Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Great Robocoin Rip-off: How We Lost $25,000 Buying a Robocoin ATM

docs.google.com

Post reply on HN
Print view View original

101–110 of 136 posts

Re: The Great Robocoin Rip-off: How We Lost $25,000 Buying a Robocoin ATM

#101

Post by hatty »

hatty wrote: post #90
aleem wrote: post #39

Jordan Kelley has posted his response on Reddit http://www.reddit.com/r/Bitcoin/comments/2jakg4/the_great_ro... Judging from the replies, it seems to have backfired probably because he did not acknowledge the errors on his side (shipping a lemon, unresponsive over email and not having provided a refund yet). Worse, he doesn't seem to realise that the name-and-shame was a result of his and ultimately RoboCoin's action…

Jordan provided his email on the reddit comment (jordan@robocoin.com) and encouraged people to contact him if they want to engage further. After spending so much time reading the materials and forming an opinion, I emailed him. I suspect he thought not many people would actually email. I'll make sure to comment if I get more details beyond these materials or even get a response.

He says he will give full refund. I supplied the response in a new comment rather than reply.

Re: The Great Robocoin Rip-off: How We Lost $25,000 Buying a Robocoin ATM

#102

Post by iancarroll »

jboggan wrote: post #97
kyledrake wrote: post #88

I've helped work on Project Skyhook, which is a $1000 Bitcoin ATM: http://projectskyhook.com Orders ship within 2-3 weeks. Shipping to Canada is no problem, customs is no problem. Assembly is in Portland, Oregon, so it's a quick ship to Vancouver. We've shipped hundreds of units. Setup is completely on the owner's end. Owners don't need the company to configure the unit, and the company doesn't need to run servers fo…

The physical security on units such as these, or the majority of newly manufactured Bitcoin ATMs, is a joke. There's a good reason to build a large, heavy safe into an ATM, and all but the very strongest and most expensive can be broken into trivially. Bitcoin ATMs are even worse than cash ATMs from this perspective because physical compromise of the machine potentially nets you private keys. Small/cheap units like t…

If the password on boot option actually encrypts something, wouldn't that solve the problem?

Re: The Great Robocoin Rip-off: How We Lost $25,000 Buying a Robocoin ATM

#103

Post by kyledrake »

jboggan wrote: post #97
kyledrake wrote: post #88

I've helped work on Project Skyhook, which is a $1000 Bitcoin ATM: http://projectskyhook.com Orders ship within 2-3 weeks. Shipping to Canada is no problem, customs is no problem. Assembly is in Portland, Oregon, so it's a quick ship to Vancouver. We've shipped hundreds of units. Setup is completely on the owner's end. Owners don't need the company to configure the unit, and the company doesn't need to run servers fo…

The physical security on units such as these, or the majority of newly manufactured Bitcoin ATMs, is a joke. There's a good reason to build a large, heavy safe into an ATM, and all but the very strongest and most expensive can be broken into trivially. Bitcoin ATMs are even worse than cash ATMs from this perspective because physical compromise of the machine potentially nets you private keys. Small/cheap units like t…

I agree with you that the locks aren't the best possible. Skyhooks wouldn't be a particularly great choice for an outdoor mall or a shady alleyway (they're not waterproof anyways), but they're perfect for cafes, small businesses, meetups, etc. I haven't heard a single report of a stolen or compromised Skyhook yet, and hundreds have been shipped. I don't think this is as big of a problem as it's made out to be.

Instead of making the entire unit expensively heavy, we opted to provide a way to bolt the unit onto something else, via 4 thick screws on the bottom of the unit with a heavy mounting plate, and supply that with purchase. That way, the ATM is either portable (a lot of people like to take them to Bitcoin meetups or swaps), or you can optionally secure it to something very difficult to steal. That way, you get a choice.

If the unit is removed from the wall, the unit detects that it has been powered off and locks the system, requiring the operator password to unlock it. It's not perfect security, but it's pretty good.

Skyhooks don't have protection from Denial of Service attacks from God yet though, unfortunately: http://www.coindesk.com/arizonas-first-bitcoin-atm-struck-li...

Re: The Great Robocoin Rip-off: How We Lost $25,000 Buying a Robocoin ATM

#104

Post by kyledrake »

iancarroll wrote: post #102
jboggan wrote: post #97

Earlier quoted context omitted.

The physical security on units such as these, or the majority of newly manufactured Bitcoin ATMs, is a joke. There's a good reason to build a large, heavy safe into an ATM, and all but the very strongest and most expensive can be broken into trivially. Bitcoin ATMs are even worse than cash ATMs from this perspective because physical compromise of the machine potentially nets you private keys. Small/cheap units like t…

If the password on boot option actually encrypts something, wouldn't that solve the problem?

That's what it currently does.

Re: The Great Robocoin Rip-off: How We Lost $25,000 Buying a Robocoin ATM

#106

Post by jboggan »

gambiting wrote: post #62
majidarif wrote: post #21

Earlier quoted context omitted.

This is true, you'll notice atm machines when under maintenance shows the classic XP screen. Though I do not know, why they still use that.

Because ATMs are usually not connected to the Internet, so there are minimal attack vectors. Every time you make a transaction the ATM literally rings up the bank, using an old fashioned modem. They could probably have Windows 95 installed on them and they would still work fine.

Not really anymore. This was the case with many of the much older OS/2 based machines but the days of dedicated lines are drawing to a close. Most ATMs I serviced were either directly plugged into a bank's network via ethernet cable or they had a wireless router hidden in the external enclosure and did transactions over a non-dedicated wireless network. These were all XP-based machines.

Updates are issued but they are typically on CD-ROMs from the software vendor, and unless the tech servicing company is going out on a monthly basis the machines are not patched or current. It was not uncommon to tack on 6 different upgrade disks to a maintenance call because that machine hadn't been patched since last year.

Re: The Great Robocoin Rip-off: How We Lost $25,000 Buying a Robocoin ATM

#107

Post by zo1 »

skyjacker wrote: post #40

Personally, I've tried five times to make small purchases with Bitcoin (this was several years ago). In all cases I was ripped off and never received product. It's not going to be government regulations that kill Bitcoin, its the associations with illicit drugs, child pornography, and dishonesty of vendors like Robocoin.

People have gotten very used to some of the niceties and existing organizations that have evolved around normal currency (Over a lot of years. Probably a few orders magnitude more years than how long Bitcoin has even existed). Such a safety net does not exist for Bitcoin, yet.

It's just a matter of people realizing that fact, and re-acting accordingly. Be more cautious, perhaps come up with some sort of novel organization to fill this need, even.

Re: The Great Robocoin Rip-off: How We Lost $25,000 Buying a Robocoin ATM

#108

Post by rip747 »

jordanrobocoin wrote: post #91

Apology letter from Jordan: http://www.reddit.com/r/Bitcoin/comments/2jakg4/the_great_ro...

So you want a pat on the head or something for finally doing the right thing?

Sorry kid, but by you letting the situation escalate to this point shows me that you have no place in the business world. I really hope your company sees how poorly you've handled this situation and removes you from it.

Re: The Great Robocoin Rip-off: How We Lost $25,000 Buying a Robocoin ATM

#110

Post by tobiasSoftware »

Was just reading the reddit thread and Jordan posted a picture of a transfer of $25000 to Andrew. However the details were not blacked out properly, you could see the address easily and could probably figure out the account numbers given a bit of time. The picture has since been removed.
Post reply on HN