12 ms·

Flexcoin is shutting down

131 points by lelf 13y ago

nbody 13y ago
It's getting ridiculous... Startups should value security way more, especially financial ones.
- davidw 13y ago
  In economics, this is an information asymmetry problem if I'm not mistaken: http://en.wikipedia.org/wiki/Information_asymmetry http://en.wikipedia.org/wiki/Information_asymmetry In other words, the people selling the bitcoin services know more about their own security than users do.
  - stanleydrew 13y ago
    Yes, but it is a little different than the traditional used car "lemon" information asymmetry problem, since there is an ongoing relationship and the reputation effects are much stronger.
- pjc50 13y ago
  As I keep posting, bitcoin has far stricter requirements than conventional banking for software security. One bug - including operating system zero-days - and your bitcoin can be irreversibly transferred to another address which is hard to trace to a human and even harder to recover. It's in the same category as rocketry, nuclear reactors or medical software, not "move fast and break things" startups. There is no room for error. Entertainingly, they've left the FAQ up: Q: Are there advantages to bitcoins? A: Of course! It is secure, anonymous and it removes the middle man resulting in very little transaction fees.
- SilkRoadie 13y ago
  I think the issue is down more to a lack of awareness than a lack of care. A while ago a site was hacked because they didn't upgrade rails which put out an urgent security update a few day's previously. This is sloppy. There is no excuse. In many other cases the problem is that people running and building the website are not security experts. They know the fundamentals and learn new things from exploits used elsewhere. However, this knowledge falls short of attackers who relentlessly look for and try to create exploits every day. I think this is the main issue. Too many hackers, not enough security experts, not enough funds to continuality audit the application and servers running the website.
- InclinedPlane 13y ago
  The idea that cryptocurrency "startups" are "financial institutions" is more than a little tenuous. Currently dogecoin is more or less equally legitimate as any other cryptocurrency, that should tell you something about the state of the "industry".
- hackerboos 13y ago
  This is what happens when the barrier to entry is downloading a Bitcoin client.
pelario 13y ago
This starts to feel like the banks in the Wild West. I'm really curious about how it will evolve.
- chii 13y ago
  The gov't start issuing notes based on how many coins you can present, and then those notes gets traded instead actual bitcoins?
blueskin_ 13y ago
Yet again, why coins are only secure in your own wallet. Giving them to a third party is throwing them away.
- tomeric 13y ago
  How can Bitcoin ever go mainstream if you need regular people to secure their computers, remember their passwords and backup everything so wallets aren't lost?
  - panacea 13y ago
    Answer: It won't ever go mainstream.
izolate 13y ago
Not a single "sorry" uttered. Shameful.
- simias 13y ago
  Well, it sticks to the facts. Given the recent Mtgox debacle at least it explains what happened and what they're going to do. Obviously if you had money there you'll be pissed but at least you know where you stand and what you lost. IMO it's a pretty good way for them to deal with the situation.
- arethuza 13y ago
  Their lawyers probably told them that saying "Sorry" is an admission of corporate and/or personal liability.
locksley 13y ago
Any word on how they were Hacked? I know that Bitcoinica, Gavin Andresen's faucet and TradeHill all got hacked through Linode's support system a while back, in which the attacker managed to reset all their passwords.
- xeroxmalf 13y ago
  FYI, they got into TradeHill but couldn't compromise[0] any of the user accounts because of the architecture of the site. [0] https://bitcointalk.org/index.php?PHPSESSID=r2dliaaebhrctppcub4bbsqg21&topic=67022.msg779310#msg779310 https://bitcointalk.org/index.php?PHPSESSID=r2dliaaebhrctppc...
vishnupr 13y ago
Please guys, please please use your own BTC wallets. It's not that hard, really. Only put up your coins online in exchanges(Like BitStamp) for a few hours to trade then immediately transfer them back to your OWN 100% trustable wallet. So many hacks and people are just not getting it. Trust no one, stay safe. My Mac wallet of choice: https://electrum.org https://electrum.org
- pja 13y ago
  By doing this, you've turned your local hard drive and the backups you made from it into an extraordinarily valuable object, thus massively increasing the incentive to steal it. "But wait!" you say, "I shall use modern cryptography to protect my wealth from prying eyes!" Yes, and the thief in the night will use rubber hose cryptography on you. There is a reason why the vast majority of people entrust their wealth to banks & not a safe buried under the floor of their house. I'm sure the BitCoin community will learn this truth about monetary systems at roughly the same rate as they've learnt all the others & probably the hard way given recent evidence.
  - jnbiche 13y ago
