...
I was surprised no one mentioned bit-pay yet
Topic: How To Automate Bitcoin Payments For Website Sales?? - page 2. (Read 4018 times)
I was surprised no one mentioned bit-pay yet
Adam,
check out
https://bit-pay.com
We let you price your items/cart in USD and we handle the rate conversion at the point of payment. If you'd like to see it in action, visit these handful of merchants that are using it:
http://bitcoinconference.com
http://www.staremagazine.com/Store/PurchaseIssue.asp?IssueID=116
http://ogdogg.com
send me a PM if you have any questions.
Thanks!
Tony
check out
https://bit-pay.com
We let you price your items/cart in USD and we handle the rate conversion at the point of payment. If you'd like to see it in action, visit these handful of merchants that are using it:
http://bitcoinconference.com
http://www.staremagazine.com/Store/PurchaseIssue.asp?IssueID=116
http://ogdogg.com
send me a PM if you have any questions.
Thanks!
Tony
maybe if my site it self went and checked the block chain data, then i would only have to trust my self....
I think the best option would be a lightweight client that listens in on the P2P network and passively checks the block chain data and dispatches notifications for receives on a set of addresses. That prevents you from relying on a single point of failure. I mean, an external provider is easier to use, but what if bitcoinnotify is hacked? It could lie that it receives coins. The P2P network and block chain is in place exactly to prevent this kind of lying.
Don't get me wrong -- I do think bitcoinnotify is a great service, especially for testing and initial development. You can always switch to your own block chain listener later.
Quote
you could try reading the api documentation for liberty reserve, alertpay, etc for security ideas.
BitcoinNotify.com please rework your idea, in light of the issues presented
i think your on the right track with the idea that you don't hold the coins you simply tell me when they have arrived
once you can solve the fake IP problem i think we will be set.
maybe if my site it self went and checked the block chain data, then i would only have to trust my self....
interesting...
I thought Josh was talking about the fact that the only authorization is your IP address:
Someone might be able to forge a 'payment sent' request to your user's website by simple spoofing your IP address since it appears there is no authentication or token or anything sent in the POST request itself to prevent a fake payment acknowledgement.
An IP address spoofing explanation is here:
http://www.shaadiya.com/ask/2007/06/15/how-to-spoof-ip-address-hackers-view-and-the-way-to-protect-sites-with-this-fake/
If I could spoof your address I could send fake payment acknowledgements to all your users.
But, I'll be honest, I only took a quick look at your docs and I don't know your system nor have I tried it yet so maybe I'm just blowing smoke out my ass.
But if I'm right, you should probably fix that.
Quote
All HTTP notifications are sent with the POST method from the IP 46.4.90.208.
You should check the request IP in your controller to ensure the notification actually comes from us.
...You should check the request IP in your controller to ensure the notification actually comes from us.
Quote
Here is the example request you can expect:
POST http://www.yourstore.com/payment_notifications?type=payment_received&btc_amount=2.99&to_address=15fdhRDNYn4vbRztLS4hZeh9TtpNEMcikJ
POST http://www.yourstore.com/payment_notifications?type=payment_received&btc_amount=2.99&to_address=15fdhRDNYn4vbRztLS4hZeh9TtpNEMcikJ
Someone might be able to forge a 'payment sent' request to your user's website by simple spoofing your IP address since it appears there is no authentication or token or anything sent in the POST request itself to prevent a fake payment acknowledgement.
An IP address spoofing explanation is here:
http://www.shaadiya.com/ask/2007/06/15/how-to-spoof-ip-address-hackers-view-and-the-way-to-protect-sites-with-this-fake/
If I could spoof your address I could send fake payment acknowledgements to all your users.
But, I'll be honest, I only took a quick look at your docs and I don't know your system nor have I tried it yet so maybe I'm just blowing smoke out my ass.
But if I'm right, you should probably fix that.
issues worth noting.
any ideas on how to fix this issues?
maybe you could send me an encrypted password along with the other information.
on my side once i can check the password and know its not a fake
you could try reading the api documentation for liberty reserve, alertpay, etc for security ideas.
I thought Josh was talking about the fact that the only authorization is your IP address:
Someone might be able to forge a 'payment sent' request to your user's website by simple spoofing your IP address since it appears there is no authentication or token or anything sent in the POST request itself to prevent a fake payment acknowledgement.
