Bitcoin Bolt

OzCoin, one of the larger Bitcoin mining pools, has reported that an unknown attacker managed to hack into their server, defacing their website and database and stealing 923 BTC ($135,000) from their Bitcoin wallet. However, in less than a day over half of the money was seized as it was passing through the web wallet StrongCoin, and promptly returned to Ozcoin. 354.06 BTC are still missing, and will likely never be found, but this nevertheless leaves OzCoin with a much softer blow than what anyone expected.

Although most people agree with StrongCoin’s actions, this is nevertheless a very worrying sign for the security and privacy of StrongCoin, and other web wallets by extension. StrongCoin is what is often called a hybrid web wallet, accessible as a website on the internet but doing all of the transaction signing and address management in Javascript on the client side. Essentially, the client is downloading a fresh version of the wallet software from StrongCoin each time, and from that point, in theory, the software becomes just as secure as any other client-side program. The user’s wallet data, including the private keys needed to sign transactions, is backed up on StrongCoin’s servers, but it is encrypted and decrypted client-side using the user’s password so, once again in theory, there should be no way for StrongCoin themselves to get hold of the user’s private keys. StrongCoin heavily advertises this feature; on the website’s front page, they write: “Therefore our servers only hold encrypted private keys and neither we nor anyone else can spend your Bitcoins. Only you.” Except they just did.

Inspections of StrongCoin’s client-side code have confirmed that StrongCoin is in fact operating exactly as a client-side web wallet should. This leaves only one possibility: StrongCoin essentially hacked their own service. By injecting code that would automatically send all of a user’s funds to themselves as soon as the user entered their password, a web wallet provider can easily steal from any of their users provided that they log in with enough frequency. Attacks like these are the reason why security analysts have generally come out against Javascript cryptography; this and other arguments are well-explained in Matasano’s article “Javascript Cryptography Considered Harmful“. This time, StrongCoin used this vulnerability to do good, but at the same time they have critically undermined the trustworthiness of their service; people use hybrid web wallets over centralized services like Coinbase precisely because they do not trust central service providers to always do the right thing.

It should be noted that the other major hybrid web wallet provider, Blockchain.info, has taken steps to protect their users against such an attack. Their web wallet is also offered in the form of a Chrome and Firefox extension, which is essentially equivalent to any other piece of desktop software with the sole difference being that it relies on the user’s browser to interpret its source code. Safari users also have a Wallet Verifier plugin, although its scope is much weaker.

The other issue is privacy. Explaining how they discovered that the thief was using their service, StrongCoin wrote that “Everytime you make a payment from StrongCoin the fee goes to 1STRonGxnFTeJiA7pgyneKknR29AwBM77 so any payments from strongcoin held accounts are easily traced back to the site.” Presumably, bitcoins from the theft were traced through the blockchain until one of the transactions made its way to StrongCoin, at that point establishing a direct link between the StrongCoin account and the thief. This actually marks the first time that a significant amount of money was successfully recovered using the help of blockchain analysis. Although blockchain analyses made by various researchers have been able to draw intricate graphs mapping Bitcoin transactions to a few high-profile users, until now the public transaction log in the Bitcoin blockchain had not managed to track down or stop a single large-scale theft – casting doubt on claims that Bitcoin is not anonymous. This incident does not imply that Bitcoin now has no privacy at all; StrongCoin’s counter-hack was only possible because the transaction came very soon after the original theft and the thief had not yet made any strong attempt at obfuscation, and StrongCoin’s wallet in particular is weak in terms of privacy because add transaction fees are sent to one particular address (1STRonGxnFTeJiA7pgyneKknR29AwBM77). However, it is still a worthy incident to point to when confronted with concerns that Bitcoin facilitates untraceable theft.

Those using StrongCoin should decide for themselves whether staying with StrongCoin is worth it. Those who enjoy StrongCoin for the user interface features should probably stay; StrongCoin has been in the Bitcoin community for a long time, and if users are willing to outright entrust their funds to exchanges it is not a leap to trust StrongCoin to do the right thing as well. Those who like the cryptographic client-side security aspect, on the other hand, should consider switching to Blockchain.info – or, better yet, a client-side wallet like Electrum. As for StrongCoin themselves, if they wish to maintain their status as a secure hybrid web wallet, they should quickly get to work on catching up with Blockchain.info and implement a Firefox and Chrome extension.

The post OzCoin Hacked, Stolen Funds Seized and Returned by StrongCoin appeared first on Bitcoin Magazine.

Mt. Gox has been one of the biggest enigmas of the bitcoin community. Despite almost universal criticism, no competitors have been been able to unseat their position as the dominant bitcoin exchange. One of the latest pieces on Bitcoin news is a  Reuters interview with CEO Mark Karpeles revealed some interesting insights into their operation and perspectives on bitcoin. The first question we can lay to rest is the correct pronunciation of their company – Mount Gox.

