Bitcoins

[Showbags]

I know there are a couple threads about them here....but are there any experts in here, TV and Thailand, with lots of experience/knowledge ?

.

[ukrules]

I know about Bitcoin, the way it works and the cryptography behind it. I've been researching Bitcoin and the 'alternates' for some time now right down to address creation, key import formats and the cryptographic signature (ECDSA) methods that it uses to sign the transactions.

I also know others who know a great deal more than I do. For example I own a small percentage of a new exchange and due to this I know the guy who designed and wrote the whole thing.

What exactly is it that you're looking for ?

[craigt3365]

This is best over in the Business sub forum. I know some "experts" frequent that forum. OK?

Topic Moved.

[Nautilus05]

I have a good amount of experience. What do you need to know?

[Showbags]

Thanks N5 and UR...

From the get go, understand I know nothing much about it at all....but interested in it for a possible project.

I'll have a hundred questions, so if you don't mind discussing them as it goes along, presuming it stays going along.

As for places to buy and sell BC's...where is the best option for now and from my angle, not necessarily the most well known, but an up and coming location that has something going for it.

[Showbags]

I know about Bitcoin, the way it works and the cryptography behind it. I've been researching Bitcoin and the 'alternates' for some time now right down to address creation, key import formats and the cryptographic signature (ECDSA) methods that it uses to sign the transactions.

I also know others who know a great deal more than I do. For example I own a small percentage of a new exchange and due to this I know the guy who designed and wrote the whole thing.

What exactly is it that you're looking for ?

Are you located in Bangkok or ??

[Nautilus05]

As for places to buy and sell BC's...where is the best option for now and from my angle, not necessarily the most well known, but an up and coming location that has something going for it.

It really depends on how you're setup for banking, and how you want to transfer funds to / from BTC. For example, I'm Canadian with Canadian bank account, so I go through https://cavirtex.com/, and it's great for me.

What type of project are you doing? Are you looking to invest / speculate? Or are you setting up an online operation that is going to accept BTC? If so, that's a different ballgame than just buying / selling BTC, and the one I have most experience in.

Edited May 1, 2014 by Nautilus05

[Showbags]

Thoughts from all angles cannot hurt.

It will be an online site accepting BC's.

Banking is in Hong Kong.

[ukrules]

I'm based in Hua Hin.

The easist way to just accept Bitcoin for goods when you sell something is to open up a Bitpay account.

Bitpay integrates with a large number of online stores, etc and you can decide whether to keep the Bitcoin or have it converted to a different currency or keep a certain percent of each sale as Bitcoin and convert the rest.

You don't need to get technically involved with the Bitcoin side of things if all you want to do is accept payments.

[Showbags]

If you store them in an offline wallet....how do you securely move them to trade...I presume whack them on a thumb drive and then onto your internet connected computer..

And, if you website is accepting bc's as payment....does this then mean you now have 2 potential risk points....when the purchase happens, and then when you wish to exchange them at a future point ?

I presume payment goes to bitpay, then to you....what is the process here and time frame ?

[ukrules]

If you store them in an offline wallet....how do you securely move them to trade...I presume whack them on a thumb drive and then onto your internet connected computer..

And, if you website is accepting bc's as payment....does this then mean you now have 2 potential risk points....when the purchase happens, and then when you wish to exchange them at a future point ?

I presume payment goes to bitpay, then to you....what is the process here and time frame ?

Bitpay forward the coins to an address of your choice. I'm not sure on the timeframe but I believe it's short - like less than an hour. Some services wait for '6 confirmations', I'm not sure what Bitpay does. '6 Confirmations' takes about an hour on average.

The only risk point is where they are stored. You could get Bitpay to send them directly to an offline wallet for storage.

[Showbags]

If you store them in an offline wallet....how do you securely move them to trade...I presume whack them on a thumb drive and then onto your internet connected computer..

And, if you website is accepting bc's as payment....does this then mean you now have 2 potential risk points....when the purchase happens, and then when you wish to exchange them at a future point ?

I presume payment goes to bitpay, then to you....what is the process here and time frame ?

Bitpay forward the coins to an address of your choice. I'm not sure on the timeframe but I believe it's short - like less than an hour. Some services wait for '6 confirmations', I'm not sure what Bitpay does. '6 Confirmations' takes about an hour on average.

The only risk point is where they are stored. You could get Bitpay to send them directly to an offline wallet for storage.

How do they do that...if its offline ?

[ukrules]

If you store them in an offline wallet....how do you securely move them to trade...I presume whack them on a thumb drive and then onto your internet connected computer..

And, if you website is accepting bc's as payment....does this then mean you now have 2 potential risk points....when the purchase happens, and then when you wish to exchange them at a future point ?

I presume payment goes to bitpay, then to you....what is the process here and time frame ?

Bitpay forward the coins to an address of your choice. I'm not sure on the timeframe but I believe it's short - like less than an hour. Some services wait for '6 confirmations', I'm not sure what Bitpay does. '6 Confirmations' takes about an hour on average.

The only risk point is where they are stored. You could get Bitpay to send them directly to an offline wallet for storage.