An IP address spoofing explanation is here:
http://www.shaadiya.com/ask/2007/06/15/how-to-spoof-ip-address-hackers-view-and-the-way-to-protect-sites-with-this-fake/
If I could spoof your address I could send fake payment acknowledgements to all your users.
But, I'll be honest, I only took a quick look at your docs and I don't know your system nor have I tried it yet so maybe I'm just blowing smoke out my ass.
But if I'm right, you should probably fix that.
Quote
All HTTP notifications are sent with the POST method from the IP 46.4.90.208.
You should check the request IP in your controller to ensure the notification actually comes from us.
...You should check the request IP in your controller to ensure the notification actually comes from us.
Quote
Here is the example request you can expect:
POST http://www.yourstore.com/payment_notifications?type=payment_received&btc_amount=2.99&to_address=15fdhRDNYn4vbRztLS4hZeh9TtpNEMcikJ
POST http://www.yourstore.com/payment_notifications?type=payment_received&btc_amount=2.99&to_address=15fdhRDNYn4vbRztLS4hZeh9TtpNEMcikJ
Someone might be able to forge a 'payment sent' request to your user's website by simple spoofing your IP address since it appears there is no authentication or token or anything sent in the POST request itself to prevent a fake payment acknowledgement.
An IP address spoofing explanation is here:
http://www.shaadiya.com/ask/2007/06/15/how-to-spoof-ip-address-hackers-view-and-the-way-to-protect-sites-with-this-fake/
If I could spoof your address I could send fake payment acknowledgements to all your users.
But, I'll be honest, I only took a quick look at your docs and I don't know your system nor have I tried it yet so maybe I'm just blowing smoke out my ass.
But if I'm right, you should probably fix that.
issues worth noting.
any ideas on how to fix this issues?
maybe you could send me an encrypted password along with the other information.
on my side once i can check the password and know its not a fake
I thought Josh was talking about the fact that the only authorization is your IP address:
Someone might be able to forge a 'payment sent' request to your user's website by simple spoofing your IP address since it appears there is no authentication or token or anything sent in the POST request itself to prevent a fake payment acknowledgement.
An IP address spoofing explanation is here:
http://www.shaadiya.com/ask/2007/06/15/how-to-spoof-ip-address-hackers-view-and-the-way-to-protect-sites-with-this-fake/
If I could spoof your address I could send fake payment acknowledgements to all your users.
But, I'll be honest, I only took a quick look at your docs and I don't know your system nor have I tried it yet so maybe I'm just blowing smoke out my ass.
But if I'm right, you should probably fix that.
Quote
All HTTP notifications are sent with the POST method from the IP 46.4.90.208.
You should check the request IP in your controller to ensure the notification actually comes from us.
...You should check the request IP in your controller to ensure the notification actually comes from us.
Quote
Here is the example request you can expect:
POST http://www.yourstore.com/payment_notifications?type=payment_received&btc_amount=2.99&to_address=15fdhRDNYn4vbRztLS4hZeh9TtpNEMcikJ
POST http://www.yourstore.com/payment_notifications?type=payment_received&btc_amount=2.99&to_address=15fdhRDNYn4vbRztLS4hZeh9TtpNEMcikJ
Someone might be able to forge a 'payment sent' request to your user's website by simple spoofing your IP address since it appears there is no authentication or token or anything sent in the POST request itself to prevent a fake payment acknowledgement.
An IP address spoofing explanation is here:
http://www.shaadiya.com/ask/2007/06/15/how-to-spoof-ip-address-hackers-view-and-the-way-to-protect-sites-with-this-fake/
If I could spoof your address I could send fake payment acknowledgements to all your users.
But, I'll be honest, I only took a quick look at your docs and I don't know your system nor have I tried it yet so maybe I'm just blowing smoke out my ass.
But if I'm right, you should probably fix that.
Quote from: MrJoshua
bitcoind can monitor the blockchain without access to your receiving wallet just as easily as a third party service.
This is not the case. While bitcoind indeed monitors the whole blockchain, the JSON / RPC API gives you information only about your own addresses.