Branding and Atmosphere

One of the first things most viewers will notice is their use of balls as chairs in the interview. Mark is clearly going for the start-up atmosphere, instead of the established banker. They have had their share of growing pains, with their inability to continue operations during DDoS attacks, and the 20,000 user queue to obtain a verified account. Clearly Mark agrees that they are not where they need to be yet, and hopefully this will benefit their users as they put more effort into expanding their infrastructure and customer service.

Lack of Internal Tools

Mt. Gox’s internal toolset

What they actually use

From the video, it’s a little concerning how unsophisticated their internal tools to monitor traffic seem to be. The first shot shows their internal tool – using a local IP address – that is little more than a ticker of the latest trade values, and clearly shows bitcoinity tabs open next to it. It’s surprising that after their acquisition of www.mtgoxlive.com they have not addapted it to work locally yet. Mark is clearly using bitcoin.clarkmoody.com to look at the latest bitcoin exchange rates. It’s no secret that we’re huge fans of Clark Moody’s interface, however it does raise flags to Mt. Gox’s market insight if those sites go down. What happens when someone DDoS’s all of the bitcoin charting sites? Does Mt. Gox only have that ticker to see how their system is doing?

Cash Flows

One key insight Mark provided was the cash inflows vs outflows. He estimated $5-20 million cash going in every day, and $0.3-1 million going out. This is obviously very bullish for bitcoin, indicating a significant net inflow of cash. Even during the steep drop from $260 to $55, there was not a significant outflow of cash indicating that a lot of it has remained in the system ready to be reinvested.

Disconcerting Quote

The most concerning part of the interview was Mark’s quote, “there’s nothing behind bitcoin trade to keep the market value high.” He appears skeptical of the current exchange rate.  I’m not certain how he’s determining what’s “behind bitcoin,” however I’m certain it’s more than “nothing.” Bitcoin has a global network of users conducting thousands of transactions on a daily basis. Just like any other currency, it’s backed by the trust of the issuer and the integrity of the systems that run it.  You, me, and everyone else using Bitcoin are what backs it’s value.

Mt. Gox is still in the process of maturing into the exchange it needs to be.  In the meantime, diversifying into and further developing alternative exchanges that can demonstrate a secure and stable platform will be essential to bitcoin’s long term success.

The post An Analysis of the Interview with Mark Karpeles, CEO of Mt. Gox appeared first on The Genesis Block.

A frequent question people have about bitcoin is ‘what can I spend them on?’ There are many merchants that accept bitcoins, and this number is increasing every day. Since Bitcoin was first adopted by the tech community, spending bitcoins on electronic equipment seems like a good place to start. I needed a new computer monitor and I thought this would be a perfect opportunity to document my transaction and share it with you.

I decided to search through Bitcoinstore.com, an online retailer that only accepts bitcoins as payment.  Bitcoinstore.com functions similarly to other online retailers (Newegg.com, Amazon.com, etc.); you can select from different categories, search for a specific product, filter based on price, etc. All prices are listed in USD and BTC; the price in bitcoins is calculated in real-time from the current USD-equivalent market price.

I decided on this monitor.

Again, using Bitcoinstore.com is similar to every other online retailer. I click the “Add to Cart” Button

Click on the “Checkout” button on the Shopping Cart tile. This will begin the checkout process. You have the option to create an account or you can checkout as a guest. As you can tell, a pattern is emerging here. Commerce via Bitcoin, in most cases, will be exactly like what we are all accustomed to.

Alright, now we arrive at the point where a Bitcoin transaction differs from a typical online transaction. For Bitcoinstore,com, there is only one payment option – bitcoins. The user selects “bitcoins” and is presented with the following instructions.

You are instructed to send X.XXXX bitcoins to a specific bitcoin address. This address is unique to your order. This allows the merchant to verify exactly when a payment is initiated. With these instructions, there are actually 3 different options you can take to send bitcoins depending on what kind of wallet you’re using. For information about wallets and bitcoin storage, check out our Bitcoin 101 course on Bitcoin Storage.

• Option 1 – Wallet is stored within a software client on your computer – For this option, simply send X.XXXX bitcoins to the bitcoin address listed.
• Option 2 – Wallet is stored on a mobile app on your phone – For this option, you can scan the QR code and send the proper amount of bitcoins.
• Option 3 – If you have an account with BitPay, you can click on the “Click to Pay” button and follow the instructions

Once the transaction is sent out to the bitcoin network, Bitcoinstore.com will recognize it and automatically finalize the order.

Congratulations! You have successfully spent bitcoins online!

