(Individual ACH charges may, with some effort, be reversible like a credit card charge, but invalid reversible credit card charges are pretty much all you have to worry about with a stolen credit card, and not all you have to worry about with a stolen bank account).
Full disclosure: I run http://howdoyoubuybitcoins.com/ and my wife's cupcake bakery, cupsandcakesbakery.com sells cupcakes for bitcoins in San Francisco (9th/harrison)
As far as I can remember, PayPal has never asked me for my bank account login details.
http://www.ecommercebytes.com/C/abblog/blog.pl?/pl/2009/2/12...
PS: That or that blog's part of a great phishing scam.
That has not been my experience; the 2 random deposits are the first option, not the last resort. Paypal has never asked me for a user/pass.
Since there is clearly a demand for buying bitcoins _quickly_, I believe Brian is providing both a good UX for those who want to just use their account / routing numbers, while also allowing people to get bitcoins in LESS THAN 10 MINUTES (I bought 1BTC today with coinbase / wells fargo).
I should note that Mint did the same thing in order to get access to transaction history, and they had 5 million registered users as of 2011 (source: http://qr.ae/8QB9G).
If the big banks addressed the need for APIs, startups like Mint and Coinbase could do this in a more sane way, but we're talking about big banks, and in the case of Wells Fargo they actually charge users a monthly fee for using Quicken to talk to their backend.
tl;dr- Mint asked users for bank passwords and got 5 million registrations. Likewise, Coinbase is just providing a "quick" ux path for the people who want to act quickly.
I'm not trying to militate against using Coinbase; I'm just saying, Coinbase and Mint aren't directly comparable for more than one reason.
A Hackersafe pen test is not a security audit. A public company SEC-required annual audit is not a security audit either.
There is no audit if there is no public audit statement from the auditor. Without one, whatever security measures were taken cannot be called an audit.
Perhaps some reporters (like the ones that reported on the WMD-based justification for going to war against Iraq) didn't do their jobs properly.
I trust my banks with all my money. That doesn't mean it's safe to trust any company with my money, simply because banks manage to do it. I don't trust arbitrary banks, either.
I do think that a lot of Hacker News contributors have blinders on, wherein they devalue the work a big, established service has done, and compare smaller, less-established companies favorably to the same, because they have this narrative of young, smart developers "disrupting" old and established businesses. Its useful to remember that sometimes those big, old businesses are not actually brittle and incompetent, and may actually know more than you think. Don't fall into Dunning-Kruger.
(honestly would like to know)
In practice, the ACH system relies on fraud detection & prosecution rather than secrecy.