Topic: [ANN] You liked instawallet.org ? You'll love instawire.org ! (Read 6163 times)

Firstbits on Instawire = bad idea

It has actually been discussed on the two previous pages.

still think that a firstbits thingie would be better^^

No worries! You forgot to mention that a lot of times the reference field will not only get uppercased but also truncated. But that's covered too.

The simpler the service looks from the outside, the more magic happens behind the scenes

naaaays.
see, you done thought of that, I like.

sorry if I came across rude, that's just me.

good luck with your endeavours.

I hope everyone remembers to copy their adress in there^^

Thank you Einstein, please have a look at this little bit of code.


I assume I don't need to show you the door.

this is doomed to fail.
why?

because some banks convert the comments field to UPPERCASE

so my adress 1nceWUfH23934kxbwqxn238940
will look like 1NCEWUFH23934KXBWQXN238940

which is NOT AT ALL THE SAME

bye bye money.


It would probably better to integrate a firsbits or btc.to-generator and have THAT code pasted in the wire text field

The first refund was rejected by the bank systems for some reason (they could not use the bank information provided): a resend was completed today to the bank account of origin. I hope it will go through without any further delay.

Yes, we'll look into it and send your transfer tomorrow if it hasn't already been done.
Refunds are not automated yet. So it has probably just slipped through the cracks. Sorry about that!

Hi!

I've cancelled a payment on 2012-10-27 08:49:04 UTC and it's not been refunded to my bank account yet. Could you please look into that?

Thanks!
  ~drekk~

Good call!

Fair enough, now you only see obfuscated e-mails and IBANs, no names anymore. Also since day one we limit the number of address inputs per hour and per IP to 3 making it quite hard to bruteforce.

Well, the truth is that humans set the price. There really is no algorithm. Sometimes we'll be a little more expensive than others, and sometimes we'll be a comparatively cheap.

I wasn't looking for a feature, I just thought that you could tell me roughly what exchange fee you charge your customers. I can figure it out myself by observing your price changes and what the price is on markets such as Mt.Gox. at that time, I just thought that maybe you could save me the trouble.

Yeah erm... that would be bad.

I was just going by the following:


I understood this to mean "If anyone inputs any bitcoin address into our system, they will be able to see the person's name and IBAN, so it's a good thing we don't allow firstbits, because some people's firstbits are available to the public and bitcoin addresses are not, and people might start seeing other people's personal information if we allow people to input firstbits".

That's the other part that confuses me...  I can see someone being able to attach a name/address to a bitcoin address if they had access to the wire transfer data, but how would a random person on the internet be able to make that connection?

Not using firstbits is already a good idea (since firstbits offer no protection against typos and practically guarantee that any mistake means you'll pay the wrong person).

But the revelation that one can see someone's identity and personal banking details by providing nothing more than a Bitcoin address and that this is by design, if true, would indicate... well... I'll leave it up to others to draw their own conclusion as to what that means.

My take on it was that people would more easily use firstbits familiar to them, possibly ones that had been previous posted on the internet.  It's a bit of a heavy-handed approach, but I can't deny that users are generally stupid, and protecting them from themselves is sometimes appropriate.

How does requiring the full address lessen this exposure?  If the reason you don't support firstbits is because you divulge personal information given a bitcoin address with the assumption that only the correct account holder will be able to provide the entire bitcoin address, how do you reconcile that with the fact that anyone can look up the full address for any firstbits on the internet and query with that instead?  In fact, the total set of bitcoin addresses ever used is very finite and publicly available, and someone could just query your server for every bitcoin address that has ever been used since your service started and datamine your entire database.

Good points regarding firstbits davout, thanks for the reply!

Fair enough, this should now be fixed. Thank you very much for the report !

We usually update it once in the morning (unless wild price swings happen during the day), sometimes you'll end up paying a little less on Instawire than the average price on bitcoin charts, sometimes a little more. At the end of the day that's not what Instawire is about. Instawire is about bridging the gap between the traditional banking system and the Bitcoin world in the most possible elegant way

Instawire offers no such feature, there are no plans to implement it. That's how we roll.