    Out of all of the many security incidents we've experienced in Bitcoin's short but eventful lifespan, not a single one has involved anything like rubber hose cryptoanalysis. This in spite of the fact that numerous public Bitcoin figures are known to be millionaires many time over. Why is this? Well, if you choose to "use rubber hose cryptography" on someone to steal their Bitcoins, you've graduated from a faceless, online, white collar crime that many police departments won't even take a report for ("they've stolen your Bitwhats? Yeah, we'll get back to you.") to an extremely serious crime that will get you locked up in violent prisons for a very long amount of time in every country of the world. So it's not surprising that the scenario you describe has not happened. It may happen yet, but it will be a rarity and not a statistically-meaningful threat.
    - rayiner 13y ago
      I don't think physical bitcoin muggings should be crimes for police to handle. Let's see how deep the anarchist rabbit hole goes. Not much of a "trust less" system if its all backed up with guys with guns anyway.
andyhmltn 13y ago
No apology and a short little post. Disgraceful. Is that all it takes to run off with $630,000+ of customers money?
- chii 13y ago
  caveat emptor is the only recourse until enough people deal with bitcoin to make laws about it.
- mikkom 13y ago
  That's why there are bank laws. Maybe the people supporting "freedom" of bitcoins slowly begin to understand the downside of no regulation and laws.
  - mike_hearn 13y ago
    The whole point of Bitcoin is that you don't need to trust third parties with your money. Pointing out that people who choose to give their coins to a third party might lose them seems trivial - yes, financial institutions collapse (if you can call something like flexcoin an institution), and yes, regulation and deposit insurance can help address that. Who was arguing otherwise? The arguments for Bitcoin are that you don't / shouldn't need anything like Flexcoin in the first place. Apparently though, some people end up buying Bitcoins and then not storing them in their own wallets, ensuring they get the worst of all worlds - no low-trust technology and no government bailouts.
ad93611 13y ago
Due to the permanent nature of bitcoin transactions, I wonder if all bitcoins stored in banks must enable multi-signature transactions. That way the money can leave the bank only if there are 2 thefts. 2 thefts are exponentially harder to pull off because second signature can be stored in different places by different people.
redthemad 13y ago
Flexcoin via Twitter: "While the MtGox closure is unfortunate, we at Flexcoin have not lost anything." "Flexcoin will be shutting its doors."
primitivesuave 13y ago
When things like this happen, I try to explain to the skeptics why I will always have faith in Bitcoin. Suppose you make a Bitcoin service where they print your keys onto pieces of paper and store them in a big vault. When people want to withdraw coins, they must visit the vault location and take money out, where the transaction is verified by a physically present person. The owner of the vault could also release an API to allow trusted third parties to conduct transactions on behalf of the people who deposited Bitcoins in the vault. We wouldn't need to worry about hackers, and if the vault is strong enough we wouldn't need to worry about thieves. But we would have to worry about the banker. The owner of the vault can devise ways to increase the apparent value of his vault, through financial mechanisms like derivatives and credit default swaps. To prevent this from happening, we could get a big organization with lots of guns and power to regulate the actions of the banker. But then again, the banker controls all your Bitcoins, so he can just use your money to pay off the people with all the guns and power. Nowadays, everything is for sale, everything can be stolen, and nothing is what it seems. That's why I have a lot of faith in Bitcoin. Even though we haven't figured out how to make a good vault, there's no real place for crooked bankers and powerful organizations.
- tbb 13y ago
  We already do have such vaults. At least most traditional banks in Europe have storage vaults for their clients. e.g. you can lend 1 usually quite cheaply, e.g. 60eur / year. A bank teller is always present while you're making a withdrawal, and you need 2 keys to open your vault. 1 key from the teller, and 1 key from you. The chances of this kind of vault getting robbed is very, very slim. If you're worried about that, you can BIP38 encrypt your paper wallet's private keys, so its impossible to use them even if paper itself is stolen. There is also some chance that the vault will be struck by a flood, earthquake etc. For that, I recommend using a USB as a back-up, where the keys are encrpyted using truecrpyt etc, and the physical drive itself being kept in a very secret location, ideally located in a different city than the bank vault itself, so that the chances of being affected by the same disaster as your vault is minimized. This is almost a failproof setup in my opinion (you can worry about loosing your Bip38 or truecrypt encryption keys, or what happens if you die etc -- there are good ideas about how to deal with these kind of circumstances as well, e.g. write a hint for BIP38 key which only you or your family may understand on the paper wallet). So best place to store your wallet might very well be your good old bank, ironic enough.
maaaats 13y ago
I'm not very into BitCoin, so I have a question: To me, it seemed like everyone were saying that one should use an online bank a year ago. Why? What do you gain by having them in a bank?
- nkuttler 13y ago
  Nothing really. People who use online wallets are either uneducated or think they can generate money by trading, flexcoin wasn't really a trading platform though. This highlights that bitcoin (not CamelCased) simply isn't a consumer reality yet. Having a wallet on your computer means you have to secure it. Offline wallets aren't very practical and not trivial to generate. Easy to use hardware devices have been promised but not delivered yet.
