Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

BitPay Integrates Bitcoin with Fulfillment by Amazon

marketwatch.com

Post reply on HN
Print view View original

31–39 of 39 posts

Re: BitPay Integrates Bitcoin with Fulfillment by Amazon

#31

Post by ufmace »

reaclmbs wrote: post #7

Where to buy BitCoins easily? CoinBase is useless since they've "exceeded their maximum daily limit", and Mt. Gox wants me to verify my home address, but I just moved and don't have any bills yet.

I've had good luck with Bitfloor. They let you do a cash deposit at Bank of America, and it goes instantly to your account. No ID or addresses or anything.

Yes, they've been hacked before and lost bitcoins. I figure 1. being hacked once probably makes them a lot more cautious now, and 2. what was stolen was bitcoins that were sitting in user accounts there. You're at very low risk if you don't leave bitcoins sitting in your account - transfer them to a private wallet or convert them to USD immediately.

Re: BitPay Integrates Bitcoin with Fulfillment by Amazon

#32

Post by jvm »

implr wrote: post #13

For those who haven't noticed, a single bitcoin is worth almost 47 dollars now, over 30% more than two days ago: http://bitcoincharts.com/charts/mtgoxUSD#rg5ztgSzm1g10zm2g25...

Note to anyone who's designing cryptographic currency 2.0: stabilize the price next time. It doesn't have to be tied to USD but it should be tied to something. Control over the supply automatically gives you control over the price, you can peg to whatever you want.

Global GDP futures perhaps? It would be interesting to have a currency worth a particular percent of global output.

Re: BitPay Integrates Bitcoin with Fulfillment by Amazon

#33

Post by Nursie »

jvm wrote: post #32
implr wrote: post #13

For those who haven't noticed, a single bitcoin is worth almost 47 dollars now, over 30% more than two days ago: http://bitcoincharts.com/charts/mtgoxUSD#rg5ztgSzm1g10zm2g25...

Note to anyone who's designing cryptographic currency 2.0: stabilize the price next time. It doesn't have to be tied to USD but it should be tied to something . Control over the supply automatically gives you control over the price, you can peg to whatever you want. Global GDP futures perhaps? It would be interesting to have a currency worth a particular percent of global output.

That part of the point of BTC though, AFAICT - no price control, no supply control.

It appeals to libertarians for this reason. Doesn't appeal to me because I like stability in my currency and am happy to have central authorities that try to ensure that, but it appeals to libertarians.

Re: BitPay Integrates Bitcoin with Fulfillment by Amazon

#34

Post by muyuu »

eric_bullington wrote: post #26
muyuu wrote: post #23

Earlier quoted context omitted.

Non-hot wallets. I didn't say you shouldn't use wallets, just don't use the naive approach of having a plain wallet in a computer that's exposed via bitcoind. That's asking for it. Cryptography is hard, but you can use this for instance: http://bitcoinarmory.com/using-offline-wallets-in-armory/ It's already prepackaged for you. Give it a good read if you don't know it. Free, Open Source, etc. And the author is a nice…

Did you read my original comment? You basically just described a solution that mirrors my own, which was to send x percentage of your balance to an off-site wallet (maximizing x to the extent possible, obviously). I didn't get into how to securely store your coins off-site, since that wasn't the question. EDIT: BTW, you do realize that Armory is a front-end to bitcoind, right? You still have to run bitcoind for Armor…

Yes, that's fine. But the rest of the elements are non-trivial and you left them "as an exercise for the reader". This usually means that the reader will just run the standard client with a full internet connection and get hacked to high hell.

You can have a computer with a firewall and a custom protocol connected to another system, and still get hacked, if you don't put in place the sort of measures Armory uses.

Read carefully what you quoted: "it relies on on the Satoshi client to securely connect * to peers, validate blockchain data, and broadcast transactions * for us" - that is not the actual problem when you have your server rooted. The problem is KEYS. Key generation, and key storage/management. Which no other common solutions that I know do in a way that won't get your arse robbed if the computer storing the wallet is compromised. Which I think is a big deal.

Re: BitPay Integrates Bitcoin with Fulfillment by Amazon

#35

Post by muyuu »

eric_bullington wrote: post #28
muyuu wrote: post #27

Earlier quoted context omitted.

That's better but still this is what bitfloor ran and it got hacked. I recommend cold wallets instead. You can have your server rooted and not lose a satoshi.

That has nothing to do with why Bitfloor lost such a large sum -- they stored unencrypted keys to a wallet holding a large sum on a server that was hacked. They could have used whatever solution you or I propose and if they stored unencrypted copies of the keys to a wallet holding $250,000 worth of btc on an online computer that was hacked, the same thing would have happened. At the time, Roman Shtylman, the founder…

The extra measures needed are non-trivial and should be detailed (or an alternative, like Armory, given).

Otherwise, in real life, most people take the easy way out which means a standard client without no special measures. Note that encrypting the wallets still is not good enough if your webapp needs to be able to operate it (it will typically have the means to transfer funds just there, either keys or source code capable of replicating it).

Crypto is too hard to do right to leave all that as an exercise for the reader.

Re: BitPay Integrates Bitcoin with Fulfillment by Amazon

#36

Post by mcantelon »

tquai wrote: post #21
muyuu wrote: post #20

Earlier quoted context omitted.

That's the kind of set-up that has been hacked to high hell several times. It's not that hard to understand why. Having a computer connected to the net to run bitcoind means that if you get it rooted by any chance, you just lost the entirety of your hot wallet. Please, please stop doing that.

