Quote from: BitcoinNotify.com on August 07, 2011, 11:25:27 AM

Quote from: MrJoshua on August 07, 2011, 11:15:13 AM

This is EXACTLY the kind of mistake I'm talking about. That service is not providing anything you can't easily do with a bitcoind.

With BitcoinNotify.com you don't need to keep your wallet online. This is a major difference. Securing online wallet properly is extremely hard.

bitcoind can monitor the blockchain without access to your receiving wallet just as easily as a third party service.

Quote from: BitcoinNotify.com on August 07, 2011, 11:25:27 AM

Quote from: MrJoshua

And it's opening you up to a HUGE security hole. Don't know that that hole is?

Please be specific.

Quote

You can expect Bitcoin payment notification in seconds after your customer clicks "Send" button in his Bitcoin client. While technically the transaction is not confirmed by the Bitcoin network, for most purposes it is practical to consider it so. Support for "confirmed" transactions is being developed for those cases when you need to be 100% sure (and do accept delays).

Do you see it now?

Considering how many people trusted mybitcoin, and a startling willingness to abandon a key security feature of bitcoin I think it's important that everyone understand that security is a multifaceted problem. You need to be very conscious when you are explicitly or implicitly trusting a 3rd party. Bitcoin as a system is well designed, but you eliminate the value of that design if you start working around it buy using online wallets, merchant services etc.

I'm not saying you can't use those things. But why use them if the built in tools do almost exactly the same thing more securely? If you understand how to use bitcoin, and you have a specific need for a 3rd party service, then you should also understand as well as possible what risk you are absorbing. A LOT of people on this list lost money because they failed to notice when that where circumventing their own security.

Understand first. Trust second.

j

P.S. Note that I'm not saying this service is bad. If you know a site is bad security questions are easy to answer. I'm simply rebutting the assertion above that it is better to trust a 3rd party then the bitcoind and API.

P.P.S:

Quote from: BitcoinNotify.com on August 07, 2011, 11:46:38 AM

Exactly. With BitcoinNotify, the worst thing that can possibly happen to you is not receiving the notification...

This just proves that neither of you are considering ALL of the security issues. It's actually really hard to do. That's why you should just try to use the bitcoind system if you can. It's vetted, peer reviewed open source, and well understood by a large community who could help you if you have trouble.