It’s as easy as that. Spending bitcoins with an online merchant is can be just as easy as buying anything else online. The real difference comes at the end when you go to the pay the bill. Instead of inputting your credit card number or logging into paypal, you simply go to your wallet to send the funds.

Good luck with your purchases, and feel free to share your experiences using bitcoin stores.

The post Tutorial: How to pay with bitcoins online? appeared first on The Genesis Block.

John Robb, a writer at Resilient Communities, just tweeted that a large amount of Wikileaks cable data has been embedded in the blockchain.

Jon Matonis – Must-see Presentations At Next Month’s Bitcoin 2013 Conference:

Bitcoin Foundation board member Jon Matonis (@JonMatonis) describes upcoming presentations at the Bitcoin 2013 Conference (May 17-19) in San Jose, CA.  Excerpts:

“The conference is attracting technologists, venture capitalists, bankers, traders, payments specialists, and financial regulators.”
–
“The agenda will be particularly interesting to those in the banking and payments fields.”
–
“BitPay co-founder and CEO, Anthony Gallippi, will explain how he’s been driving business adoption of Bitcoin.”
–
“Paymium’s co-founder and chief operating officer, Pierre Noizat, will talk about bridging the gab [between bitcoin and the traditional regulated banking infrastructure].”
–
“Rainey Reitman, the activism director of the Electronic Frontier Foundation, a nonprofit civil liberties law firm and advocacy center, will hold forth on the liberating aspects of Bitcoin.”
–
“Tuur Demeester, author of the financial newsletter MacroTrends, will talk about bitcoin’s emerging role as a separate asset class alongside precious metals, equities, and bonds.”
–
“Online payments industry veteran Peter Šurda about how nonpolitical cryptocurrencies like bitcoin could alter the future of fractional reserve banking.”

[Note: Though registration for the event continues online through May 15th, the deadline for the conference rates is April 26th.]

 – http://bit.ly/17IYUcR
 – http://www.Bitcoin2013.com
 – http://www.bitcoin2013.com/topics—schedule.html (PDF)

All News – Daily E-mail Subscription – Twitter: @BitcoinNews

The most famous torrent site in the world, The Pirate Bay, has just started accepting Bitcoin donations, placing a donation address on their front page. The initiative quickly proved to be very successful, raising over 10 BTC ($1,300) in little more than a single day, and other major torrent sites have quickly started to do the same thing. EZTV, OpenBitTorrent, PublicBitTorrent and istole.it have all added Bitcoin donation addresses onto their front pages.

In terms of promoting awareness, this is a fairly large step forward for Bitcoin. The Pirate Bay is ranked by Alexa as the 77th most visited site on the internet, placing it above all other Bitcoin-accepting sites to date except WordPress at 21st. However, the Pirate Bay’s use of Bitcoin, and that of the other torrent sites that have rapidly followed suit, is much more prominent. Unlike WordPress, Namecheap and Reddit, which do not make any attempt to advertise their acceptance of Bitcoin beyond an initial press release, the Bitcoin address on The Pirate Bay in particular is immediately visible to everyone who accesses the page. The message that The Pirate Bay is sending is clear: you do not need to be ashamed about supporting Bitcoin. Sure, Bitcoin is controversial, with some mainstream economists coming out outright against it, but what revolution isn’t? As an organization whose very continued existence has come to symbolize an ongoing victory against the pro-copyright establishment, The Pirate Bay understands this better than almost anyone else – except perhaps Wikileaks, although incidentally Wikileaks accepts Bitcoin too, and are actually doing quite well with it.

Of course, businesses like WordPress, Reddit and NameCheap are not charities, and essentially since have already made the bold step of accepting Bitcoin in the first place we should not demand them to more actively promote Bitcoin from the kindness of their hearts if they do not want to. Fortunately, however, at least in spirit The Pirate Bay is a charity, and as members of the Bitcoin community, we should be very grateful that such organizations exist. It is only through people and organizations continually and passively promoting Bitcoin in this way that the currency will reach any kind of significant cultural acceptance – simple news articles primarily lead to transitory interest that, in the case of the latest bubble, has already largely faded away. News promotes Bitcoin as something special; passive promotion promotes Bitcoin as something normal. The answer to which one evokes less hostile attention from regulators, more interest from casual users, and ultimately more willingness on the part of more traditional businesses to accept Bitcoin and show it, is clear.

When donating bitcoins in general, there is one security reminder that is important to repeat: don’t copy a donation address from anything other than the official website, and do not post a donation address without directly linking to the page that confirms the address as being legitimate. Posting fraudulent donation addresses is very easy, and it would be a shame if the Bitcoin community’s charitable nature were to be exploited by the most trivial of scams. Stay secure, stay safe, and feel free to donate a few bitcents today.

The post The Pirate Bay Accepting Bitcoin Donations, Other Torrent Sites Follow appeared first on Bitcoin Magazine.