OVH has been compromised

Having a cloud-hosted front-end isn't a big deal. Having your BTC wallet on a system you do not have 100% physical control over is amateur hour.

A Raspberry Pi on a cable modem connection could be made more secure than whatever off-the-shelf hosting most of these companies are crazy enough to use.

Not going to happen at the price points people are accustomed to - they'll simply become professional-grade hosting environments, with a price tag to match. See Amazon's recent cloud HSM announcements - $5000 set-up fee before you get started. Then people will whine about how expensive it all is, and some bright spark will come up with ways to make it cheaper by compromising here and there, and we're back to square one.

Honestly, the high tech industries are shocking at learning from history - "Oh, those constraints from 10 years ago don't apply to us anymore, technology has moved on." Sure, but people haven't, and most of the real problems are sociological problems - fraud, greed, stupidity, stubbornness. Companies that deal with money or payment processing come up against this faster than ones that don't, and they adapt (see PayPal's anti-fraud department, so successful they spun off Palantir) or die (80% of all Bitcoin exchanges to date).

It won't be long now until we'll hear the first case where some employee of a third-rate exchange or something will wake up with a barrel of a gun pointed at him, forcing him to go to work and turn over all the float at his company or have his family killed. It's been done in the USA, and for much less than what these exchanges and mining pools routinely manage.

Banks have security against this sort of thing. They manage it by making actually keeping that money after obtaining it without getting caught really hard. I have no idea how it can be protected against when it's bitcoin.

The product I spend most of my time working on sells as a managed service to the investment/advice banks, and even though we only deal with the T&C side of things (no money, very little by way of client data (it should be zero client data really, but as names and other identifying info sometimes creep into file-check records and such they have to take precautions based on the service having more than just employee details within)) we have to keep with that sort of standard: ISO27001, everything dedicated including firewall boxes between "their" machines and us (& the rest of the DC, obviously), regular penetration tests, they even require background-checks and other vetting of our staff.

One of the other products worked on from here is used by the Met Police and several local councils. Even though it is only their procurement departments (bulk order of paperclips, ...) the hosting security standards are similar (in some ways more stringent).

> People need to start taking this stuff a little more seriously.

For bitcoin definitely. Companies like our clients already take it very seriously (the regulators would fine them heavily if they didn't, and if they didn't and information leaked out because they didn't the PR could be disastrous). What many of the individuals dabbling in bitcoin don't realise is that if they want a decentralised currency where no bank or government department has control, no bank or department can protect them so they need to make sure they provision sufficient security themselves which means properly vetting any suppliers or keeping the wallet in their own environments.

It surprises me that people running towards bitcoin because it is decentralised then immediately run to a centralised coin store to make life easier... They seem to want their cake and its icing without taking precautions to defend it from ants.

(OK, so many are running to it ATM because of the hype, rather than because of the decentralised nature, but they often claim otherwise)

Notice how all these leaks were not because of HTTP server security issues or the like, but because the critical parts of the application were not isolated.

No need to force obscure interfaces, just add an extra NIC and connect the critical part over Ethernet.

Just because they use a cheap trick to make the user feel more secure doesn't mean the system underneath it isn't, in fact, secure (it doesn't mean it is secure either, it says nothing one way or another).

I don't hear about big bank sites (even ones using psychological trickery on their users) getting cracked very often while bitcoin exchanges/wallet services/etc are falling over seemingly daily).

Then 3 months later, I found out they were still charging me. I forwarded them the conversation and they just kept responding with canned messages refusing to acknowledge the wrong on their part. It's a shame because they are by far the best value :-(

I accept that for managed servers they need to connect from outside to manage them, but how hard would it be to drop all traffic except for the IP range their management systems use?

People Coin is not only about mining but also about having a stake of the money supply. You could attack ppcoin by owning 51% of the currency supply, but by that time you're so invested you don't want to.