New Bitcoin Exchange (mtgox.com) - page 6.

SmokeTooMuch

legendary

Activity: 860

Merit: 1021

Quote from: mtgox on July 17, 2010, 10:51:32 PM

SmokeTooMuch: Almost all sites do it this way. Are you worried that I personally will learn your password? You can just set your "password" to be the hash of your password if you are really worried.
(or use a different one for mtgox)

this won't prevent you from stealing your users cash and btc. pls correct me if i'm wrong.

and i say it again, i want you to delete my account and all associated data.

maybe i will re-register later, but for now i decided to not using your service.

sry for making you such a hard start into business, but it's 5 am here and i'm a bit stressed out.
will go to sleep now.

EDIT 2014-02-27:
See this post https://bitcointalksearch.org/topic/m.3876

Babylon

hero member

Activity: 938

Merit: 500

CryptoTalk.Org - Get Paid for every Post!

Quote from: mtgox on July 17, 2010, 10:53:07 PM

> Why would I use Mt. Gox instead of BitCoin Market?

It is always online, the site is faster and I think the interface is nicer.

Also because, at the moment, bitcoins are cheaper on MTgox, although I am not sure if there are any actually available since with a higher bid than sell transactions should be being resolved.

mtgox

full member

Activity: 185

Merit: 102

> Why would I use Mt. Gox instead of BitCoin Market?

It is always online, automated, the site is faster and on dedicated hosting and I think the interface is nicer.

mtgox

full member

Activity: 185

Merit: 102

SmokeTooMuch: Almost all sites do it this way. Are you worried that I personally will learn your password? You can just set your "password" to be the hash of your password if you are really worried.
(or use a different one for mtgox)

SmokeTooMuch

legendary

Activity: 860

Merit: 1021

~~you could buy BTC cheap at one of them and sell them fore more at the other exchange service (if the exchange rates fit in that pattern)~~

EDIT 2014-02-27:
See this post https://bitcointalksearch.org/topic/m.3876

theymos

administrator

Activity: 5166

Merit: 12850

Why would I use Mt. Gox instead of BitCoin Market?

SmokeTooMuch

legendary

Activity: 860

Merit: 1021

so how does it work ?

password --->encryption (ssl) ---> your site/server && decryption ---> hashing ---> saving/checking hash in db ?

as long as you receive the password unencrypted, it's just not an option for me

EDIT 2014-02-27:
See this post https://bitcointalksearch.org/topic/m.3876

PulsedMedia

sr. member

Activity: 402

Merit: 250

Quote from: SmokeTooMuch on July 17, 2010, 10:32:53 PM

You can't use unhashed passwords at a site, that deals with money. That's just one big mistake you just can't make if you want to make such a thing. What if someone hacks your database ? He could steal the money and BTC funded in all your users accounts.

That the variable coming to server is unhashed does not say that the DB uses unhashed pws.

The password is practically always transmitted cleartext to the server, within SSL session most of the time however, on crucial things. But it does not tell is it hashed in the database or not.

The thing about if the encryption is clientside, it's trivial for any hacker to hack as the algo can be trivially disassembled and disseminated.

It's a very bad idea to transmit the password in GET variable tho.

mtgox

full member

Activity: 185

Merit: 102

Don't worry the passwords are hashed in the DB.

SmokeTooMuch

legendary

Activity: 860

Merit: 1021

You can't use unhashed passwords at a site, that deals with money. That's just one big mistake you just can't make if you want to make such a thing. What if someone hacks your database ? He could steal the money and BTC funded in all your users accounts.

Quote from: mtgox on July 17, 2010, 10:31:00 PM

SmokeTooMuch: It is a post over https. It is secure. I'll PM you about the login issue if that is ok.

~~maybe the transmission is secured, but what's with your database ? Since you don't transmit hashes I guess the passwords get stored in clear text.~~

EDIT 2014-02-27:
See this post https://bitcointalksearch.org/topic/m.3876

mtgox

full member

Activity: 185

Merit: 102

SmokeTooMuch: It is a post over https. It is secure. I'll PM you about the login issue if that is ok.

PulsedMedia: The spread is 2%. Is that too high? I think you are just looking at the difference in what two people are offering. That isn't what you should look at.

PulsedMedia

sr. member

Activity: 402

Merit: 250

Quote from: SmokeTooMuch on July 17, 2010, 10:22:39 PM

https://mtgox.com/users/login?username=SmokeTooMuch&password=XXXXXXX

what the fuck!?! use hashes for transmitting and saving passwords!!!!

and btw, I cant log in

sorry to say that, but until now your exchange service is just a password-ripoff service ....

Well atleast POST and not GET. (Btw, 99.9% of web services transmit password from user browser to the server clear text, no JS hashing or something before transmit)

And another thing: The spread is insane. Insanely expensive to buy BC and selling BC mediocre rate for today.

SmokeTooMuch

legendary

Activity: 860

Merit: 1021

https://mtgox.com/users/login?username=SmokeTooMuch&password=XXXXXXX

what the fuck!?! use hashes for transmitting and saving passwords!!!!

and btw, I cant log in

sorry to say that, but until now your exchange service is just a password-ripoff service ....

BTW: I want you to delete my account and all associated info (like my password, dude!)

I will re-register when you fixed that password thing ...

EDIT 2004-02-27:
Since this post has gotten some attention from reddit I feel I should clarify a few things.
At the time of posting this I had a very naive perception of IT security. It is perfectly normal for sites to receive their users passwords in cleartext and hashing them after (server-side).
I've since learned a lot about IT security and want to apologize for the inconvenience I brought upon the servie back then.
The real problem was not the un-hashed transfer, but the transfer via GET (readable in URL) as opposed to POST (non-readable in URL), so the only attack vector was an "over the shoulder attack".

mtgox

full member

Activity: 185

Merit: 102

I should add this to the site but...
that ticker is:
Last Price: (The price of the last successful trade)
High: (the highest price in the last 24 hours)
Low: (the lowest price in the last 24 hours)
Volume: (the total amount traded in the last 24 hours)

Current Lowest Buy Price (This is the lowest buy price currently offered by another user)
Current Highest Sell Price (This is the highest sell price currently offered by another user)

All trades are between users. So the current buy price and current low price is just what someone else entered. You can always enter a lower or higher one.

Babylon

hero member

Activity: 938

Merit: 500

CryptoTalk.Org - Get Paid for every Post!

Quote from: mtgox on July 17, 2010, 09:57:19 PM

Hi Everyone,
I just put up a new bitcoin exchange.
Please let me know what you think.
https://mtgox.com

Your trade mechanism seems to favor those buying bitcoins at the expense of those selling. I am not certain but I believe that bitcoin market take the average between the high bid and the low ask while you set the price at the low ask. This is not necessarially a bad thing, but I did want to point it out.

mtgox

full member

Activity: 185

Merit: 102

Hi Everyone,
I just put up a new bitcoin exchange.
Please let me know what you think.
https://mtgox.com

Topic: New Bitcoin Exchange (mtgox.com) - page 6. (Read 38405 times)