One of bitcoin's strengths is decentralization, and you just told people not to manage their own wallets. How do you accept bitcoin? Please enlighten us.

actually, come to think of it, you just need to provide a Bitcoin address for payments to be sent to and a form that takes the customer's own address so you can know who paid and for what.

Re: BitPay Integrates Bitcoin with Fulfillment by Amazon

#37

Post by eric_bullington »

mcantelon wrote: post #36
tquai wrote: post #21

Earlier quoted context omitted.

One of bitcoin's strengths is decentralization, and you just told people not to manage their own wallets. How do you accept bitcoin? Please enlighten us.

actually, come to think of it, you just need to provide a Bitcoin address for payments to be sent to and a form that takes the customer's own address so you can know who paid and for what.

Yes, absolutely. If you're thinking of a low-volume, semi-manual system, you can simply generate a list of addresses, store them on a DB, and display them to customers for payment. Then send out your product/service once you verify payment has cleared on the Blockchain Explorer. That's a good, simple, low-tech way of taking care of things, as long as you carefully match addresses to customers and take care to securely store the wallet you used to generate the addresses. But assuming you can program, it's not hard to implement an automated payment processor, or to integrate a third-party API. Please don't be scared off by alarmists. As long as you are taking care not to store large sums of Bitcoins on your server, there's no problem. You can easily set a cron job to move the full balance off your wallet every minute to a cold, air-gapped, inaccessible, off-site wallet (Armory looks good for storage). As long as you're not distributing bitcoins (like exchanges have to do), you don't need to worry about keeping a large sum on the wallet you use for your app. Please feel free to contact me at the address on my profile if you have any questions (my user name is my real name).

Re: BitPay Integrates Bitcoin with Fulfillment by Amazon

#38

Post by eric_bullington »

muyuu wrote: post #35
eric_bullington wrote: post #28

Earlier quoted context omitted.

That has nothing to do with why Bitfloor lost such a large sum -- they stored unencrypted keys to a wallet holding a large sum on a server that was hacked. They could have used whatever solution you or I propose and if they stored unencrypted copies of the keys to a wallet holding $250,000 worth of btc on an online computer that was hacked, the same thing would have happened. At the time, Roman Shtylman, the founder…

The extra measures needed are non-trivial and should be detailed (or an alternative, like Armory, given). Otherwise, in real life, most people take the easy way out which means a standard client without no special measures. Note that encrypting the wallets still is not good enough if your webapp needs to be able to operate it (it will typically have the means to transfer funds just there, either keys or source code c…

This is my last comment on this thread, since you keep repeating the same unfounded complaint. I did mention the extra measure of moving coins offsite in my original comment (which is trivial if you know how to use cron). As long as you do this, your risk of exposure is the amount of Bitcoins you accept during n interval, where n can be practically as small as you want it to be.

Also, I get the distinct feeling you're lecturing us about something you've never done. "to operate [a wallet]"?? "to transfer fund just there, either keys or source code capable of replicating it"?? How would you connect a web app, say a Ruby on Rails app, or a Django app if you're more comfortable with Python, to Armory to process Bitcoin payments? There's a new feature that's just been merged that I see would allow Armory to be used on the web, but as far as I can tell, no one is using it in production. But assuming this feature is production ready, how would you use Armory to process payments on the web? Have you actually done this? You're just mentioning a product and nothing about implementing payment processing. The extra measures needed to set up payment processing are most decidedly non-trivial and should be detailed.

Finally, I should mention that Bitcoin Armory is under AGPL (even stricter than the GPL), which means that no serious business is going to use it for payment processing since they would have to open source whatever app they are connecting it to (it's just fine to use it to store a business's Bitcoins, however, since in this case, it's not connected to your application). From the BitcoinArmory site: "Armory is licensed under the AGPL version 3, which guarantees that any derivative programs based on Armory source-code must also be open-source." bitcoind, on the other hand, is under the MIT license and can be freely used in commercial software without the obligation to share your source code.

Re: BitPay Integrates Bitcoin with Fulfillment by Amazon

#39

Post by muyuu »

eric_bullington wrote: post #38
muyuu wrote: post #35

Earlier quoted context omitted.

The extra measures needed are non-trivial and should be detailed (or an alternative, like Armory, given). Otherwise, in real life, most people take the easy way out which means a standard client without no special measures. Note that encrypting the wallets still is not good enough if your webapp needs to be able to operate it (it will typically have the means to transfer funds just there, either keys or source code c…

This is my last comment on this thread, since you keep repeating the same unfounded complaint. I did mention the extra measure of moving coins offsite in my original comment (which is trivial if you know how to use cron). As long as you do this, your risk of exposure is the amount of Bitcoins you accept during n interval, where n can be practically as small as you want it to be. Also, I get the distinct feeling you'r…

The only problem I had about your initial comment, is that someone unaware of the risks would be encouraged to do the same things that caused a gazillion hacks in the past.

The option of just having a small hot wallet and a cron script (risking just the amount in the hot wallet at any given time) is probably good enough for most people, and it's a lot simpler than the kind of crypto needed to set up a wallet that can be safely operated in untrusted media. That much is fine.

Still, hotwallets combined with limited human resources (can't have someone constantly checking the balance, cannot automate the loading of the wallet and keep that in the server for obvious reasons) usually end up in cutting corners, getting robbed and essentially financing crooks.

Cannot go around saying safe, home-made BTC wallet support is trivial for a newbie. If you think so you live in la-la land.

It's just unrealistic and conveys a dangerous message, that's all. 99% of HN's readers would be much better off using any of the already put in place payment processing systems and pay them for their years of expertise.

Post reply on HN