I'm not a bitcoin expert, so I may end up off base, but...

The US government seemed surprisingly warm to bitcoin in the senate hearing. I suspect that if governments end up getting involved in bitcoin, each merchant will require some form of ID for each wallet that they interact with. This will mean that tracking down crimes like this will be fairly easy, since there's a record of each transaction. Trace down the chain, find the people involved, and if an anonymous wallet shows up, you investigate the people that it transferred to or from.

Sure, it erodes privacy, but bitcoin has the potential to make things much easier for law enforcement (and anyone else interested in money transfers) by causing registration of endpoints, giving very strong leads to investigators.

ID'ing hasn't stopped stolen guns from being used by criminals, I highly doubt it will stop hackers from being able to use Bitcoin. Harder maybe. But there will be thousands of markets that exist outside of USA regulation (or black markets within the USA). Especially by the time the USA would be capable of implementing some sort of ID system.

There is also factoring in the complexity added to associating any form of ID to a particular coin, if CoinJoin or similar trustless anonymizing mixing services reach widespread adoption.

This is all assuming Bitcoin continues it's mainstream course.

If the US government decides to take this approach, I am sure that a few of these guys will do the exact opposite: http://en.wikipedia.org/wiki/Tax_haven#Examples

Jurisdictions like that have been increasingly disappearing. If regulators in major countries make it illegal to exchange BTC anonymously, it will significantly hamper its adoption.

Ugh. There are much better solutions than keeping user funds in the hot wallet (fully cold storage with manual withdrawals, multi-signature wallets), but many "reputable" businesses STILL uses them. I don't understand why. If you want to store your customers funds online, do it the right way, or don't do it at all.

You cannot automate a cold-wallet scheme.

Any automated website or tool will require a "hot wallet" of some kind. The more funds in the hot wallet, the longer the website / BTC Bank can go automatically.

Customers like having funds available to them immediately... among other things.

Given the choice between being hacked, losing your reputation and millions of dollars; or having someone on call 24/7 to move USB sticks across an air gap; I'd choose the latter.

I've seen fast food joints and parking lots with 24/7 attendants, it can't possibly cost more than $100,000 a year.

THIS IS THE FUTURE EVERYONE!!!!

The future of modern banking is to return to physical transfer of funds. Instead of relying on modern networking, technology, automation, or websites... we will manually move money over a physical medium.

</sarcasm>

Without automation, how the hell is BTC supposed to be any better than cash?

Uhhh let me get this right:

$10,000,000 spent to secure a bitcoin exchange to within 99.999% secure via "automation"

$100,000 spent to secure a bitcoin exchange to within 99.999% secure via physical air gap...

which makes more sense

You can still do automated transactions from your hot wallet - human intervention is only required for transactions that exceed the size of the hot wallet.

And merchants who don't make enough profit to pay $20-$30 an hour to put a human in the loop can have a payment processing company do it.

Don't get me wrong, if you think bitcoin websites have done a superb job at securing their hot wallets [1,2], you're welcome to keep all your money in a hot wallet where it can be 100% cleaned out without a human lifting a finger. Good luck with that.

[1] https://bitcointalk.org/index.php?topic=83794.0 [2] http://fc13.ifca.ai/proc/1-2.pdf

Did you really just suggest trusting millions of dollars of customer funds to the equivalent of minimum wage fast food restaurant employees?

> You cannot automate a cold-wallet scheme.

That's why I said that it would be manual. Actually, it could be semi-automatic - a script could generate all relevant transactions, and a human operator could simply confirm them few times a day by signing the transaction with his password protected private key.

> Customers like having funds available to them immediately... among other things.

Either security or convenience. This service was aimed for merchants, which are used to get their funds from payment processors much slower than in a matter of hours.

Also, that's only one of the solutions that I mentioned. Second one, which is convenient and more secure at the same time, is using multisignature wallets.

> and a human operator could simply confirm them few times a day by signing the transaction with his password protected private key.

It's a payment system. This would be unacceptable.

I'm not talking about confirming transactions of merchant customers. I'm talking about confirming withdrawals from the merchant accounts.

Any wallet that has been exposed to a computer connected to the Internet, or is sitting on one, is a "hot wallet".

> You cannot automate a cold-wallet scheme.

Yes, you can. You can have the hot wallet only deal with multi-signature outputs, and have these approved by separately locked down servers running behind TOR, for example, using out-of-band mechanisms for approving transactions.

>You can have the hot wallet only deal with multi-signature outputs

Then you don't have a cold-wallet scheme. You have a hot wallet scheme.

You can do anything if you allow massive handwaving. ("out-of-band mechanisms for approving transactions")

Do I have to spell it out? The machine could be under physical control of its operators, with rate limiting restrictions lifted only by manual intervention via a GUI interface, making the low bandwidth TOR connection the only link to the outside world (and a simple one at that). Or the the verification and signing steps done via TPM so as to prevent key theft. There are other possibilities too.

This isn't handwavery. It's basic security engineering.

