[ANN]First online MPEx brokerage now in public beta - page 2.

Bitcoin Oz

hero member

Activity: 686

Merit: 500

Wat

I have one piece of advice for anyone who wants to take it. If youre previously "not legit" bitcoin site starts talking about "going legit" you are about to be fucked in the ass.

There is no "going legit" so either start out that way or embrace the dark side.

Quote

[05:20] and I'm going to my tax directorate branch tomorrow, to get official acknowledgement that i'm doing imaginary trades
[05:20] only

You should have done that before opening the brokerage.

Because if you do it now and the lawyers tell you its illegal your clients will be glbse'd

burnside

legendary

Activity: 1106

Merit: 1006

Lead Blockchain Developer

Quote from: rini17 on November 30, 2012, 06:06:14 PM

This isn't about jurisdiction. Did anyone ever got saved by that lame "for educational purposes only" excuse?

That would definitely be very lame, if that were all it was.

Quote from: rini17 on November 30, 2012, 06:06:14 PM

Since the bitcoins can't be withdrawn without hacking also backend server, the portfolio can be rebuilt with small loss, MPEx is liquid enough for that. I am not going to bother MPEx asking to reverse transactions in this case. Maaaybe if the hacker does something utterly stupid like spend everything by buying some options and exercising them worthless, then maybe it will be possible to work together with MPEx to revert the txs, as this would be is much simpler case both for them to undo and for us to prove. We really don't see a need to draw some "what if" agreeements with MPEx, rather prefer to focus on doing our stuff right and that takes time.

The part in bold applies pretty much across the board. I think all the exchanges have the wallets on backend boxes.

You're definitely going where noone has gone before. Hopefully you're a breakthrough success.

Cheers.

rini17

sr. member

Activity: 340

Merit: 250

GO http://bitcointa.lk !!! My new nick: jurov

Quote from: burnside on November 30, 2012, 05:26:09 PM

Quote

[05:05] morning
[05:05] so, apparently i need to slap "The use of this site is for educational and entertainment purposes only." on coinbr
[05:05] to evade accusations that i'm "borderline scammer", eh?
[05:07] while the same person says that that to say about myself that i'm a broker, i need some certificate, lol
[05:08] oh, and i also need insurance. usagi, you there?
[05:10] https://bitcointalksearch.org/topic/m.1367797
[05:12] so, mircea_popescu, of it all comes that we should get some legal affidavit that that nothing we trade is real.
[05:12] then we can call ourselves "security exchange" and "broker"
[05:15] yeah borderline trolling
[05:17] and we need borderline insurance, don't forget Tongue

I don't mind so much that you're not taking this seriously. Maybe you're in a jurisdiction where you don't have to care? Fair enough.

This isn't about jurisdiction. Did anyone ever got saved by that lame "for educational purposes only" excuse?

Quote from: burnside on November 30, 2012, 05:26:09 PM

Quote

[05:29] oh and what if hacker sells all coinbr holdings? https://bitcointalksearch.org/topic/m.1367844
[05:30] o any mistakes you make are far harder to fix than if you were running your own exchange where you probably would eat a BTC loss out of the wallet but could easily revert to a previous backup.
[05:30] i cant even...
[05:31] so if i empty btct wallet, they'll just revert to previous backup, and all will be dandy
[05:32] why didn't i think of such?
[05:32] this is a bizzare argument
[05:32] seems to me the broker-exchange structure is inherently safer

I thought what I was saying was clear, I'll attempt to re-word it:

(a) If BTC-TC / Cryptostocks / MPEx is compromised people lose the BTC in their wallet on the exchange. Any securities compromised can be restored by the site admins.
(b) If CoinBr is compromised people lose all their securities. You claim zero liability, the trades happen on an exchange out of your control, so your clients are just shit out of luck.
(c) Keep in mind, we're talking asset exchanges, NOT currency exchanges.

Doing the math. Where do you think the larger exposure is?

(a) A few BTC in a wallet? Or;
(b) A person's entire portfolio of securities?

