Quote from: jav on May 24, 2011, 01:19:07 PM

Quote from: jerfelix on May 23, 2011, 09:40:33 PM

@JAV, You may also have to worry about Toolbar programs (like Alexa toolbar, Ask toolbar, Bing tool bar, Yahoo Tool Bar, Google Toolbar, lots of Firefox plugins). I believe that some of these send URLs back to the "mother ship" to help with page rankings and site analytics.

Thx for the heads up, but how do you propose I should deal with them? It seems to me, that if people want to send their private data to a cloud service, it's up to them whether they trust that provider. I'm not the only service that uses secret URLs. You can, for example, create YouTube videos that can only be accessed through a private link. As far as I know, these services also don't deal specifically with toolbars. But I will mention it in the upcoming FAQ.

Yup. You are right - lots of people do it. I think a warning in your FAQ or terms and conditions is sufficient.

I think the difference is that you are dealing with money, while YouTube is just dealing with videos. (Not that personal videos can't be a lot more valuable than the 1 BTC that someone might have in their instawallet,...)

Although you are only dealing with small amounts of Bitcoins, I can imagine the temptation at one of the suppliers to be great, in that a rogue Google / Alexa / Yahoo employee can attack ALL of the tiny stored amounts, and potentially get a lot of cash. Or worse, maybe one of these sites publishes to the internet "Frequently accessed pages on the site instawallet.com" and lists a bunch of them. Then a random stranger on the internet could rob the bank of many pennies.

I think someone can use Yahoo API to find the 1000 most popular pages on a website, which might be exactly the hack needed.

I'm not saying you shouldn't go forward with the project. I love the idea. But it's something to think about. Maybe some security experts can give their opinion.

---

Here's another attack that may or may not be an issue. There's a tricky way for one site to access your browser history - specifically, it can see whether you have or have not visited a specific page. I don't THINK that will be a problem for you (as they'd have to guess the exact page), but it popped into my head as I was typing this. See http://infinity-infinity.com/2009/06/sniffing-browser-history-with-css/ which is the page that also mentioned that Yahoo API can give you the 1000 most popular pages on a site.

Anyway... as long as people treat it like "disposable money" to play with, then no biggie. But your site could lose credibility or you may need to shut down, if you get hacked in one of these fashions, so it's something to consider.

Hope I'm being helpful in pointing out things that you may figure out preventions for!