hmm, used to keep some coins there, i am glad i dont keep coins there anymore, intersango is the best.
While I have heard this many times, and have used Intersango, and understand that they have the respect of well respected members of the community, I have serious concern about
- 1) their repeated discovery of other exchanges security flaws
combined with
- 2) the manner in which they bring this (apparently) to the
public attention
before alerting
their competitor that they have been engaged in #1.
This is one of the first things I saw online about Intersango (in fact it was BTC-e's response to the blog post about their security flaw they sounded
pissed). I have seen this at least one other time, very recently.
While this may be completely benevolent, and performed as a service to the community, it raises some red flags. Are they trying to discredit competition? Are they trying to break in? If so, why, and would my information be safe with them?
These are the types of questions that one must ask when one competitor repeatedly discovers security flaws in others. Each repetition makes the behavior more suspect.
As I would like to have an additional exchange that I truly trust, and as there seems to be some relationship (at least in overlapping people) with the GLBSE, I would like to find out the whole story here, so that I might be able to trust Intersango. (because, despite the above, they still seem to have the best rep here!)
Most of the things we've discovered we haven't brought to the public's attention. We have become known to be able to investigate and resolve manners much more reliably and have been paid to do penetration tests for other bitcoin exchanges.
For mtgox there were people for over a week specifically complaining that their account was hacked into. After less than 40 seconds of investigating MtGox's security, Patrick Strateman was able to verify a security flaw. We spent hours trying to contact Mark however knowing it might be a week before MtGox replied and that they could potentially have been losing 10s of thousands per hour we made an alert. This almost certainly sparked the price drop exclusive to mtgox as the person exploiting mtgox realized now he or she only had a limited time to deplete as much as they could instead of staying under the radar. We could not have known that there was another mtgox security flaw aside from the CSRF flaw which allowed someone root access.
To this day users like our friend who had their accounts hacked into with the CSRF have not been paid.
In the case of BTC-e someone specifically asked us to check a potential vulnerability. We did attempt to contact BTC-e (just like with mtgox). After being unsuccessful we reported the issue. The person who asked us to investigate was doing so because they had heard from someone else that there was a problem meaning that knowledge of a potential problem was at least wide spread.
We keep security vulnerabilities private unless we feel it is unethical to do so. One exception is when keeping it secret is completely useless as it is already public to the extent that it is likely either already being exploited or someone is actively working on exploiting it.
It is wasn't for Patrick Stratemen alone the value of a Bitcoin would, in my opinion, be at most $2.