I'll leave ya be from here on out. I don't think stirring the pot is going to help matters. Best of luck with your brokerage. Wink

Since the bitcoins can't be withdrawn without hacking also backend server, the portfolio can be rebuilt with small loss, MPEx is liquid enough for that. I am not going to bother MPEx asking to reverse transactions in this case. Maaaybe if the hacker does something utterly stupid like spend everything by buying some options and exercising them worthless, then maybe it will be possible to work together with MPEx to revert the txs, as this would be is much simpler case both for them to undo and for us to prove. We really don't see a need to draw some "what if" agreeements with MPEx, rather prefer to focus on doing our stuff right and this will be plugged too, just it takes some time.

burnside

legendary

Activity: 1106

Merit: 1006

Lead Blockchain Developer

Quote from: burnside on November 29, 2012, 06:59:28 PM

[05:19] mmm
[05:19] just use CPA oh wiat
[05:20] lol mpex has self-issued court immunity
[05:20] if that's not good enough i dunno what is.
[05:20] and I'm going to my tax directorate branch tomorrow, to get official acknowledgement that i'm doing imaginary trades
[05:20] only
[05:21] oh, can we have this immunity extended to coinbr?
[05:21] no.
[05:21] it's only for white background websites

lol.

Quote

[05:24] the argument is pretty retarded, "your honor, I thought jurov was a broker" "well... did you wire him money ?"
[05:24] "no, he wouldn't take money"
[05:24] "this makes sense"

It's common knowledge that bitcoin is a virtual commodity. Brokers are not limited to trading cash. Undecided

Quote

[05:29] oh and what if hacker sells all coinbr holdings? https://bitcointalksearch.org/topic/m.1367844
[05:30] o any mistakes you make are far harder to fix than if you were running your own exchange where you probably would eat a BTC loss out of the wallet but could easily revert to a previous backup.
[05:30] i cant even...
[05:31] so if i empty btct wallet, they'll just revert to previous backup, and all will be dandy
[05:32] why didn't i think of such?
[05:32] this is a bizzare argument
[05:32] seems to me the broker-exchange structure is inherently safer

I thought what I was saying was clear, I'll attempt to re-word it:

(a) If BTC-TC / Cryptostocks / MPEx is compromised people lose the BTC in their wallet on the exchange. Any securities compromised can be restored by the site admins.
(b) If CoinBr is compromised people lose all their securities. You claim zero liability, the trades happen on an exchange out of your control, so your clients are just shit out of luck.
(c) Keep in mind, we're talking asset exchanges, NOT currency exchanges.

Doing the math. Where do you think the larger exposure is?

(a) A few BTC in a wallet? Or;
(b) A person's entire portfolio of securities?

I'll leave ya be from here on out. I don't think stirring the pot is going to help matters. Best of luck with your brokerage. Wink

burnside

legendary

Activity: 1106

Merit: 1006

Lead Blockchain Developer

Quote from: rini17 on November 29, 2012, 06:33:34 PM

Quote from: burnside on November 29, 2012, 06:05:34 PM

I was worried about that. Quoting that page:

Quote

Warning: This MPExAgent version does not support any authentication! Anyone who has access to the listening port, can freely issue MPEx commands in your name. Try it only behind firewall. Patches to support HTTP authentication (should not be hard to add, twisted supports it) or other means are welcome.

If anyone gets CLI on your box all of your brokerage's shares are pwned. Only hedge I see against this would be some kind of agreement from MPEx to roll back trades if that situation were to occur. Do you have such an agreement?

I know what it lacking and am honest about it, but this is not a big issue. The frontend (webserver) attacker would be able to only trade, not push or withdraw anything (MPExAgent does not support these functions at all). So possible damage for this attack vector is limited. The connection to backend is protected by VPN and backend server itself is highly secured with minimal services running. And it will not stay like this forever, it is being continuously improved. BTW, I am also owner of simpleshell.com , which is running for several years already with minimal maintenance and no major problems, something unheard of for linux shell server.

TBH, when I was initially asking, I was kind of hoping you were going to say that you were manually processing the orders.

