The coin, not the broadcast, genius.

Some, yes. All, no.  This dev has already been forthcoming with own his name and made various claims about the people involved and the financing of this project.  Google search turned up blank for the 21 names that were published on the website, hence seeking further validation. 

How about yourself? You appear to be using your real name. Do you have Linkedin?

You already said that you did not develop website or the coin.

Svonione, in answering your earlier question ONE PHONE ONE ACCOUNT, NO EXCEPTIONS. If someone games the system,  you BURN his coins. It is very simple,  really:either he bought them (and you know it) or he got them gaming the system.  You burn them -and the coins- and make the game FAIR. why does this have to be "like" anything? It isn't even crypto -which you continue calling it quite wrongly- but it easily can be fair because you can make it fair so no one not even you get more than 7 coins a day. Someone got more and did not buy them? Take them away and burn them. That simple.

Right now, you can't use one account on mutliple phones.
But you can have different accounts on different phones.
10 accounts on 10 phones works, but 1 account on more than 1 phone doesn't work

its not cool what you did, i just looked to make some fast profit on this coin

What stops people from having 50 mining rigs that mine BTC? Is that unfair to the community? The man has 50 phones and gives all of them enough energy to mine as much as he is mining. How is that unfair? Cryptos are all unfair. There are people with resources to mine more than others. That's just the way it is. There are a lot of users in this community that have a lot more coins than even us, the dev team.

The whole point is to have people compete for their coins. Let's all complain about that guy that runs 30km a day and mines more than us who sit around all day. Take BTC for example. Let's all complain about that guy that has a 10k$ mining rig and mines more than me with a 200$ system.

Hey everybody,

We can't force people not to use multiple phones.
We've asked the person that has those multiple phones, and he gave permission to tell you guys that he has a phone store, and he installed MangoCoinz on a bunch of phones.
He provided us with images, and we looked at them and we saw MangoCoinz running on multiple phones with legit usernames (no PhotoShop).

We don't want to scam anybody, we just wan't to make something cool that everybody can use and benefit from.
So please have some understanding that this is still Beta and please have some patience for future improved versions of MangoCoinz.

Best regards, Srele from MangoCoinz.

Hey blackwat3r,

feel free to take as many looks as you like We appreciate if you inform us of what you find.

In regards to the recent hack this is what I remember seeing posted from the DEV

Hey everybody,

We've just published MangoCoinz v0.5.2 and it will be available to update in a few hours.
This is a security update, and updating from v0.5.1 will not result in coin loss.

A short time after the update is available, it will be the only version able to interact with the system.

Best regards, Srele from MangoCoinz.

Notice that he says "A short time after the update is available, it will be the only version able to interact with the system."

Meaning that when I explained about how you could earn heaps of MangoCoinz on the older app versions and then when choosing to you can update to the latest version and sync it up with no limit or a very high sync limit for 1 day since those coins were earn't on different kinds of settings.

I was told this is not possible by the DEV yet he has said in the latest release "A short time after the update is available, it will be the only version able to interact with the system"

I think we have a bit of a hiccup here.

- If I may ask, how is proof implemented?
- Just updated and saw that. This authentication still can be implemented in a bot.
- I'm not concerned about manufacturer and device name, it can be even used as useful statistics, but please hash the IMEI in the next update. You have no need to store the IMEI number of all registered devices.
- This will only get effective if you migrate to trusted certificate. Also, this doesn't guarantee you don't store passwords in plaintext anymore.
- Same as above. Because of the centralized nature, users can't know for sure it isn't that way.


What would anyone do with the salt? You'd still need the password to successfully create the matching hash. Now this isn't needed anymore. Your password is sent plaintext to the server. Yeah, it's HTTPS, but self-signed as of now so it really is plaintext as a matter of fact.
Regarding "one could easily do from the browser" and "nothing but a single http request": I personally don't feel it simple doing a POST request from a browser.

I don't know if it would be better to open-source the whole project, release the blockchain and stuff, because it's also a point that scamcoin makers would saturate the market with this kinda coins. The problem is, we are talking about stuff worth money after all and trust isn't something anyone can build anything upon in this field. If there are flaws in the system, people will go and abuse them.

Just updated and saw that. This authentication still can be implemented in a bot.

- I'm not concerned about manufacturer and device name, it can be even used as useful statistics, but please hash the IMEI in the next update. You have no need to store the IMEI number of all registered devices.

Since everyone is talking about source and security lately, let me share my opinions. I'm an Android app and system developer and just recently started looking into cryptocurrencies.

So here are my findings about this coin:
- Reverse-engineering the apk was trivial, devs didn't even use ProGuard to make it harder to read. This is not a problem actually, because even if the app is obfuscated, it's not much harder to understand.
- The coin is centralized and all data is probably stored in a database without a blockchain and proof-of-anything. This system can be hacked, devs can do bad things (though they seem to be honest).
- Even if you don't have the source, there are a lot of ways to cheat the system on Android.
- Coding a desktop implementation based on the reverse-engineered apk is trivial, one can sync without using an Android device at all. Add proxies and bots to this and you can easily "mine" hundreds of coins per day. You can also signout anyone just by knowing the username. It might be possible to sync an arbitary amount of coins to any username too, this depends on how much checking is implemented. I guess it could work since if one used random device data, the system would think the user started using another device (too).
- The app uploads the following information about a device: device model and name, IMEI number and if the device is rooted. All of them can be faked on a rooted device. I understand that IMEI is used for checking multi-account usage on one device, but not in plaintext, it should be hashed and only that value sent to the server. What if the server is hacked, IMEI numbers are stolen and sold on the black market? I personally wouldn't be happy.
- Up until v0.5.0b, only salted password hashes were sent to the server, providing a secure authentication. The salt was generated by the device randomly upon signup. Since v0.5.1 update, passwords are sent directly to the server without hashing. This causes a security risk as devs can now save passwords in plaintext, which is problematic if you use the same password elsewhere, let's say for your e-mail account, not to mention they know your e-mail address too.
- Probably this was introduced to ease server load as there's no need for another API call to get the salt.
- Fortunately, communication between the device and the server is done through the secure HTTPS protocol. However, the server uses a self-signed certificate (trusted certificates are not free) and the app is coded not to reject unauthorized certificates for this very reason. This makes it possible to successfully execute a man-in-the-middle attack and steal passwords which aren't sent hashed anymore. This kind of attack is very common on public Wi-Fi access points, such as a coffee shop, airport, etc.

By all this said, please do not think I'm against this coin or anything. People just have to know the truth. Even if it might have sounded harsh at places, I appreciate developers' work, because this really is a unique idea. Unfortunately without a real blockchain and proof-of-anything system there's no way to properly secure the system. You can make it harder to cheat, but not impossible.

do you mean device's IMEI number?

¨

You can use only one account per device. It is not a bug.

Basically what I did to play the game was to remove SU binary, remove Titanium backup and Mangocoinz before I was able to play, however I am not 100% sure that it is because of mangocoinz (just that after its removal the game lets me play ) as the game will only give a error 9991 saying some ubiquitous app is installed. The error will only show after the tutorial where u press play. Thanks for checking though!

What was the above private message exchange about?

The first one should have sufficed for direct communication.  Posting here that you have exchanged technical information is either leading or irrelevant.  I'm concerned that it is the former...