We will probably never support firstbits addresses, think about it for a minute, by inputting someone's address I can instantly find out whether this person transacted with Instawire, what this person's IBAN and name are. Probably not the best idea when firstbits are often part of forum signatures.

Additionnally, we rely a lot on bank wire references, these references can get truncated along the way, with a regular address that's not an issue, you can immediately see if it's valid or not and complete it at the moment the user inputs his full address. Truncating firstbits could be catastrophic since truncated firstbits could possibly resolve to a completely different address than the one originally intended.

Do you support firstbits addresses?

Still, I'd like to know what the price was at Mt.Gox. at the exact time that the exchange rate was set, so that I can compare them.

From what I understand the exchange rate is set once a day, therefore the information on the page doesn't "update often". That's a pretty convenient thing, IMHO.

I haven't tried it yet, but it looks good! So, if I use SEPA there is no fee on your side, right? What kind of price will I get compared to the latest price on Mt.Gox.? It's hard to compare since the price on your site is not updated that often.

Note that I was specifically addressing the page you get when your coins are "Ready to deliver" and the confirmation page that you see after your coins have been delivered.

Hi all and thanks for the positive comments !

So, to answer the couple of questions that have been raised :

Q. Why can't I see the total amount I'm buying ?
A. Because the rate is frozen at the moment your coins are in "Ready to deliver" state.

Q. Can I cancel a transaction because the rate has changed between the time I sent the money and the time the rate was frozen ?
A. Yes, absolutely.

Q. Why are you asking for an identification document ?
A. Because we need to mitigate the risk of accepting fraudulent incoming wires (in other words : wires that come from phished bank accounts)

Q. I don't like you guys being so nosy, can I cancel my transfer without providing an identification document ?
A. Yes, absolutely, we'll send the money back to the account it came from.

Q. Do you accept international wires ?
A. Yes, but our bank can charge us fees that we'll have to factor in to your sale. Only wires EUR wires coming from the SEPA zone are guaranteed to be free on our end.

Hi. I have been testing your service and is very quickly, how do you do (usually less than 4 hours)??

Last time, I get the "ID scan" mss.
Do you store the scans??
Is there any way to refuse the ID scan process and have my funds back? How?

And a last question. The money was received yesterday (when you had exchange rate ~ 8.4 €/BTC). If I send you the ID today, are you going to apply today exchange rate (~9.1 €/BCT)??

Thanks

Just tried this service, it was fast and easy.


+1

This lasted only a few hours, and I got my bitcoin. I really like this service!

One suggestion though: when you are ready to convert the € to bitcoins, you should indicate the rate and the expected amount that will be sent. Same thing when bitcoins are delivered, the page lists  the "Complete Bitcoin address", the "Bitcoin transaction ID", and the "Notification email", but not the "Amount" (which was at this type the only information that interested me :-).

Great service!

I'm currently testing the service, but while everything went very quickly so far (I initiated the transfer around 22:30 yesterday if I remember correctly, and it looks like you already received it 20 hours later) my purchase entered a so-called "Pending risk assessment" state. Does this phase take long? (I've been using this bank account with bitcoin-central a lot, inbound and outbound)

Your concern is valid but has been addressed in our risk analysis before launching the service: we have capped the maximum amount to 100 € per day per bank account.
Given the instawire sales flow seen by any given bank and the risk for the job security of a bank employee engaging in this kind of fraud, we consider the risk acceptable at this point.

Yep, mainly because those who have bought my coins likely feel they have adequate recourse against me, and if their BTC were to disappear, there is exactly one person whose ass to kick.  I have helped to mitigate their risk by sharing my personal information and offering to cooperate with any reasonable steps to verify anything anybody wants.

You are welcome to disregard my input, as I don't mean it to be critical.  Given the fee for a typical bankwire, I'd expect to see amounts much larger than 100€, certainly amounts worth stealing.  I am simply recommending that you take steps to mitigate the risk of a MITM changing the comment field on a bankwire for his own benefit and not assuming it can never happen.

Coming from you it's kind of a really weird thing to say. You do sell 1000 BTC casascius gold coins right ? Yeah, that's what I thought.

Whatever man, you're the one that can potentially run away with thousands of BTC worth of private keys and your only comment on this service is that we shouldn't trust banks to properly execute transfers 100€ worth ?

