Introducing QuickCoin: Bitcoin Made Simple
quickcoin.co
quickcoin.co
Well I'm in then.
We haven't invented any cryptosystems. What we've built is on top of SSL, HMAC-SHA256 signed tokens and Bitcoin.
What is interesting and novel about our security is our use of brain wallets. The wallets are all literally client-side only. If a user adds a password then no one but them can get at their wallet. Of course, they are still susceptible to phishing, theft and other forms of social engineering, but those are all well outside of the realms of cryptography.
Other than that, what are you doing to increase trust within the bitcoin system? I have a few friends who work on Wall Street (investment bankers, account executives, etc) and they summarize money as this: "Money is an embodiment of trust. Clients transmit funds to me in amounts with 5 zeroes, or with 7 zeroes, but if they don't trust me they won't send me a single cent."
I think the focus on making bitcoin easy to use with a simpler interface is a side-step.
The client-side software is built on top of Helloblock.io and uses BitcoinJS-lib. All wallets and transactions originate on the client and never on our servers using the same mechanisms found in any other hierarchical deterministic brain wallet. So if you add a passphrase and then promptly forget it there's nothing we can do! This is both a feature and a bug and we are interested in exploring other mechanisms that keep our users in control of their funds while also being very easy and convenient to use. We don't want you to store your life savings in this wallet. Think of it like your real wallet. Just put enough for the day in there. There is a time and place for cold wallets and tight restrictions but that can be less convenient for day-to-day use.
When you first sign up your passphrase is supplied by our servers. This mechanism is similar to how most Bitcoin and Dogecoin tip bots work. It lets people send to a friend's address before they've signed up for the service. This has some dangers. If our servers are compromised these passphrases can be used to gain access to the wallets, but only if the users haven't gone through the "upgrade your security" process and created a new deterministic wallet. We are busy working on multi-factor authorizations based on multiple identity providers including SMS, Twitter, email and more. We think there are ways to keep users fully in control of their own funds, safe from attackers as well as being convenient. It is a tall order but we're ready to take on the challenge.
William Cotton - CTO QuickCoin
Your wallet is only associated with our services by signing and submitting a token that proves it owns the associated public address.
We are exploring ways where any Bitcoin private keys can sign their own token and register with our infrastructure. This process would require the cooperation of other wallet software creators but we're sure a standard will emerge at some point.
We would like to have some form of two-factor authorization in place before we expose the private keys to the user interface. Right now the private key never leaves the warm embrace of a function closure inside of a web worker and well out of the global scope of the DOM.
There must be some, given all the trackable-as-dollars implementations I've seen lately, like the Bitcoin debit card and this, which is actually less anonymous than dollars (since you're sending under an account that has your real name per the Facebook TOS).
From my naive standpoint, it seems like you're exposing yourself to a lot of value volatility and to a relatively complex and uncommon processing system. Why not just use PayPal, Stripe, whatever?
Not to mention the fact that no third party can be compelled to freeze your account or manipulate it in any way.
Of course all of that falls apart if you trust a third party.
If you knowingly give your details over to a phishing attempt, then yes, you bear the loss. Otherwise, any loss of monies from your bank account through hacking or identity fraud will be borne by your bank. Granted, it would still be a hassle, but I am not really at risk if a website which has my details gets hacked and my CC number gets stolen.
Hopefully. Sure in an ideal world, you get your money back. But the real world sucks. And if you do get the money back then you have to get a new CC and go through that whole process.
Bitcoins also means that to spend online you don't have to give someone total control of your funds. My chase checkings account was put on hold and my card cancelled when I bought Bitcoins from a friend using Chase Quickpay. I had to meet with someone, in person, and get an entirely new card. Just because Chase didn't like the way I had spent my money. No one had attempted a refund, or complained. Chase just noticed the email was associated with lots of Bitcoin sales and closed my account without informing me. With Bitcoins you don't need to give a 3rd party that much power just to be able to spend money online.
Imagine that I am traveling abroad and only have one bank, if someone broke into my house and found my routing and account number then I would have to get new ones. As I am traveling abroad I will have to continutally have access to money to simply have a place to stay. Suddenly something that you are saying isn't a risk to me is really fucking up my trip and even has the potential to have me sleeping on the street.
Bitcoin provides a different way to deal with the risk, it lets you control almost all of the risk personally, of course this means that if someone does steal your bitcoins from you, you are fucked. No third party to protect you, but also no third party to mess you up.
They serve different purposes.
The risk of creating new products is great enough as it is. The added risk of building certain kinds of social financial products on top of existing payment methods and currencies doesn't make it worthwhile.
By building on top of Bitcoin we're able to offload an incredible amount of risk. The very nature of Bitcoin protects against double-spending and other kinds of fraud that keep PayPal and MasterCard so busy all of the time. At the same time, building software that relies on those companies is almost lunacy due to the fees and regulations. You've got to applaud what a company like Venmo can achieve with these sorts of limitations and roadblocks.
In a matter of weeks we were able to make something similar in scope to what would have taken substantial effort on the part of a company trying to do it without a cryptocurrency network.
We're very happy with the results of our first experiment as it seems to have created immediate value for people.
We're going to experiment with a number of concepts related to how people interact in a financial manner that build on the engagement that we're already seeing. Stay tuned, we're moving very quickly, and we'd rather give you something than promise you something.
We are not expecting people to keep any more in their wallets than they would with their real wallets.
Currently we recommend cold-storage for long term savings. We think there is a lot of middle ground for exploring different kinds of security and access privileges and how that affects the liquidity of your bitcoin.
Also, the fact of the matter is that this is subject to the problem that every person everywhere can secretly try to attack every wallet everywhere. One person getting their (physical) wallet stolen when they go out is upsetting for that person, but if someone figured out a way to steal 30% of all peoples' physical wallets at once, you can imagine that would be seen as a catastrophe, which is exactly what you're looking at given the monocultural nature of software. Maybe it wouldn't be a problem for someone who knows the risk and knows what they are doing, but those people don't need the convenience this app purports to offer anyway. Best of luck, I hope I'm wrong.
Start with firing the person who came up with this ingenius marketing pitch and try again.
I'd love for you to try out and compare QuickCoin to CoinBase and Blockchain.info and let us know if we came anywhere near are goals.
We're bootstrapped and have been in development for only about 10 weeks. I'm sure we have a long way to go.
I'm counting on the community here at Hacker News for some feedback so we can make the product and business better!
Any and all identity/authentication providers are being discussed, including SMS, Email, TOPT clients like Google Authenticator, and OAuth from any provider. We are also discussing alternate blockchains.
We cannot promise anything at this time as our strategies as a company may change but I will say that we could very easily change a few settings to support these other identities and blockchains.
This is built on the one-and-only Bitcoin blockchain network. This is not it's own independent blockchain.
You can send to your QuickCoin wallet from any other Bitcoin wallet.