I'm going to have to disagree with how big an issue it is. The hacker doesn't have to benefit for it to be a huge blow to CoinBr. All the hacker has to do is sell off all of your holdings and you're in trouble. (you have to buy them back at potentially painful prices to cover your users) A huge part of the problem is that you're not the authority on who owns what, MPEx is. So any mistakes you make are far harder to fix than if you were running your own exchange where you probably would eat a BTC loss out of the wallet but could easily revert to a previous backup.

For being honest about it, thank you. I suspect you're going to need to setup your backend to not trust your frontend, maybe the backend can verify orders on a per-user basis using a hash of the users auth data or something similar? I see lots of coding in your future. Wink

Cheers.

rini17

sr. member

Activity: 340

Merit: 250

GO http://bitcointa.lk !!! My new nick: jurov

Quote from: burnside on November 29, 2012, 06:05:34 PM

I was worried about that. Quoting that page:

Quote

Warning: This MPExAgent version does not support any authentication! Anyone who has access to the listening port, can freely issue MPEx commands in your name. Try it only behind firewall. Patches to support HTTP authentication (should not be hard to add, twisted supports it) or other means are welcome.

If anyone gets CLI on your box all of your brokerage's shares are pwned. Only hedge I see against this would be some kind of agreement from MPEx to roll back trades if that situation were to occur. Do you have such an agreement?

I know what it lacking and am honest about it, but this is not a big issue. The frontend (webserver) attacker would be able to only trade, not push or withdraw anything (MPExAgent does not support these functions at all). So possible damage for this attack vector is limited. The connection to backend is protected by VPN and backend server itself is highly secured with minimal services running. And it will not stay like this forever, it is being continuously improved. BTW, I am also owner of simpleshell.com , which is running for several years already with minimal maintenance and no major problems, something unheard of for linux shell server.

burnside

legendary

Activity: 1106

Merit: 1006

Lead Blockchain Developer

Quote from: rini17 on November 29, 2012, 05:38:55 PM

GPG key is stored on backend servers (one at the moment, there will be more soon for higher availability) that are physically safely located - not even colocated, they don't need very fast connection. Passphrase is held in memory and must be entered by hand when server starts. The software used is open source.

I was worried about that. Quoting that page:

Quote from: rini17 on November 29, 2012, 05:38:55 PM

Thank you both for inquisitive questions. I'm looking forward to you requesting such transparency from other exchanges or MPEx brokers/passthrough operators.

Absolutely.

Cheers.

rini17

sr. member

Activity: 340

Merit: 250

GO http://bitcointa.lk !!! My new nick: jurov

Quote from: burnside on November 29, 2012, 03:28:05 PM

Quote from: rini17 on November 29, 2012, 03:25:33 PM

Quote from: burnside on November 29, 2012, 02:39:42 PM

I'm considering using CoinBr to trade MPEx assets.

Can you walk me through the trade process between CoinBr and MPEx?

IE, I place an order. What steps does CoinBr take to execute that order? Details please.

Thanks!

I think this has enough details:

Quote from: rini17 on October 16, 2012, 05:56:49 AM

At the moment, order is placed immediately when you click "Save". (It may be shown in "Queued" state but it means it waits for next STAT call to process further.) You can GPG-verify the receipt on the order detail page that it was placed exactly with the same parameters as you requested. Maybe later it will be necessary to really queue orders before submitting to MPEx to improve latency, but we'll always strive to place them asap.

It is not. I read the thread before posting, thanks.

Details. Please. Where is the GPG key stored? Where does the passphrase come from? If you want users to trust the platform, you're going to have to be a little more transparent.

Cheers.

GPG key is stored on backend servers (one at the moment, there will be more soon for higher availability) that are physically safely located - not even colocated, they don't need very fast connection. Passphrase is held in memory and must be entered by hand when server starts. The software used is open source.

Quote from: picobit on November 29, 2012, 03:22:55 PM

If I use such a broker, will assets formally be issued to me, or to the broker?

The assets are yours, by all definitions broker is someone who only facilitates the trade.

Quote from: picobit on November 29, 2012, 03:22:55 PM

I guess that MPex will GPG sign that the asset was issued to the broker, so if the broker goes broke, do I have a problem?

I described the precautions in this thread already. MPEx issues GPG signed message - receipt that an asset was bought/sold and CoinBr makes the receipt immediately available to you on order page - like in the screenshot. (It will be also sent by email, this is under development, together with GPG-signed daily account statements). It can be used as a proof that this trade was done on your behalf.

We use CoinBr MPEx account exclusively for client's transactions, and if client goes broke it only affects his account in CoinBr database, nobody else. For speculation (like the loans I took) and testing different personal account is used.

Thank you both for inquisitive questions. I'm looking forward to you requesting such transparency from other exchanges or MPEx brokers/passthrough operators.

burnside

legendary

Activity: 1106

Merit: 1006

Lead Blockchain Developer

Quote from: rini17 on November 29, 2012, 03:25:33 PM

Quote from: burnside on November 29, 2012, 02:39:42 PM

I'm considering using CoinBr to trade MPEx assets.

Can you walk me through the trade process between CoinBr and MPEx?

IE, I place an order. What steps does CoinBr take to execute that order? Details please.

Thanks!

I think this has enough details:

Quote from: rini17 on October 16, 2012, 05:56:49 AM

At the moment, order is placed immediately when you click "Save". (It may be shown in "Queued" state but it means it waits for next STAT call to process further.) You can GPG-verify the receipt on the order detail page that it was placed exactly with the same parameters as you requested. Maybe later it will be necessary to really queue orders before submitting to MPEx to improve latency, but we'll always strive to place them asap.

It is not. I read the thread before posting, thanks.

Details. Please. Where is the GPG key stored? Where does the passphrase come from? If you want users to trust the platform, you're going to have to be a little more transparent.

Cheers.

rini17

sr. member

Activity: 340

Merit: 250

GO http://bitcointa.lk !!! My new nick: jurov

Quote from: burnside on November 29, 2012, 02:39:42 PM

I'm considering using CoinBr to trade MPEx assets.

Can you walk me through the trade process between CoinBr and MPEx?

IE, I place an order. What steps does CoinBr take to execute that order? Details please.

Thanks!

I think this has enough details:

Quote from: rini17 on October 16, 2012, 05:56:49 AM

At the moment, order is placed immediately when you click "Save". (It may be shown in "Queued" state but it means it waits for next STAT call to process further.) You can GPG-verify the receipt on the order detail page that it was placed exactly with the same parameters as you requested. Maybe later it will be necessary to really queue orders before submitting to MPEx to improve latency, but we'll always strive to place them asap.

picobit

hero member

Activity: 547

Merit: 500

Decor in numeris

If I use such a broker, will assets formally be issued to me, or to the broker?

I guess that MPex will GPG sign that the asset was issued to the broker, so if the broker goes broke, do I have a problem?

burnside

legendary

Activity: 1106

Merit: 1006

Lead Blockchain Developer

Quote from: MPOE-PR on November 29, 2012, 02:58:44 PM

You know, irc won't bite.

A lot of the irc servers have policy against publicly quoting the conversation logs. I don't like that very much. What is freenode's policy?

Cheers.

MPOE-PR

hero member

Activity: 756

Merit: 522

You know, irc won't bite.

burnside

legendary

Activity: 1106

Merit: 1006

Lead Blockchain Developer

I'm considering using CoinBr to trade MPEx assets.

Can you walk me through the trade process between CoinBr and MPEx?

IE, I place an order. What steps does CoinBr take to execute that order? Details please.

Thanks!

rini17

sr. member

Activity: 340

Merit: 250

GO http://bitcointa.lk !!! My new nick: jurov

Password reset function is now available, 2FA for withdrawals is next. We plan to provide two methods:

BTC address sign message (same as password reset)
HMAC, most likely Google Authenticator - preferable if you have offline wallet backup and want to keep its usage to minimum.

MPOE-PR

hero member

Activity: 756

Merit: 522

Quote from: rini17 on October 26, 2012, 08:07:57 PM

Quote from: Stephen Gornick on October 26, 2012, 01:47:19 PM

Quote from: rini17 on October 15, 2012, 03:25:52 AM

Currently supported operations:

There doesn't currently appear to be any way to change my password when logged in. Sometimes minimally viable product site builders will say that functionality exists through the "forgot my password" / reset capability but I don't see that capability either.

Also, there is no multi-factor authentication option for login.

Or more importantly, for there is no way to require multi-factor authentication for withdrawal:

A plea to exchanges ... lets do 2 factor right!
- https://bitcointalksearch.org/topic/a-plea-to-exchanges-lets-do-2-factor-right-109424

Thanks for feedback.

The project focused to start with most often used functions, which, hopefully, password reset isn't. The form for that, using "sign message" function of the bitcoin address you have provided on registration is fully specified and will be done. Until that time, in case the need arises, we can resort to using GPG encrypted e-mail or similar method.

As for two factor authentication, we agree it is important and can't even think to go out of beta without it. The withdrawal form already has some weak protection by one-time token and by the time the withdrawal is processed (while the balance is subtracted immediately, so user has some time to react). We still aren't decided which method to implement with our limited budget - even the thread you recommend did not agree on best way how to do it. It discusses mostly browser session hijacking, against which the browsers are increasingly patched, but not phishing or hacking GMail account.

One poor man's solution to the 2fa problem might be something stolen from gribble: if a withdrawal over a set amount is requested, user receives via email a challenge, which is a gpg string they have to decode. If the user fails to respond with the correct string the withdrawal isn't processed. Maybe have these expire in a set interval (24 - 48 hours?), and also allow the user himself to set the trigger amount (and don't display it anywhere on the user pages, so an attacker can't learn it).

rini17

sr. member

Activity: 340

Merit: 250

GO http://bitcointa.lk !!! My new nick: jurov

Quote from: Stephen Gornick on October 26, 2012, 01:47:19 PM

Quote from: rini17 on October 15, 2012, 03:25:52 AM

Currently supported operations:

There doesn't currently appear to be any way to change my password when logged in. Sometimes minimally viable product site builders will say that functionality exists through the "forgot my password" / reset capability but I don't see that capability either.

Also, there is no multi-factor authentication option for login.

Or more importantly, for there is no way to require multi-factor authentication for withdrawal:

A plea to exchanges ... lets do 2 factor right!
- https://bitcointalksearch.org/topic/a-plea-to-exchanges-lets-do-2-factor-right-109424

Thanks for feedback.

The project focused to start with most often used functions, which, hopefully, password reset isn't. The form for that, using "sign message" function of the bitcoin address you have provided on registration is fully specified and will be done. Until that time, in case the need arises, we can resort to using GPG encrypted e-mail or similar method.

As for two factor authentication, we agree it is important and can't even think to go out of beta without it. The withdrawal form already has some weak protection by one-time token and by the time the withdrawal is processed (while the balance is subtracted immediately, so user has some time to react). We still aren't decided which method to implement with our limited budget - even the thread you recommend did not agree on best way how to do it. It discusses mostly browser session hijacking, against which the browsers are increasingly patched, but not phishing or hacking GMail account.

Stephen Gornick

legendary

Activity: 2506

Merit: 1010

Quote from: rini17 on October 15, 2012, 03:25:52 AM

Currently supported operations:

There doesn't currently appear to be any way to change my password when logged in. Sometimes minimally viable product site builders will say that functionality exists through the "forgot my password" / reset capability but I don't see that capability either.

Also, there is no multi-factor authentication option for login.

Or more importantly, for there is no way to require multi-factor authentication for withdrawal:

A plea to exchanges ... lets do 2 factor right!
- https://bitcointalksearch.org/topic/a-plea-to-exchanges-lets-do-2-factor-right-109424

AngryCatfish

member

Activity: 104

Merit: 10

Quote from: 🏰 TradeFortress 🏰 on October 16, 2012, 06:30:37 AM

Bitcoin Credit Ratings

This thread has received a B- rating.

OP provides good explanations, and probably won't run away with your coins. Good business plan.

Damn I was looking for A++ I guess I'll jeep looking... Tongue

scrybe

sr. member

Activity: 350

Merit: 250

Topic: [ANN]First online MPEx brokerage now in public beta - page 2. (Read 4872 times)