwhat 14y agoThat's okay. I don't think I'm really representative anyway, as I'm not a professional/schooled programmer. Thanks for the link, I did try googling it myself but I didn't think to use the word "currency" so I just got a bunch of irrelevant results.
- wmf 14y agohttp://stackoverflow.com/questions/3730019/why-not-use-double-or-float-to-represent-currency http://stackoverflow.com/questions/3730019/why-not-use-doubl... Also, all Bitcoin calculations are supposed to be done in integer Satoshis.
- pygy_ 14y agoSome numbers with a finite representation in base 10, 0.2, for example, don't have a finite representation in base 2. They are rounded, and doing arithmetic on such numbers leads to compounded rounding errors that you don't want to see when dealing with money. Another problem is that the mantissa of floating point numbers is limited (52 bits for doubles), which can lead to truncated numbers, another big no no.
- dsterry 14y agoStoring BTC balances as floats is something a few services have done in the past so it makes sense to ask/bring up. Since BTC have 8 decimal precision, rounding can become noticeable very quickly even in addition and subtraction even though in real, today's value, it's not such a big deal.