- deleted 13y ago
  [deleted]
- Cthulhu_ 13y ago
  Were those everyones by chance people who owned or had an interest in a bitcoin bank?
- jnbiche 13y ago
  Can you please point me to someone who was saying you should use an online wallet (i.e., "bank") a year ago? Among every Bitcoiner I've ever known, we'll all stressed the importance of not using any type of online wallet, unless it's a special one like blockchain.info that lets you maintain control over your coins. You do gain some convenience by storing your Bitcoins in an online wallet, since you can use them then from any device. But you make a very tempting target for unethical people. Plus, you get all the convenience of an online wallet with blockchain.info, and yet you still maintain control over your money. That said, even a system like blockchain.info is not appropriate for storage of large amounts of Bitcoins, like your savings. For that, only a system like paper wallets or Electrum or Armory deterministic wallets -- created on a secure, offline computer -- are appropriate.
duiker101 13y ago
Every time a new bitcoin exchange opens, on the homepage one of the first things you see is that they claim that is "secure". And than things like this always happen.
- danielweber 13y ago
  I bet they forgot the padlock icon.
ck2 13y ago
I am not trusting any crypto-currency site anymore unless they have an active pen-test team employed. We know good security is difficult but this is getting ridiculous - it has to be a priority.
- arethuza 13y ago
  And how do you trust the penetration test team? Honestly, I'm not a security expert and I've seen a few penetration/security audit reports that seemed pretty worthless to me.
- jnbiche 13y ago
  No, don't worry about pen tests. Just don't store your Bitcoins in someone else's control, like an online wallet. This really isn't that hard. The only time you should be exposed to any sort of counterparty risk in Bitcoin is when you buy or sell them. And if you use a reputable service like Coinbase or Bitstamp, and only keep your Bitcoins on that site for the few minutes it takes to buy, sell, and transfer them, your risk should be miniscule.
  - TeMPOraL 13y ago
    > Just don't store your Bitcoins in someone else's control, like an online wallet. This AND hire your own pentest team to make sure you keep your bitcoins safe. There's a reason people use banks for "normal" money.
  - thenmar 13y ago
    Do you keep your real money stashed under your mattress? What if your house burns down?
dabeeeenster 13y ago
1. Open bitcoin bank 2. Receive deposits 3. Claim you have been hacked 4. Run off with everyone's money
- Cthulhu_ 13y ago
  5. ????? 6. PROFIT
  - swombat 13y ago
    7. Criminal investigation 8. JAIL!
    - arethuza 13y ago
      It'll be interesting to see how much resources the relevant law enforcement agency assigns to this case and how succesful they are at apprehending the culprits. NB I think I'll re-read Halting State: http://en.wikipedia.org/wiki/Halting_State http://en.wikipedia.org/wiki/Halting_State
      - silvertonia 13y ago
        It's an interesting question of how much resources law enforcement should assign to a case like this. Many fierce proponents of Bitcoins are the anarchy-leaning libertarians. Its appeal is that government agencies can't track and tax it (or have a tougher time with it) While I do think a crime has occurred, it feels a bit like collecting a benefit you refused to pay into.
    - smoyer 13y ago
      Maybe ... but the governments are terribly keen on Bitcoin and it would be easy for them to say "we don't believe a crime has been committed". I think it's far safer for the Bitcoin community as a whole to police themselves, but determining how to add "self-regulation" in a decentralized way may take some time.
      - 13y ago
mattlutze 13y ago
If only there was a system, by which many of these institutions that hold other people's bitcoin, could protect the currency against individual institutions losing their clients' deposits. I wonder what something like that might look like... Maybe: http://www.fdic.gov/ http://www.fdic.gov/
- deskamess 13y ago
  Or cold wallets done properly. For larger amounts cold wallets are better. No US$ 100,000 FDIC cap.
  - mattlutze 13y ago
    OP's link was about clients' bitcoin in hot wallets hosted by the bank/exchange. That seems to be a huge risk. Recent events provide strong support for exchanges and banks to work with insurance houses and develop insurance products. Flexcoin shouldn't be shutting down and telling its customers "oh well" over their hot wallet theft; they should have an insurance policy paying out value to their customers.
bobjordan 13y ago
Problem with bitcoin security right now is the truly secure self storage tools are immature. For example, I've been trying to get this armory program (https://bitcoinarmory.com/ https://bitcoinarmory.com/) to complete building database for more than 1 week. It just doesn't want to work on my Mac. My dad is not going to endure this to secure his bitcoins.
- jnbiche 13y ago
  Armory is notoriously bad on Mac. Why are you using Armory? Use Electrum, back up your passphrase in a secure location, and be done with it. Unless you're storing your inheritance, that should be fine. There have been no security flaws in any of the SPV clients on desktop, including Electrum. If you're storing a huge sum, you should be using Linux.
kalleboo 13y ago
