Quote from: zefir on July 23, 2013, 08:06:20 AM

Quote from: iikun on July 23, 2013, 04:25:07 AM

Quote from: hchc on July 23, 2013, 03:56:10 AM

Zefir and all chip buyers, please take note the way burnin is taking orders by your username and wallet (he abandon the message singing method...). These info are all out in the open so it poses risk for somebody to stole your chips (they paid for assembly with your chips buying info and have it ships to them...). I dunno how burnin will verify info with group buys organizer so you guys have to work it out to prevents against this...SebastianJu has the same concern afaik.

I know that's not really Zefir's responsibility, but could his chip addressing system be slightly modified so that we can also enter our personal shipping addresses there? (ie not just to what assembler we chose). If Burnin was then given access to that info it should be easy for him to then cross check that address is the same as entered on his site.

No, I can't take over accounting and responsibility for shipping data for all manufacturers. We have an agreement already which includes me sending pre-verified data (i.e. people signed with their payment addresses).

There are several layers of security included here: first, while most users' orders can be identified (due to their posting in the thread), it is not known where the chips are sent to. If someone would try to post false orders (pretending to be an other user with chips in order) three things can happen:
a) he orders at the wrong manufacturer,
b) he orders at the correct manufacturer, but the rightful owner does also, and
c) he orders at the correct manufacturer, while the rightful owner does not.

Case a) reveals him as scammer immediately, b) does the same after he can't prove his order (by signing), while the rightful owner can. The only critical path is c), but this would require that a user was going through the registration and claim process, delegate chips to a manufacturer but failed to place his order there. Given how unlikely this would be, plus the risks involved to scam this way (scammer has to pay manufacturing costs and provide some valid postal address), I personally won't expect too many attempts.

Yes, only point 3 is a threat and its not very likely. I only think a scammer with address in china and paying by paypal has no risk to fear at all. One would think that no buyer will abandon his chips and not order assembly but when i see how many billing addresses still are missing in my groupbuy i wonder what those buyers do.
On the other hand. Everyone that fears to be scammed only has to order the assembly before the chips arrive with burnin. Then he is safe. Of course only when you mark in your list when chips are wanted to be verified by burnin. I doubt that burnin would check for duplicate orders in his shop. Thats something the group buy organizers have to do.
Its only a risk that applies to lamers that dont order assembly before the chips arrive at burnin.