Yes, but the whole debate was how to it automatically. Once you have someone physically intervening, your solution fails to meet the problem criteria.

Having people involved to resolve edge cases and possible fraud/theft is kinda the point...

I know it makes for a better headline to say $1M stolen, but unless actual USD was taken in the theft, I wish these headlines would say "X BTC stolen, valued at $Y."

But then again, the headline made it to the front page and got me to comment...

Why do you wish that? Every news source on the planet localizes currency amounts to their audience. Are you actually making some weird political point about BTC value, or are you surprised that a news source is localizing currency values?

1) When large amount of BTC are stolen or moved, the fiat value would be far less if the coins were sold on the open exchange.

2) The article title becomes immediately obsolete due to exchange rate fluctuations. On the day of the theft for instance, the BTC/USD rate was hugely volatile, fluctuating between $522 and $788.

We could go dig up the old Bitcoin Forum posts about people losing 25k coins and mark-to-market those losses for more sensational headlines. Or we could simply post the BTC amount in the headline along with present fiat value.

Well, it's a news article. The goal of the journalist is to get people to read it. It would be a less interesting headline if it forced people to do the conversion since many people still do not yet understand BTC. Putting both values (BTC & USD) into the headlines would make it redundant.

hah i suggested this a few posts ago & people got pissed.

https://news.ycombinator.com/item?id=6783710

granted, i don't present these things very tactfully

If you are new to bitcoin-related sites, you might find this story legitimate. But anyone that reads the article will see there is a basic flaw: DDoS attacks do not give access to the server, they just make the service inaccessible. If you read past (paid) articles about this very same service, you will see claims about how secure the system is, and how expert everyone that developed it is. The same was claimed by inputs.io, I'm sure you have read about that story earlier.

The thing is, if you want to use bitcoin, you cannot trust third parties to hold your coins for you. If you want to support bitcoin in your business, you cannot trust other sites to handle the payment for you. Yes, it is not convenient. But you have everything available to handle this yourself and, yes, you will need someone competent to do that for you if you are not into it. Bitcoin is not meant for the average user or the unaware merchant and it might never be, people need to start accepting this fact.

Misleading. 1295 BTC were stolen, no USD.

Well thank goodness for that. At least this way there is no chance of recovery.

I enjoyed the bit at the end about a potential lawsuit to get the BTC back. Sounds awfully familiar to the legal posturing after some other BTC heists--none of which got anywhere AFAIK.

Do people still think the irrevocability of BTC transactions is a good thing?

Gold, which was easier to track down and confiscate "back" was historically confiscated in much larger quantities by much tougher guys. This "insured" government debt-backed money that you have today is a result of having heavy money that is ultimately owned by someone who is bigger than you.

While Bitcoin is stolen from some exchanges from time to time, it's much more diffused and it's enormously harder to take bitcoins massively from population than gold.

See also: http://en.wikipedia.org/wiki/Executive_Order_6102

By the way, these "insured" USDs that you have in your account are not owned by you. Try to cash out everything in paper. Or move anywhere at once without asking for permission. Or what would you do when they impose capital controls like in Cyprus or Argentina? Or when your % of total USDs in the economy is going down while Fed is printing more dollars? Or when some new taxation is applied retroactively? Or when some bureaucrat didn't see your tax return papers in time and your entire account is frozen during investigation?

Bitcoin reduces systemic risk like the one present in banking system and shifts the burden on individual users. You can still create a bank if you want, but that's totally optional and you have many other options as well. In the future people will develop hundreds really different devices, services and tricks to store your coins securely. Compare that with monopolised non-innovative heavily regulated banking.

As bitcoins are so cheap to store, security is asymmetrical: it's much harder to take, than to hide. Gold, or any physical commodity, are as hard to protect as to take from you. Hence, most brutal guys end up owning precious metals over the course of the history. Average Joe can only have as much gold as he can hide in his pants.

States are powerful. You are mistaken if you think bitcoin can somehow materially evade that power, you have to interact with the real world some time.

Putting aside the increasingly clear fact that network-attached computers won't be secure from state-actors for the foreseeable future --- and bitcoin transactions always have to hit the network --- states can effectively control bitcoin being spent or bitcoin cash-outs being transferred in country as well as any currency.

Presently the risk of losing or having stolen your bitcoin is far higher than the same for gold or conventional stores of value.

>Do people still think the irrevocability of BTC transactions is a good thing?

Yes. Third parties will provide escrow/insurance services if there is demand for them. Transactions been irreversible "by default" is a core benefit of bitcoin and merchants may preffer that over chargebacks at 18€.

I've heard that this type of insurance is expensive and a large part of banks' transaction fees. I can only imagine how expensive an insurance service like that for Bitcoin would be.

However unlike the existing system there will be a transparent, competitive market for such insurance mechanisms, and they will be available to consumers/businesses directly.

I think the banks are pretty focused on offering competitive products that are packaged together neatly to avoid putting too much of burden on consumers (what's the diff between choosing a bank or choosing a private transaction-insurance service?).