This easily is my biggest reservation about Bitcoin. There are huge huge security requirements on the storage and use of Bitcoin. And frankly (I'm sure tptacek or someone will come in here to tear me a new one for saying this) but the state the art of computer security is a complete joke. These systems we have are just too complex, and it's a statistical impossibility to close all the security holes in the operating system and all the software on top. You can never predict when and where the next Goto Fail or Debian Random Number Generator flaw will show up. And that's for gigantic corporations and governments. And people are telling end users to keep Bitcoin safe on their home computer instead? Home computers will NEVER be safe.
- M4v3R 13y ago
  It's just that people have to understand that current Bitcoin service implementations are wrong. If you have Bitcoin private keys laying somewhere on your server, you are doing it wrong. If you're covering that by the fact that you have "cold storage", you are doing it wrong. The only proper way to proceed is to use multisignature wallets. If you want to know why that's better, visit our explanation site: https://www.bitalo.com/why_bitalo https://www.bitalo.com/why_bitalo Fortnunately Bitalo is not the only service that provides this. More and more services were created lately, most notably: https://api.trustedcoin.com/wallet/ https://api.trustedcoin.com/wallet/ http://www.bitgo.com http://www.bitgo.com http://greenaddress.it http://greenaddress.it Vote with your money, don't support "Bitcoin banks" that can run with your money any time they want.
  - jzwinck 13y ago
    With all due respect, I do not think multi-signature solves the real problem. The real problem is that Bitcoin transactions are irreversible, so even if we realize within hours that a hack has occurred, we can do nothing about it. Banks as we knew them did not work this way. Yes, having to wait three days for settlement is absurd, but folks are working to speed that up (to just one day, haha). Yes, the fees add up. But the systems have been developed over a really long time, and they have multiple levels of protection against you losing all your money. In the US that's the FDIC and SIPC, for regular-sized accounts. There will never been a direct equivalent for BTC, precisely because no one's national security is tied to BTC. And most people won't buy deposit insurance at any price higher than the "free" one they get from their government. Early adopters of Bitcoin spoke fondly of the fact that there are no chargebacks. That's a great way to reduce transaction costs. It's also a great way to make sure that when you get hacked (and you will) you cannot recover. Compare this to the situation with ACH transfers (the US-only, low-cost "wire transfer" system). Anyone who knows anything about computers would be aghast at the technology comprising that system. The security appears to be pretty lame. Yet people do not lose their savings via ACH. Why? It isn't because ACH transfers are so secure--it's because the banks can undo them, which in turn lowers the incentive for thieves. This is a virtuous cycle, by contrast to Bitcoin's vicious one, and the way it works has nothing to do with technology.
Udo 13y ago
What I don't understand is why are Bitcoin sites keeping such amounts in their hot wallets in the first place? Bank robberies happen, that's why traditional banks don't keep a huge amount of cash in the teller's office. Why not just transfer almost everything into cold wallets immediately? This way, the worst that could happen is every once in a while a human needs to bring a cold wallet online for a big withdrawal - with the added benefit that, you know, an actual human would check if the transaction is actually valid. It seems to me the solution to this problem (which will keep on happening apparently) is not primarily to make a site that is absolutely penetration proof, but to devise a system where the scope of a breach is guaranteed to be very limited.
servowire 13y ago
Use your own wallet. If you do not own the Private Key - you do not own the Bitcoin! Sad this has to happen again and again.
twobeard 13y ago
What Bitcoin does better than anything else is to highlight the current state of computer security, which is plain terrible. For that alone Bitcoin deserves to exist.
igl 13y ago
if bitcoint was made for the people, it would be forbidden already. wake up.
jjindev 13y ago
1. We have a currency without government! 2. We were robbed, and will now contact the government.
zacinbusiness 13y ago
Ok. So where can I find an accurate exchange rate for Bitcoin vs. U.S. dollars? I'm just curious to see what the rate is these days, given that people keep getting "hacked." And as a so-far-not-adopter, I wonder if now may be the time to "invest" a little into the Bitcoin thing.
- bendoernberg 13y ago
  If you're going to buy in the US I'd recommend using Coinbase. Their price will be within $10-$15 of the prices you'll get at the largest BTC exchanges.
  - zacinbusiness 13y ago
    Is Coinbase considerably more secure than MtGox? As I've said elsewhere, I do believe that Bitcoin is a resilient and useful currency. But I'd hate to get Goxed (I'm coining this term here).
zacinbusiness 13y ago
"His soul swooned slowly as he heard the snow falling faintly through the universe and faintly falling, like the descent of their last end, upon all the living and the dead." (there are some people having a dick fight about their majors in college...well I was an English major.)
notastartup 13y ago
We've been hacked = All your coin are belong to us

