Slashdot Mirror

On my ranking site (Gibson Index), I rated this a Level Three Attack, but I think the submitter is wrong to say there was poor security. By all accounts, if they were any less secure, they would have lost tens of thousands more. It just happened that *one* of their exchange accounts did not have 2FA, because they weren't aware that that vendor had added support for it.

BitInstant's full blog post has more details: http://blog.bitinstant.com/blog/2013/3/4/events-of-friday-bitinstant-back-online.html

It is actually quite hard to obtain bitcoins anonymously.

The days of CPU-based mining are long over, and even the current "economy" of multi-GPU-based mining rigs is about to be eclipsed by the ASIC-based devices coming online this year.

There are effectively no services that will take anonymous payment for bitcoins. Paying via bank account ACH or check is certainly not anonymous, and the same goes for credit/debit card payment. Furthermore, any credit/debit based payment is potentially reversible via chargebacks, etc, so most places don't take that kind of payment due to the fact that bitcoin transfers are irreversible.

Services like Bitinstant claim to take cash for bitcoins, but what that really means is that they require payment via MoneyGram, which requires you to present government-issued ID when sending payment. This is linked to the Bitinstant anti-money laundering policy, which requires your real name, etc. Dwolla wants a name, SSN, government ID, etc, to setup an account. As for Mt. Gox? Heh, they require everything but a DNA sample in order to use the exchange. Any service registered as a "money services business" in FinCEN will have these kinds of restrictions.

Obtaining bitcoins locally requires finding someone offering them for sale, negotiating price each time, and likely a face-to-face meeting to hand over cash. If one is really patient and trusting, a deal might be able to be struck for sending cash in an envelope. However, the bitcoin market is extremely volatile, which tends to undermine these types of deals.

Anyway, this ATM seems very convenient and anonymous; ergo, it likely will fall afoul of the anti-money laundering laws in one way or another.

http://blog.bitinstant.com/blog/2012/8/22/public-statement-regarding-the-bitinstant-paycard.html "BitInstant’s partners, who are issuing the card, have been working with MasterCard for many years, and the specific relationship will be between these partners and MasterCard (not directly between MasterCard and BitInstant)."

(Who's "Bitcoin"?)

http://blog.bitinstant.com/blog/2012/8/22/public-statement-regarding-the-bitinstant-paycard.html

From their FAQ:

What's with these transaction limits? You may have noticed our service limits transactions: each transaction has a dynamic limit calculated by our model but the limit will never exceed a 3 digit number (that is, the highest limit that will ever be possible per transaction for our service will be precisely 999). On top of this, we limit overall amount per-user within any single trading period to far below regulatory requirements - although we no doubt are turning away some users who are disappointed by this policy, it is in everyone's interest to maintain it. If we allowed every user to transfer as much as they wanted it would cause several problems - first, it'd open us to unlimited risk if fraudulent transactions...

If your transaction system is sufficiently insecure that your only solution to fraud and money laundering is to block transactions over a certain size, you fail. We're all dying to move away from that ridiculous idea that visa/mc/banks are currently using, because it is fundamentally broken. Who are you to tell people not to buy cars, home repairs, startup business equipment, etc...