I'm paranoid of investment banks but I think plain old banks are benign. You put a certain amount of money in your account and they handle all this for you. There is usually no charge for checking. Credit cards don't charge interest unless you go into debt, etc.

I don't think lack of competition is so much an issue, it seems that the Bitcoin movement just has a fundamental distrust of govt/corporations. I think if Bitcoin money didn't magically appreciate in value so much it wouldn't be much cheaper than banking except for big international money transfers.

Insurance does not eliminate risk from the market.

Market risk is not related to irreversible transactions, at least i don't see how.

What insurance might solve regarding bitcoin irreversible transactions and thieves is that customers of bitcoin services could have their funds reimbursed after a heist.

yes. events like this encourage better security.

If that's true, why did we see three significant Bitcoin services get hacked in basically the same way in the last year? I'm talking about the Linode ones.

Events like this encourage better thieves.

Because the people running these services apparently cared more for quick money than for security. Or running their own server. I mean, who runs that kind of thing on a cheap rented server? No pity here.

They took a risk, and one don't always win when taking a risk. (You startup folks should know.)

They seem to be currently worth more than $1 million USD though. Maybe the USD equivalent was chosen for the title because more people would be able to immediately relate to it as a value.

this is common linkbait tactic now. They take the current high trading value of BTC & multiply by the number of BTC involved to get some crazy-high-looking USD price. It's not money in hand, the reality of getting that money out of BTC can be pricey.

Which is why bitcoin is secure and liquid - great as a utility currency.

So you're saying the transaction costs of converting from bitcoin to any useful currency is really high and that we should see the unattractiveness of money-servicing costs as a security-assurance since script-kiddie criminals don't like seeing any portion of their free "money" siphoned away by the money-changers in the temple.

heh they DO hate that ;)

my point was simpler tho which is just that the real numbers being applied to these amounts rely on ecosystem stability and the market cap (a term a trader helpfully pointed me to in order to understand their favorite stat, which these "multiply by exchange rate" figures are an extension of) really doesn't represent the real world value of assets in Bitcoin since the value declines as money is pulled out of the system.

It seems to be anyone's guess as to whether or not it has real value or is a pyramid scheme. There's no way to tell without a mass cashout. Then we'd see how many BTC can get sold off before one starts to incur heavy losses. I think if some of the big players cashed out (early adopters with an inordinate amount of essentially self-printed wealth) the system would destabilize and finally flop. It's why they instead drive the price up & try to trickle units out one by one.

Why would early adopter cash out instead of keeping their savings in a deflationary currency that is gaining value? They didn't in the April crash.

eh cuz its just too good to be true. why not sneak out a few $700 now and then just in case tomorrow its worthless? keep enough for a large fortune but just take like 100 coins out every year. that would be what now, $70k/year? Just for selling off something that 2 years ago was worthless and in 2 years may be worthless? At a certain point you gotta just take the money & run.

Which makes me wonder: now that bitcoin seems to be gaining traction in china and elsewhere, how deep is the market?

How many BTC can you convert in dollars before you crash the market?

Correct me if I'm wrong, but if someone tries to convert stolen BTC into USD, it'll show up as a public transaction? (hence making it useless to steal BTC)

If they made a transaction with the exact amount stolen, maybe we could say it is the same wallet as the one stolen, but it could also be a false positive.

I would think the thieves are smart enough to make multiple transactions to move this money, in which case they won't get caught at all.

Yes and no. While all transactions are public, you can use a "mixing service" that will mix your Bitcoins with other people's Bitcoins, effectively covering their origin.

That's the point of the market-depth charts.

You can see the cumulative bids for the price as it moves down so you can pretty easily see what kind of loss you would take if you needed to sell a few thousand coins and it's not currently that bad.

For example, you could unload 1295 BTC without pushing the price below 760, and that's if you just dumped it all at once. http://bitcoinity.org/markets

Whale Communications, before they were purchased by Microsoft, had a hardware solution where a shared HDD disk was used to physically switch it between 2 different hosts to enable file sharing in a shared directory. would be almost perfect to secure the hot wallet of a BT service. MS seem to discontinued the product. I wander if something like this still exists from another vendor?

Can we get a break from all these Bitcoin posts please?

I just don't read posts I'm not interested in. I never feel compelled to complain that others are interested.

I don't work with web dev, can't we get a break from all those ruby, mongo, go and JavaScript posts please?

I agree, there are six posts about Bitcoin right now on top. On one hand it is community regulated matter, but on other hand 20% of top posts is too much.

When Steve Jobs passed, the entire home page was related articles.

It's just a reflection of what is happening in the world. Like it or not, Bitcoin is a big deal now.

I felt the same way about Aaron Swartz. Or Jobs after his death. Or commentary on Samsung v. Apple. Or random SF news. Or random NSA commentary.

Why did you click on it?

Just ignore or downvote next time.

Bitcoin is a hot topic these days, tons of people are interested in what's going on.

This isn't reddit. There's no downvote on stories for (most) users on HN.