131 points by lelf 13y ago

nbody 13y ago

It's getting ridiculous... Startups should value security way more, especially financial ones.

davidw 13y ago
In economics, this is an information asymmetry problem if I'm not mistaken: http://en.wikipedia.org/wiki/Information_asymmetry http://en.wikipedia.org/wiki/Information_asymmetry In other words, the people selling the bitcoin services know more about their own security than users do.
- stanleydrew 13y ago
  Yes, but it is a little different than the traditional used car "lemon" information asymmetry problem, since there is an ongoing relationship and the reputation effects are much stronger.
pjc50 13y ago
As I keep posting, bitcoin has far stricter requirements than conventional banking for software security. One bug - including operating system zero-days - and your bitcoin can be irreversibly transferred to another address which is hard to trace to a human and even harder to recover. It's in the same category as rocketry, nuclear reactors or medical software, not "move fast and break things" startups. There is no room for error. Entertainingly, they've left the FAQ up: Q: Are there advantages to bitcoins? A: Of course! It is secure, anonymous and it removes the middle man resulting in very little transaction fees.
SilkRoadie 13y ago
I think the issue is down more to a lack of awareness than a lack of care. A while ago a site was hacked because they didn't upgrade rails which put out an urgent security update a few day's previously. This is sloppy. There is no excuse. In many other cases the problem is that people running and building the website are not security experts. They know the fundamentals and learn new things from exploits used elsewhere. However, this knowledge falls short of attackers who relentlessly look for and try to create exploits every day. I think this is the main issue. Too many hackers, not enough security experts, not enough funds to continuality audit the application and servers running the website.
InclinedPlane 13y ago
The idea that cryptocurrency "startups" are "financial institutions" is more than a little tenuous. Currently dogecoin is more or less equally legitimate as any other cryptocurrency, that should tell you something about the state of the "industry".
hackerboos 13y ago
This is what happens when the barrier to entry is downloading a Bitcoin client.

pelario 13y ago

This starts to feel like the banks in the Wild West. I'm really curious about how it will evolve.

chii 13y ago
The gov't start issuing notes based on how many coins you can present, and then those notes gets traded instead actual bitcoins?

blueskin_ 13y ago

Yet again, why coins are only secure in your own wallet. Giving them to a third party is throwing them away.

tomeric 13y ago
How can Bitcoin ever go mainstream if you need regular people to secure their computers, remember their passwords and backup everything so wallets aren't lost?
- panacea 13y ago
  Answer: It won't ever go mainstream.

izolate 13y ago

Not a single "sorry" uttered. Shameful.

simias 13y ago
Well, it sticks to the facts. Given the recent Mtgox debacle at least it explains what happened and what they're going to do. Obviously if you had money there you'll be pissed but at least you know where you stand and what you lost. IMO it's a pretty good way for them to deal with the situation.
arethuza 13y ago
Their lawyers probably told them that saying "Sorry" is an admission of corporate and/or personal liability.

locksley 13y ago

Any word on how they were Hacked? I know that Bitcoinica, Gavin Andresen's faucet and TradeHill all got hacked through Linode's support system a while back, in which the attacker managed to reset all their passwords.

xeroxmalf 13y ago
FYI, they got into TradeHill but couldn't compromise[0] any of the user accounts because of the architecture of the site. [0] https://bitcointalk.org/index.php?PHPSESSID=r2dliaaebhrctppcub4bbsqg21&topic=67022.msg779310#msg779310 https://bitcointalk.org/index.php?PHPSESSID=r2dliaaebhrctppc...

vishnupr 13y ago

Please guys, please please use your own BTC wallets. It's not that hard, really. Only put up your coins online in exchanges(Like BitStamp) for a few hours to trade then immediately transfer them back to your OWN 100% trustable wallet. So many hacks and people are just not getting it. Trust no one, stay safe. My Mac wallet of choice: https://electrum.org https://electrum.org

pja 13y ago
By doing this, you've turned your local hard drive and the backups you made from it into an extraordinarily valuable object, thus massively increasing the incentive to steal it. "But wait!" you say, "I shall use modern cryptography to protect my wealth from prying eyes!" Yes, and the thief in the night will use rubber hose cryptography on you. There is a reason why the vast majority of people entrust their wealth to banks & not a safe buried under the floor of their house. I'm sure the BitCoin community will learn this truth about monetary systems at roughly the same rate as they've learnt all the others & probably the hard way given recent evidence.
- jnbiche 13y ago
  Out of all of the many security incidents we've experienced in Bitcoin's short but eventful lifespan, not a single one has involved anything like rubber hose cryptoanalysis. This in spite of the fact that numerous public Bitcoin figures are known to be millionaires many time over. Why is this? Well, if you choose to "use rubber hose cryptography" on someone to steal their Bitcoins, you've graduated from a faceless, online, white collar crime that many police departments won't even take a report for ("they've stolen your Bitwhats? Yeah, we'll get back to you.") to an extremely serious crime that will get you locked up in violent prisons for a very long amount of time in every country of the world. So it's not surprising that the scenario you describe has not happened. It may happen yet, but it will be a rarity and not a statistically-meaningful threat.
  - rayiner 13y ago
    I don't think physical bitcoin muggings should be crimes for police to handle. Let's see how deep the anarchist rabbit hole goes. Not much of a "trust less" system if its all backed up with guys with guns anyway.

andyhmltn 13y ago

No apology and a short little post. Disgraceful. Is that all it takes to run off with $630,000+ of customers money?

chii 13y ago
caveat emptor is the only recourse until enough people deal with bitcoin to make laws about it.
mikkom 13y ago
That's why there are bank laws. Maybe the people supporting "freedom" of bitcoins slowly begin to understand the downside of no regulation and laws.
- mike_hearn 13y ago
  The whole point of Bitcoin is that you don't need to trust third parties with your money. Pointing out that people who choose to give their coins to a third party might lose them seems trivial - yes, financial institutions collapse (if you can call something like flexcoin an institution), and yes, regulation and deposit insurance can help address that. Who was arguing otherwise? The arguments for Bitcoin are that you don't / shouldn't need anything like Flexcoin in the first place. Apparently though, some people end up buying Bitcoins and then not storing them in their own wallets, ensuring they get the worst of all worlds - no low-trust technology and no government bailouts.

ad93611 13y ago

Due to the permanent nature of bitcoin transactions, I wonder if all bitcoins stored in banks must enable multi-signature transactions. That way the money can leave the bank only if there are 2 thefts. 2 thefts are exponentially harder to pull off because second signature can be stored in different places by different people.

redthemad 13y ago

Flexcoin via Twitter: "While the MtGox closure is unfortunate, we at Flexcoin have not lost anything." "Flexcoin will be shutting its doors."

primitivesuave 13y ago

When things like this happen, I try to explain to the skeptics why I will always have faith in Bitcoin. Suppose you make a Bitcoin service where they print your keys onto pieces of paper and store them in a big vault. When people want to withdraw coins, they must visit the vault location and take money out, where the transaction is verified by a physically present person. The owner of the vault could also release an API to allow trusted third parties to conduct transactions on behalf of the people who deposited Bitcoins in the vault. We wouldn't need to worry about hackers, and if the vault is strong enough we wouldn't need to worry about thieves. But we would have to worry about the banker. The owner of the vault can devise ways to increase the apparent value of his vault, through financial mechanisms like derivatives and credit default swaps. To prevent this from happening, we could get a big organization with lots of guns and power to regulate the actions of the banker. But then again, the banker controls all your Bitcoins, so he can just use your money to pay off the people with all the guns and power. Nowadays, everything is for sale, everything can be stolen, and nothing is what it seems. That's why I have a lot of faith in Bitcoin. Even though we haven't figured out how to make a good vault, there's no real place for crooked bankers and powerful organizations.

tbb 13y ago
We already do have such vaults. At least most traditional banks in Europe have storage vaults for their clients. e.g. you can lend 1 usually quite cheaply, e.g. 60eur / year. A bank teller is always present while you're making a withdrawal, and you need 2 keys to open your vault. 1 key from the teller, and 1 key from you. The chances of this kind of vault getting robbed is very, very slim. If you're worried about that, you can BIP38 encrypt your paper wallet's private keys, so its impossible to use them even if paper itself is stolen. There is also some chance that the vault will be struck by a flood, earthquake etc. For that, I recommend using a USB as a back-up, where the keys are encrpyted using truecrpyt etc, and the physical drive itself being kept in a very secret location, ideally located in a different city than the bank vault itself, so that the chances of being affected by the same disaster as your vault is minimized. This is almost a failproof setup in my opinion (you can worry about loosing your Bip38 or truecrypt encryption keys, or what happens if you die etc -- there are good ideas about how to deal with these kind of circumstances as well, e.g. write a hint for BIP38 key which only you or your family may understand on the paper wallet). So best place to store your wallet might very well be your good old bank, ironic enough.

maaaats 13y ago

I'm not very into BitCoin, so I have a question: To me, it seemed like everyone were saying that one should use an online bank a year ago. Why? What do you gain by having them in a bank?

nkuttler 13y ago
Nothing really. People who use online wallets are either uneducated or think they can generate money by trading, flexcoin wasn't really a trading platform though. This highlights that bitcoin (not CamelCased) simply isn't a consumer reality yet. Having a wallet on your computer means you have to secure it. Offline wallets aren't very practical and not trivial to generate. Easy to use hardware devices have been promised but not delivered yet.
deleted 13y ago
[deleted]
Cthulhu_ 13y ago
Were those everyones by chance people who owned or had an interest in a bitcoin bank?
jnbiche 13y ago
Can you please point me to someone who was saying you should use an online wallet (i.e., "bank") a year ago? Among every Bitcoiner I've ever known, we'll all stressed the importance of not using any type of online wallet, unless it's a special one like blockchain.info that lets you maintain control over your coins. You do gain some convenience by storing your Bitcoins in an online wallet, since you can use them then from any device. But you make a very tempting target for unethical people. Plus, you get all the convenience of an online wallet with blockchain.info, and yet you still maintain control over your money. That said, even a system like blockchain.info is not appropriate for storage of large amounts of Bitcoins, like your savings. For that, only a system like paper wallets or Electrum or Armory deterministic wallets -- created on a secure, offline computer -- are appropriate.

duiker101 13y ago

Every time a new bitcoin exchange opens, on the homepage one of the first things you see is that they claim that is "secure". And than things like this always happen.

danielweber 13y ago
I bet they forgot the padlock icon.

ck2 13y ago

I am not trusting any crypto-currency site anymore unless they have an active pen-test team employed. We know good security is difficult but this is getting ridiculous - it has to be a priority.

arethuza 13y ago
And how do you trust the penetration test team? Honestly, I'm not a security expert and I've seen a few penetration/security audit reports that seemed pretty worthless to me.
jnbiche 13y ago
No, don't worry about pen tests. Just don't store your Bitcoins in someone else's control, like an online wallet. This really isn't that hard. The only time you should be exposed to any sort of counterparty risk in Bitcoin is when you buy or sell them. And if you use a reputable service like Coinbase or Bitstamp, and only keep your Bitcoins on that site for the few minutes it takes to buy, sell, and transfer them, your risk should be miniscule.
- TeMPOraL 13y ago
  > Just don't store your Bitcoins in someone else's control, like an online wallet. This AND hire your own pentest team to make sure you keep your bitcoins safe. There's a reason people use banks for "normal" money.
- thenmar 13y ago
  Do you keep your real money stashed under your mattress? What if your house burns down?

dabeeeenster 13y ago

1. Open bitcoin bank 2. Receive deposits 3. Claim you have been hacked 4. Run off with everyone's money

Cthulhu_ 13y ago
5. ????? 6. PROFIT
- swombat 13y ago
  7. Criminal investigation 8. JAIL!
  - arethuza 13y ago
    It'll be interesting to see how much resources the relevant law enforcement agency assigns to this case and how succesful they are at apprehending the culprits. NB I think I'll re-read Halting State: http://en.wikipedia.org/wiki/Halting_State http://en.wikipedia.org/wiki/Halting_State
    - silvertonia 13y ago
      It's an interesting question of how much resources law enforcement should assign to a case like this. Many fierce proponents of Bitcoins are the anarchy-leaning libertarians. Its appeal is that government agencies can't track and tax it (or have a tougher time with it) While I do think a crime has occurred, it feels a bit like collecting a benefit you refused to pay into.
  - smoyer 13y ago
    Maybe ... but the governments are terribly keen on Bitcoin and it would be easy for them to say "we don't believe a crime has been committed". I think it's far safer for the Bitcoin community as a whole to police themselves, but determining how to add "self-regulation" in a decentralized way may take some time.
    - 13y ago

mattlutze 13y ago

If only there was a system, by which many of these institutions that hold other people's bitcoin, could protect the currency against individual institutions losing their clients' deposits. I wonder what something like that might look like... Maybe: http://www.fdic.gov/ http://www.fdic.gov/

deskamess 13y ago
Or cold wallets done properly. For larger amounts cold wallets are better. No US$ 100,000 FDIC cap.
- mattlutze 13y ago
  OP's link was about clients' bitcoin in hot wallets hosted by the bank/exchange. That seems to be a huge risk. Recent events provide strong support for exchanges and banks to work with insurance houses and develop insurance products. Flexcoin shouldn't be shutting down and telling its customers "oh well" over their hot wallet theft; they should have an insurance policy paying out value to their customers.

bobjordan 13y ago

Problem with bitcoin security right now is the truly secure self storage tools are immature. For example, I've been trying to get this armory program (https://bitcoinarmory.com/ https://bitcoinarmory.com/) to complete building database for more than 1 week. It just doesn't want to work on my Mac. My dad is not going to endure this to secure his bitcoins.

jnbiche 13y ago
Armory is notoriously bad on Mac. Why are you using Armory? Use Electrum, back up your passphrase in a secure location, and be done with it. Unless you're storing your inheritance, that should be fine. There have been no security flaws in any of the SPV clients on desktop, including Electrum. If you're storing a huge sum, you should be using Linux.

kalleboo 13y ago

This easily is my biggest reservation about Bitcoin. There are huge huge security requirements on the storage and use of Bitcoin. And frankly (I'm sure tptacek or someone will come in here to tear me a new one for saying this) but the state the art of computer security is a complete joke. These systems we have are just too complex, and it's a statistical impossibility to close all the security holes in the operating system and all the software on top. You can never predict when and where the next Goto Fail or Debian Random Number Generator flaw will show up. And that's for gigantic corporations and governments. And people are telling end users to keep Bitcoin safe on their home computer instead? Home computers will NEVER be safe.

M4v3R 13y ago
It's just that people have to understand that current Bitcoin service implementations are wrong. If you have Bitcoin private keys laying somewhere on your server, you are doing it wrong. If you're covering that by the fact that you have "cold storage", you are doing it wrong. The only proper way to proceed is to use multisignature wallets. If you want to know why that's better, visit our explanation site: https://www.bitalo.com/why_bitalo https://www.bitalo.com/why_bitalo Fortnunately Bitalo is not the only service that provides this. More and more services were created lately, most notably: https://api.trustedcoin.com/wallet/ https://api.trustedcoin.com/wallet/ http://www.bitgo.com http://www.bitgo.com http://greenaddress.it http://greenaddress.it Vote with your money, don't support "Bitcoin banks" that can run with your money any time they want.
- jzwinck 13y ago
  With all due respect, I do not think multi-signature solves the real problem. The real problem is that Bitcoin transactions are irreversible, so even if we realize within hours that a hack has occurred, we can do nothing about it. Banks as we knew them did not work this way. Yes, having to wait three days for settlement is absurd, but folks are working to speed that up (to just one day, haha). Yes, the fees add up. But the systems have been developed over a really long time, and they have multiple levels of protection against you losing all your money. In the US that's the FDIC and SIPC, for regular-sized accounts. There will never been a direct equivalent for BTC, precisely because no one's national security is tied to BTC. And most people won't buy deposit insurance at any price higher than the "free" one they get from their government. Early adopters of Bitcoin spoke fondly of the fact that there are no chargebacks. That's a great way to reduce transaction costs. It's also a great way to make sure that when you get hacked (and you will) you cannot recover. Compare this to the situation with ACH transfers (the US-only, low-cost "wire transfer" system). Anyone who knows anything about computers would be aghast at the technology comprising that system. The security appears to be pretty lame. Yet people do not lose their savings via ACH. Why? It isn't because ACH transfers are so secure--it's because the banks can undo them, which in turn lowers the incentive for thieves. This is a virtuous cycle, by contrast to Bitcoin's vicious one, and the way it works has nothing to do with technology.

Udo 13y ago

What I don't understand is why are Bitcoin sites keeping such amounts in their hot wallets in the first place? Bank robberies happen, that's why traditional banks don't keep a huge amount of cash in the teller's office. Why not just transfer almost everything into cold wallets immediately? This way, the worst that could happen is every once in a while a human needs to bring a cold wallet online for a big withdrawal - with the added benefit that, you know, an actual human would check if the transaction is actually valid. It seems to me the solution to this problem (which will keep on happening apparently) is not primarily to make a site that is absolutely penetration proof, but to devise a system where the scope of a breach is guaranteed to be very limited.

servowire 13y ago

Use your own wallet. If you do not own the Private Key - you do not own the Bitcoin! Sad this has to happen again and again.

twobeard 13y ago

What Bitcoin does better than anything else is to highlight the current state of computer security, which is plain terrible. For that alone Bitcoin deserves to exist.

igl 13y ago

if bitcoint was made for the people, it would be forbidden already. wake up.

jjindev 13y ago

1. We have a currency without government! 2. We were robbed, and will now contact the government.

zacinbusiness 13y ago

Ok. So where can I find an accurate exchange rate for Bitcoin vs. U.S. dollars? I'm just curious to see what the rate is these days, given that people keep getting "hacked." And as a so-far-not-adopter, I wonder if now may be the time to "invest" a little into the Bitcoin thing.

bendoernberg 13y ago
If you're going to buy in the US I'd recommend using Coinbase. Their price will be within $10-$15 of the prices you'll get at the largest BTC exchanges.
- zacinbusiness 13y ago
  Is Coinbase considerably more secure than MtGox? As I've said elsewhere, I do believe that Bitcoin is a resilient and useful currency. But I'd hate to get Goxed (I'm coining this term here).

zacinbusiness 13y ago

"His soul swooned slowly as he heard the snow falling faintly through the universe and faintly falling, like the descent of their last end, upon all the living and the dead." (there are some people having a dick fight about their majors in college...well I was an English major.)

notastartup 13y ago

We've been hacked = All your coin are belong to us