Quote from: bracek on June 04, 2012, 08:53:56 PM

Quote from: TangibleCryptography on June 04, 2012, 08:37:00 PM

Quote from: bracek on June 04, 2012, 08:26:13 PM

if incoming money is automatically registered to users playmoney account, then only one receiving address would be enough, as long as it i added to the right user

how would that be done ?

It can't be done. You would have one 1 address per user at a minimum. You likely would want to have multiple addresses per user so they can gain some psuedo anonymity.

what about
bitcoin client feature for proving the address ownership ?

user sends btc to cold storage
then logs in to my service
copy/pastes his signature to his account requesting funds to be added
then my side checks the blockchain, and if signature is valid, amount is written to users account balance

would this work ?

In theory but in reality it is going to turn into a giant cluster fuck.

1) The default client doesn't allow you to control which address you send funds FROM.
2) User tx may involve unspent outputs from multiple addresses.
3) Shared wallet services (like yours

) don't allow a mechanism for send to "prove funds".
4) User's subsequent re-deposits may involve different addresses or even wallets.

Between those caveats some % of deposits will be irreconcilable. If you get big enough that is going to start happening multiple times per day. Those users will call you a scammer and thief, even as your work hard to resolve the issues. Some may simply claim to have made a deposit they didn't in hopes to scam funds or cause grief. Add to user confusion on the deposit amount (user says he made deposit 1268.878 but it was 1268.787, or amount he is thinking is before fee, etc) and you have a giant mess which kinda defeats the whole point of automated deposits.

Given the solution is insanely simply why put yourself through all that?

1) Generate a thousand private and public keys.
2) Put the public keys ONLY in a database on server and assign them to user accounts.
3) Allow user to display their current deposit address.
4) Optional allow user to add a new deposit address (just assigned the next unassigned address)
5) Import the private keys to an offline wallet of your choice.

Nothing on the server to steal, and no risk of mixing up funds. Too easy right?