That's not a safe assumption to make when customers are the one taking the risk, possibly with a lot of money.  What if somebody somewhere can alter a comment without losing their job or being detected or identified?  Neither of us knows for certain that's impossible.  Complaints won't do much good if you're complaining after the money has already been stolen.  You use SSL when you bank or shop online, right?  Even though the risk of MITM is relatively small?  Even if only spending $10?  You would exercise caution (especially with other people's money) for much the same reason as you would use SSL when transacting online.

Come on ! Even in the very unlikely situation were they can alter the content of an online wire transfer, bank employees would not risk losing their job for a few BTC (each bank will only process a fraction of the traffic and it would not take long before we receive complaints). Then again, I can get struck by lightning twice tomorrow.

Whether or not there is is highly dependent on the bank and their procedures.  None of us really knows for sure, but finding out the hard way will be really expensive for somebody.  I know I'm a little bit prudish, but then again, I haven't lost money with Zhou Tong, Pirate, or ever had a wallet stolen, or funds in a website that got hacked.

I sent a wire out recently and, after clearly verifying that the amount was x, it went through for 10x, and then I had to start sounding the alarm bells pointing out that somebody somewhere screwed up.  So clearly, at some places, some things are done manually.  In that case, the full 10x hit the recipient's bank account, and then they were able to get the destination bank to send 9x of it back.  Imagine your bank wire gets manipulated by a clipboard BTC-address replacer because some step along the way involves copy and paste on a computer that caught malware.  Just sayin'!

If the address we receive is truncated, uppercased or otherwise invalid it gets corrected transparently as soon as the user checks for his transfer status by inputting his full and valid address in our interface.

I highly doubt there is any manual intervention in transfers made from web interfaces, and even if there was, I think the risk is pretty equivalent to having your transfer maliciously re-routed to a different IBAN.

My experience with wiring money is that the comments field is often converted to all caps. How do you deal with that?

One thing is kind of scary is that a rogue bank employee who knows about bitcoin could perform a low-tech meatspace MITM attack and insert his own address. By the time it was discovered it would be too late.

You could accept USD, but I am guessing that you would have to open a USD bank account with your bank (other currency or foreign currency account.)

Looking good!

Ordered 10 BTC yesterday. I somehow didn't receive the notification E-Mail, but you can check the status of pending orders by (re-)entering your BTC address on the front page. It won't place a new order, if you don't want to!

This way I was able to finalize the process and have just gotten the sixth confirmation for the transfer. And davout made a small provision.

Everybody happy!
~drekk~

We got our first two customers yesterday!
And they went through my affiliate link 

very very nice! Good job!

We're working on accepting USD through Dwolla and other methods, that should come pretty soon.

Excellent idea!

The obvious suggestion/request is to increase the €100 limit and accept other currencies (USD, etc)

Seems pretty nice! It would be cool if it is available for CAD too...

Not saying anything, but these kind of websites usually have some XSS vulnerabilities. Please check for that.

Your website only mentions Euros. Do you accept USD too?

LOVE IT. Nice work

TL;DR : Paste a Bitcoin address in a bank wire "reference" field. Bitcoins automatically sent to that address. Also refer your friends and get 1% of what we sell.


Hello everyone!

I'm very proud to announce that Paymium is launching a new original service called InstaWire, it's available at https://instawire.org.

It'll let you buy Bitcoins hassle-free by simply pasting your Bitcoin address in the "Comments" field of a bank wire. It's mostly intended for beginners or people who want to buy a few coins from time to time without the pain of registering an account on an exchange or going through AMhell.

The price will vary depending on market conditions and include a small commission.

We also have a nice affiliation program where you direct customers to us through a specially crafted link containing your Bitcoin address and you are rewarded with 1% of the Bitcoins sold. So if you refer Paul to us and Paul buys 100 BTC on InstaWire, we reward you with 1 BTC out of our own pocket.

Just craft your URL like this : https://instawire.org/?r=1DavouTAsveznCFHsz688xvbrRAq4u2qm8 put in on your blog, your signature, get its QR code tattoed on your chest and listen to the sweet sound of Bitcoins rolling in. (Pro-tip : we haven't edited the wiki pages yet to add InstaWire to the lists)