How do they do that...if its offline ?

The Bitcoins themselves are not stored in the wallet. The wallet is only a means to access them by using the private key associated with your Bitcoin address and the blockchain.

The actual coins you have are stored in the 'blockchain' which is a large massively redundant (many copies) database which every 'Bitcoin node' contains a copy of. Inside this blockchain are a list of all transactions since Bitcoin was created. There are 'spent' transaction outputs and 'unspent' transaction outputs. A Bitcoin addresses balance is calculated by adding up all the unspent transaction outputs which relate to it.

If you have the private key to a Bitcoin address you can access them from any Bitcoin client anywhere and once it's updated it's copy of the massively distributed blockchain they will appear in your balance ready to use.

This is why it's important to keep the private keys encrypted / safe from malware.

So if someone sends money to a Bitcoin address an unspent transaction output is logged in the blockchain against your Bitcoin address.

So long as that transaction output remains unspent it's available for the person who has the private key to spend. You could accept Bitcoin payments every week for a year using an offline account. Then come online, update the blockchain and watch as the transactions appear one by one in the Bitcoin client.

[Nautilus05]

There's two reservations I have about using APIs such as Bitpay:

1.) You have to store the API key / info in the site's software, and if the software can access it, so can hackers. Then it depends on the API you're using. Not sure about Bitpay, but for example, if someone is using Coinbase a hacker could get into the database, find their Coinbase API key, and 10 seconds later the Coinbase account is empty. I've seen it happen before.

2.) A URL on your site has to accept IPN requests. So every time a payment comes into your Bitpay account, the Bitpay server will send a request to your server letting you know. This is a security vulnerability, and hackers will find & hammer that URL with 500,000+ requests an hour with hopes of getting your system to accept fraudulent payments.

We've tried various APIs, and personally just use bitcoind now, which is basically the whole "be your own bank" premise of bitcoin. There's no restrictions or limitations, no merchant fees, it's instant, robust, secure (if done properly), and you have complete flexibility over how to handle your own money.

It all depends on what you're doing though. If you have an existing eCommerce store and want to add bitcoin to the list of accepted payment methods, then something like Bitpay is probably better. If you're starting a more "real-time" type operation, such as an exchange, trading platform, gambling site, or anything of that nature where funds are constantly moving, then bitcoind is the best choice. Getting setup with bitcoind properly takes quite a bit more in the technical arena though.

Edited May 8, 2014 by Nautilus05

[Showbags]

There's two reservations I have about using APIs such as Bitpay:

1.) You have to store the API key / info in the site's software, and if the software can access it, so can hackers. Then it depends on the API you're using. Not sure about Bitpay, but for example, if someone is using Coinbase a hacker could get into the database, find their Coinbase API key, and 10 seconds later the Coinbase account is empty. I've seen it happen before.

2.) A URL on your site has to accept IPN requests. So every time a payment comes into your Bitpay account, the Bitpay server will send a request to your server letting you know. This is a security vulnerability, and hackers will find & hammer that URL with 500,000+ requests an hour with hopes of getting your system to accept fraudulent payments.

We've tried various APIs, and personally just use bitcoind now, which is basically the whole "be your own bank" premise of bitcoin. There's no restrictions or limitations, no merchant fees, it's instant, robust, secure (if done properly), and you have complete flexibility over how to handle your own money.

It all depends on what you're doing though. If you have an existing eCommerce store and want to add bitcoin to the list of accepted payment methods, then something like Bitpay is probably better. If you're starting a more "real-time" type operation, such as an exchange, trading platform, gambling site, or anything of that nature where funds are constantly moving, then bitcoind is the best choice. Getting setup with bitcoind properly takes quite a bit more in the technical arena though.

Interesting.

How is this done properly then ?

[Nautilus05]

Interesting.

How is this done properly then ?

That's a pretty in-depth subject. First and foremost would be standard server security. Make sure you're protected against SQL and file injection attacks, XSS attacks, ensure IP restrictions and SSH keys are in place, etc. As for bitcoind itself, there's various things you can do. Automated flush functionality so you set a balance limit, and any excess funds are automatically flushed to an offline wallet. This way, even if a hacker does get in, the most you'll ever lose is a small float, and not the entire bank.

Then for example, one is Shamir's Secret Sharing Scheme:

http://point-at-infinity.org/ssss/

So your private key / wallet password is split into encrypted chunks, and stored on different servers. You can add in time based mechanisms, similar to how store safes around the world are on a timer, so one or two chunks of that private key is only online for a couple minutes a day. You could use bait & kill switches, so basically spread a few fake wallets around your server(s), and if any ever get touched, hit the kill switch rendering the actual wallet useless. Then obviously basic user-side protection -- one-way encryption of passwords, 2FA, IP restrictions, etc.

Again though, all this type of thing is only required if you're running more of a "real-time" operation, and have money constantly flowing in & out. If you're just accepting payments for a product / service, then this isn't really needed. However, if you are doing a "real-time" operation, then this is all basically necessary, and if you don't do it now, you will after you get hacked a few times. Well, either that or you'll just close your doors.

Edited May 8, 2014 by Nautilus05