XRP Surges Nearly 300% in Just Over a Month, and the Real Reason Why!

The last couple of months have been a little painful for all but the most patient of traders, as XRP fell from a high of just over $0.02 USD (two cents) to less than $0.0025 (a quarter of a cent). Now, and seemingly in tandem with an announcement that Ripple may be open-sourced by the end of the month, XRP has surged back to just under $0.01 USD, or approximately 300% higher than the mid-August lows.

Personally, I think there's a more important reason why XRPs are trading higher as of late, and that's this little hint of an announcement hidden in the Ripple Blog post about the Developer Conference taking place next month:

10:25-11:20am – Integrating with Ripple for Merchants and Gateways, Bob Way and Brian Keller-Heikkila 

Integration Engineer Bob Way will explain how merchant and gateway integration works. Brian Keller-Heikkila, CTO of ZipZap, will join Bob on stage to share special news.

What special news could the CTO of ZipZap be announcing? Well, considering they operate a global cash transaction network of 700,000 payment centers, perhaps they're going to be integrating with Ripple to become a massive multi-currency gateway?

That's just a guess, but I can't imagine any other reason why the CTO of ZipZap would make an appearance with Bob Way, the Integration Engineer for OpenCoin.

If ZipZap is indeed becoming a gateway, it'll be a massive win for OpenCoin, and a huge vote of confidence for the technology.

Read more »

Post-mortem: bitcoin stealing attack against LocalBitcoins

There was an attack against LocalBitcoins.com on Friday 13.9.2013 to steal bitcoins from the wallets of LocalBitcoins.com users. Thanks to the responsive LocalBitcoins community, the attack was quickly detected, the support team was notified and the attack was blocked. All affected users have now been reimbursed for their losses.

A user using a relatively old LocalBitcoins.com user account sent maliciously file attachments through LocalBitcoins.com internal messaging to the traders. People opening the attachment might have lost bitcoins they had in their LocalBitcoins wallet. This was due to an error in LocalBitcoins.com messaging system which should block all kind of malicious file attachments. Total 82 bitcoins was stolen.

Only the users who had not enabled two-factor authentication were affected. LocalBitcoins.com always reminds the users who have bitcoins in their wallet to enable two-factor authentication which protect against both technical and social account hacking attempts.

LocalBitcoins.com security has now been strengthened and similar attacks are not possible in the future. LocalBitcoins.com internal messaging is safe and the users are encouraged to use it. People should be always very careful when communicating outside localbitcoins system.

 

LocalBitcoins reimbursement policy

LocalBitcoins credits the lost bitcoins to its users when there is a clear error in LocalBitcoins.com service, allowing somebody who is not authenticated on the site to access the wallet.

LocalBitcoins.com does not credit the lost bitcoins when the loss is caused by the actions of user. Usually actions like this include, but are not limited to,

• Giving username and password to some external (phishing) site or losing the control of the password when having the computer infected by malware.
• Releasing bitcoins from an escrow to a buyer even though the payment is not properly confirmed and cleared.
• Payment problems outside LocalBitcoins control, such as afterwards reversed transactions

LocalBitcoins.com cannot protect the users against phishing and file attachment attacks outside LocalBitcoins.com service. Thus, always be careful when opening emails, SMS messages, links and attachments coming directly from another person. Always enable the two-factor authentication when you are actively dealing with bitcoins on any services you are using.

 

Attack details

The attack was performed by uploading a specially crafted image file. The file attachment had PNG image file headers, but contained HTML payload and .htm extension. The HTML payload included JavaScript code performing HTTP POST request to send bitcoins out from LocalBitcoins wallet.

• LocalBitcoins.com uses Django web framework which includes security features to block invalid image uploads. However, in this particular case, the image verify method let the specially crafted file through because it contained valid PNG headers. The standard Python Imaging Library verify method does not check for extra payload at the end of image file.
• When the web browser downloaded the file, it interpreted the attachment as a HTML file, even though the beginning of the file was garbage due to PNG headers.
• Because the file was served from LocalBitcoins.com domain, the download was considered as safe and it passed through cross-site request forgery protections.
• When the user opened the attachment, the web browser executed JavaScript inside the file and managed to perform a Send from wallet action if the two-factor authentication was not enabled. With two-factor authentication an additional security code is needed to execute a wallet transaction.