Please test for example getreceivedbyaddress API call. It will work only for your addresses, not for arbitrary Bitcoin address.
This means that:
- either you keep your wallet online and use relatively easy JSON / RPC API...
- either you you have to use the binary p2p API, which is pain in the arse and far behind capabilities of 99% Merchants, I guess.
Quote from: MrJoshua
Quote
You can expect Bitcoin payment notification in seconds after your customer clicks "Send" button in his Bitcoin client. While technically the transaction is not confirmed by the Bitcoin network, for most purposes it is practical to consider it so. Support for "confirmed" transactions is being developed for those cases when you need to be 100% sure (and do accept delays).
Do you see it now?
Thank you for being more precise.
As explained, support for confirmed transactions is on the way. It is up to the Merchant to decide, how many confirmations he considers "safe" for which product. Bitcoin wiki itselft suggests accepting not confirmed payments for cheap / low-risk products / services.
But you are right - I should make it more clear to avoid any misconceptions.
(edited)
This is EXACTLY the kind of mistake I'm talking about. That service is not providing anything you can't easily do with a bitcoind.
With BitcoinNotify.com you don't need to keep your wallet online. This is a major difference. Securing online wallet properly is extremely hard.
bitcoind can monitor the blockchain without access to your receiving wallet just as easily as a third party service.
Quote from: MrJoshua
And it's opening you up to a HUGE security hole. Don't know that that hole is?
Please be specific.
Exactly. With BitcoinNotify, the worst thing that can possibly happen to you is not receiving the notification...
This just proves that neither of you are considering ALL of the security issues. It's actually really hard to do. That's why you should just try to use the bitcoind system if you can. It's vetted, peer reviewed open source, and well understood by a large community who could help you if you have trouble.
Quote from: adamstgBit
to me the worst that can happen is BitcoinNotify goes down and the payment notification is only sent when they come back up?
Exactly. With BitcoinNotify, the worst thing that can possibly happen to you is not receiving the notification...
BitcoinNotify looks like an usable service.
Thanks for recognition.
Quote from: BioMike
https://walletbit.com (currently writing a PHP class for this one, but requires customer to be signed up with them as well)
and
http://www.bitcoinpayflow.com
and
http://www.bitcoinpayflow.com
The major difference is that BitcoinNotify does not store your coins.
Payments go directly from a customer to your private wallet (possibly disconnected from the network).
On the contrary, BitcoinPayflow and WalletBit are very nicely designed but you need to trust in the perfect security of these services, as the wallets are being kept online.
This is the best solution!
it works so well and so simple to use, i was able to sign up and use there test notification in minutes
and it seems to me a very secure, no need to trust anyone!
wow
This is EXACTLY the kind of mistake I'm talking about. That service is not providing anything you can't easily do with a bitcoind. And it's opening you up to a HUGE security hole. Don't know that that hole is? Then that is exactly why you should not be using third party solutions. At least one security hole on this site is easy to identify, but that is not true of most 3rd party sites. You'll never know all the security liabilities. With bitcoind you know what you're getting into, and it just isn't that much harder to do a json request then to get a post notification from a 3rd party site.
Tell me why are you trying to avoid using the proper API? You just don't want to read the manual? Reading the manual and learning how bitcoin works is a small price to pay for the security and reliability it can offer if used properly.
what is the security hole?
to me the worst that can happen is BitcoinNotify goes down and the payment notification is only sent when they come back up?
BitcoinNotify looks like an usable service. 2 Others:
https://walletbit.com (currently writing a PHP class for this one, but requires customer to be signed up with them as well)
and
http://www.bitcoinpayflow.com
https://walletbit.com (currently writing a PHP class for this one, but requires customer to be signed up with them as well)
and
http://www.bitcoinpayflow.com
This is EXACTLY the kind of mistake I'm talking about. That service is not providing anything you can't easily do with a bitcoind.
With BitcoinNotify.com:
- you don't need to run a bitcoind daemon on your server
- you don't need to integrate custom JSON/RPC API
- you don't need to keep your wallet online
- you simply handle HTTP requests with purchase notifications
This is a major difference in the ease of payment integration.
Quote from: MrJoshua
And it's opening you up to a HUGE security hole. Don't know that that hole is?
Please be specific.
I suppose you don't have a full understanding of how the service works.
