Quote from: Herodes on April 09, 2013, 09:44:59 PM

Read my post earlier in the thread, it's quite possible to handle claims (at least some of them) on an ongoing basis.

I assume you mean either this:

Quote from: Herodes on April 09, 2013, 03:30:41 PM

10. Your stated claims process on the Instawallets site states: If several claims have been filed for the same url, we will process those claims on a case by case basis, under the presumption that the claim we received first belongs to the legitimate balance holder.. Please will you describe the logic of that? If a hacker has the URLs then surely he can file a claim as quickly as any legitimate account holder? And if youre assuming that the first claim is likely to be the more legitimate one then why wait 90 days? Your logical methodology makes little sense and I would appreciate clarification.

11. You also state that Claims for wallets that hold a balance greater than 50 BTC will be processed on a case by case and best efforts basis. Please clarify why the arbitrary figure of 50 BTC has been chosen. This comment suggests that you have lost a certain number of coins and need to limit your total payout to what you have left. Please confirm if this is how it is, or if there is another reason for this figure?

or this:

Quote from: Herodes on April 08, 2013, 02:10:08 AM

The 90 day claim process is highly questionable, and it's a typical scammer way of evading and delaying the process. After 90 days, people will have 'forgotten', many give up, because they only have small amounts and so on... Lot's of accounts (read: unique urls) should be possible to verify beyond doubt given pieces of information, and should be handled manually on an ongoing basis, then those remaining in an uncertain state should be held until the 90 days are up, and then be released to the person claiming it. To avoid having to pay out to some hacker who've submitted multiple claims, some verification would be possible to do, to ensure multiple claims does not go to the same person. (I know some may have more instawallets, but it's a difference in having 2-3 and having 45...)

There are many pieces of info that could be used to determine whether it's a legitimate claim or not, and these could be handled on an ongoing basis.

For instance a user could be using the same ip for most of his access to instawallet, and he might even be able to remember transactions in or out of instawallet, and he may even have access to adresses from which he previously have sent coins, and can prove he control these, perhaps he even have screenshots from an exchange showing withdrawals to his adress, or have transaction history in a local wallet.

Also, it depends on how much information the hacker got from the database. How much does he know about the users, and how easy would it be to fake a claim ? That's rather important information needed to determine the course of action.

Neither of these quotes have logic I find all that convincing. The one point I'll grant you is that instawallet will no doubt make money off of this, whether or not it's a scam, because of the number of people that will have forgotten after 90 days.

However, that doesn't mean that, assuming it isn't a scam, they shouldn't exercise this level of security anyway. Maybe they should be more lax on wallets under .25 BTC in balance, but they've arbitrarily decided on two divisions instead of three, one below 50 BTC and one above 50 BTC.

All of the methods of determining wallets that you speak of are things I'm sure they'll do, if more than one claim is filed or if the wallet has a balance of 50 BTC or more.

Quote from: Herodes on April 08, 2013, 02:10:08 AM

it depends on how much information the hacker got from the database. How much does he know about the users, and how easy would it be to fake a claim ? That's rather important information needed to determine the course of action."

Yes, and it's also something that shouldn't be publicized, in the interest of reducing the number of false claims.

On a final note, it's preferable that bitinstant wouldn't have to process the claims at all, and could just return them immediately. Of course, this is an impossible ideal. There are a lot of wallets, and a claims process isn't something very easy to automate, and the number of wallets mean that it would take potentially, probably, far more than 90 days for them to process all the claims manually.

The 90 day wait is an easy way to verify, with zero human work, the majority of the claimed wallets, of which there will presumably be many. If they were to try and do them all case-by-case as you suggest, in the interest of not having to wait 90 days, there would be a backup and the majority of users would most likely have to wait longer than 90 days, in the end. The 90 day wait comes closest to that impossible ideal.

Edit: Actually, the "forgetting after 90 days" problem depends on how they implement the claims system. If you could just give them an address at the very beginning of the claims process to send the funds to if there are no other claims, then forget about it, then that problem would be abolished more or less.