 

Actions taken to prevent further attacks

Since the attack, LocalBitcoins.com team has strengthened the site security with additional layers to prevent similar attacks in the future.

• Uploaded image files are rewritten to be clean image files, so that any extra payload or codec bug exploits in the web browsers are not possible.
• Extra checks are performed to make sure that the image content matches the attached file extension.
• LocalBitcoins wallet pages performs more aggressive HTTP referrer checks to prevent triggering wallet actions from JavaScript code.

Read more »

OpenCoin Aiming to Open Source Ripple by September 26th

Start watching at 27:06, where Patrick Griffin reveals that Opencoin is targeting September 26th to release the source code for the Ripple server software!

Read more »

Release the Kraken!

After what felt like an endless wait (in Bitcoin time), Kraken has finally come out of beta and now allows real money trading!

At the moment you can trade in EUR, BTC, and LTC. XRP and CAD will be coming very soon.

I expect Kraken will quickly become the major player in the new era of regulated digital currency trading.

Edit: here's the official announcement.

Read more »

Tune up your Bitcoin trading with market-based pricing

Hey traders,

If you've ever dug deeper in our ad options, you may have found the price equation field. The innocuous premium field above actually creates a basic, functional price equation for the ad. That's where the magic happens. But how to improve on the equation? Maximizing risk and profit, or playing it safe? Perhaps even both?

Price equations as used on LocalBitcoins.com have been somewhat of an arcane art so far, especially for advanced use.

We don't like features that don't create value for us and our customers. In part of this effort to suck less, we've just published a guide to using price equations more effectively. Although it is mostly a technical reference at this time, I hope it will be useful! As always, we will consider any feedback to improve our service.

Read more »

Bitcoin market data available on Bitcoin Charts

LocalBitcoins.com team has implemented Bitcoin Charts integration. Now you can see LocalBitcoins.com market data with other big exchanges.

This data includes online trades and excludes cash trades. LocalBitcoins.com is not an order book based exchange. For the order book asks and bids data we provide online selling bitcoins and online buying bitcoins advertisement values.

Even though Bitcoin Charts only displays EUR, we have data available for  ARS, AUD, BRL, CAD, CHF, CZK, DKK, EUR, GBP, HKD, ILS, INR, MXN, NOK, NZD, PLN, RUB, SEK, SGD, THB, USD, ZAR (or any currency our users trade).

You can also pull the data with HTTP  in JSON format as described in LocalBitcoins.com API documentation.

Read more »

LocalBitcoins.com Public JSON API released

Hey developers!

I'm proud to announce the second iteration of our API. The focus of API 2.0 is public browsing APIs. There's a whole slew of different ways to find good deals on LocalBitcoins.com -- almost all of them are now also available in JSON. Please have a look at our Public API documentation!
Changes and additions include:

• A new API to query profile information with
• JSON versions for most of our listings (full list of them are in the docs)
• Supporting APIs that facilitate searching through our listings, including the lists of currencies, payment methods and countries our service recognizes.
• Corner case issue fixes in existing APIs

About our API

We first introduced a small API last month, with the goal of enabling traders to release their escrows with an application. Although the scope was small, the response was good. Thank you for your interest!

Our bounty program for API implementations and clients is a rough start, but we'll keep doing them in the future. The experience in the pilot bounties is important to us as we want the bounty program to be a good experience for everyone involved.

Future of our API – You're invited

I'm already looking forward to our 3.0 API. We'll be setting our foot in the sprawling Bitcoin market data field. The exact details and breadth will be decided at a later time. API development right now is focused on troubleshooting the current API and grabbing all the low hanging fruit.

The design decisions are still malleable. Now it is the time to contact us and help us make the new APIs useful from day one. You can discuss it in public on our forums or contact our support in private if you prefer.'

Pie-in-the-sky requests are also considered for later planning, please do come forward with them. I want to keep the API simple and powerful: having as many concerns as possible known well in advance helps keeping it all in harmony.

Read more »