I'll be happy to explain.
Please understand BitcoinNotify is NOT a payment proxy. We never have coins. Payments go directly to the Merchant.
(edited)
This is the best solution!
it works so well and so simple to use, i was able to sign up and use there test notification in minutes
and it seems to me a very secure, no need to trust anyone!
wow
This is EXACTLY the kind of mistake I'm talking about. That service is not providing anything you can't easily do with a bitcoind. And it's opening you up to a HUGE security hole. Don't know that that hole is? Then that is exactly why you should not be using third party solutions. At least one security hole on this site is easy to identify, but that is not true of most 3rd party sites. You'll never know all the security liabilities. With bitcoind you know what you're getting into, and it just isn't that much harder to do a json request then to get a post notification from a 3rd party site.
Tell me why are you trying to avoid using the proper API? You just don't want to read the manual? Reading the manual and learning how bitcoin works is a small price to pay for the security and reliability it can offer if used properly.
Accepting Bitcoin payments is as easy as handling HTTP requests: https://bitcoinnotify.com/accept-bitcoin-payments
Bitcoins go directly from a customer to your private wallet - no need to trust anyone, no risk of loosing Bitcoins (contrary to i.e. MyBitcoin).
Feel free to PM or e-mail me if you need any help.
PS. Invitation code: HoAR86OQXS
Bitcoins go directly from a customer to your private wallet - no need to trust anyone, no risk of loosing Bitcoins (contrary to i.e. MyBitcoin).
Feel free to PM or e-mail me if you need any help.
PS. Invitation code: HoAR86OQXS
This is the best solution!
it works so well and so simple to use, i was able to sign up and use there test notification in minutes
and it seems to me a very secure, no need to trust anyone!
wow
If you mean how do you implement shopping cards and such with bitcoins, then you're looking for the json interface to bitcoind
I would strongly discourage this approach. It requires the online store to keep the wallet online, which is extremely hard to secure properly. It also requires setting up bitcoind daemon and custom JSON/RPC integration, which is not trivial for most Merchants. It's far better to use one of existing merchants solutions.
Well unfortunately you are a bit biased. After recent events the reliability of third parties to manage bitcoins must always be considered lower then managing your own wallets and security. The entire point of bitcoin is to eliminate the need for third parties, that's a security feature you should not attempt to circumvent unless you thoroughly understand and can tolerate the risks involved.
Also, in point of fact. You do not need to keep a wallet that contains coins in it on the server if you are only receiving payments. You can pre-generate a number of bitcoin addresses on a secure client and load them into a database table on your site. Even if you do use a normal server side bitcoind you can also keep a local copy of the same wallet, so that you can regularly sweep money to your trading account of offline savings wallet.
How about this? PowerPoint presentation of a concept I have for Safebit and online payment.
I can assure you that the pptx is malware/spyware/virus/trojan free, but I would appreciate it if omeone other than me could scan the PowerPoint to verify that it's not stealing anyone's walletz
It basically goes like this:
Find a bitcoin://vendor.name/price/details/PGPSignature link, click on it, and this pops up in the app:
Click confirm payment and this pops to verify that you really want to send the coins to their destination:
I can assure you that the pptx is malware/spyware/virus/trojan free, but I would appreciate it if omeone other than me could scan the PowerPoint to verify that it's not stealing anyone's walletz
It basically goes like this:
Find a bitcoin://vendor.name/price/details/PGPSignature link, click on it, and this pops up in the app:
Click confirm payment and this pops to verify that you really want to send the coins to their destination:
If you mean how do you implement shopping cards and such with bitcoins, then you're looking for the json interface to bitcoind
I would strongly discourage this approach. It requires the online store to keep the wallet online, which is extremely hard to secure properly. It also requires setting up bitcoind daemon and custom JSON/RPC integration, which is not trivial for most Merchants. It's far better to use one of existing merchants solutions.
If you mean how do you implement shopping carts and such with bitcoins? Then you're looking for the json interface to bitcoind:
https://en.bitcoin.it/wiki/API_reference_(JSON-RPC)
Note the link may not work, so cut and paste.
https://en.bitcoin.it/wiki/API_reference_(JSON-RPC)
Note the link may not work, so cut and paste.
Jump to: