A valid concern - we have a fallback option of verifying two small credits amounts to your account if you are uncomfortable with the first option. It just takes a bit longer (2-3 business days) so we wanted to provide both options. Hope it helps.

Your company seems really interesting, and I'm considering setting up a merchant-account, but I'd STRONGLY advise you to drop the bank login feature.

I know it took a lot of code to write. And I know you convinced yourself it's an advantage. But it's not.

It's making people run from your site.

Look at the comments here, and these are from FRIENDLY people. Many many many others will see that in your blog article, and decide not to sign up for an account, and you'll never even know.

They won't write an article, they won't email you, they'll just decide you're skeevy, and abort.

You're already working with one tech that people thing is a bit "iffy". That means you need to do EVERYTHING POSSIBLE to make EVERY other bit of your service seem 10,000% above board.

Asking for bank login credentials, EVEN AS AN OPTION, torpedos that.

You're probably thinking to yourselves - "Maybe we should make the Credit Card primary, and make this secondary?" Just don't.

I know you spent a long time writing this, and I really wish it were a good idea, but I'd really suggest you just comment out the feature.

You can always put it back in a year or three if you really really want, once your service has inertia, and is already more trusted. But even if Square or Stripe asked for that, it'd scare people away, and lose customers. It's just a bad idea right now.

I want you guy to do well. Please kill that feature.

It's not like he's blazing new ground here. People have already done this with Mint. When it launched TechCrunch was full of comments exactly like yours.

Actually, I don't think Coinbase is hurting themselves. Sure, smart people are running away, but the muppets[1] are happy to enter their bank passwords. But they're hurting their own customers by training them in unsafe practices. I guess it's a lost cause if Paypal does the same thing, though.

[1] since we're on the topic of finance

From BofA's guidelines on online privacy and security [1]:

"Protect your Online ID and Passcode. You should always guard your Online ID and Passcode from unauthorized use. If you share this information with someone, all transactions they initiate with the information are considered as authorized by you, even for transactions you did not intend for them to make."

Sure, why not.

1. http://www.bankofamerica.com/onlinebanking/index.cfm?templat...

That's the standard option that all other monetary services use when they want to ACH transfer to or from your bank account. Using that mechanism will make your service much more familiar and acceptable to people, whereas asking for a username and password raises huge red flags.

I only know of one other service that asks for bank account usernames and passwords: mint.com. And they frequently have to deal with customer concerns about the security of doing so, even though they very explicitly say they only provide read-only access. Your service doesn't even have that guarantee.

So: drop the username and password thing, and only support the standard verify-two-small-transfers option that every other service uses.

Paypal also asks for your bank username and password for instant verification. The process looks identical to the one displayed here so I would imagine that is where this came from.

I'm not saying I would trust giving my bank details out in general, especially with these bitcoin businesses, but I have to say that when I wanted to open a business account with paypal and I was faced with either waiting days or instant verification, I took the instant option even while knowing it was probably a bad idea.

With the dubious security reputation Bitcoin already has, you're already on thin ice with regards to this sort of thing. My gut says that by asking for banking passwords, you hurt yourself more than you help yourself.

If you're looking to get users into the door more quickly, you could borrow a page from LendingClub, who will let you deposit from a credit card, but only when opening a new account, not afterwards.

It's not a problem for me, but I'm thinking bigger. IMO we need very strict rules to keep normal users from compromising themselves, and there's a sort of herd immunity that comes from everybody following these rules. No service should ask for anyone's password to another service, ever. Even if OAuth isn't available, just say no.

As a bitcoiner, I urge you to reconsider the first option. Asking password to users' bank account is very bad practice.

Unlike others here, I'm really excited about this feature! Buying bitcoins is one of the hardest steps for new people getting into it, so if you can provide a faster and easier way to do it, then good!

That said, you should absolutely ensure your security is top-notch. You should also be getting frequent public security audits.

Merely, "valid?"

Hahaha! No, seriously. WTF?