Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
How To Accept Bitcoin On Your Website (coinbase.com)
229 points by barmstrong on Dec 5, 2012 | hide | past | favorite | 73 comments


Suggestion: I found the option "Send to a bitcoin address" to be confusing. I would have expected it to say "Send from a bitcoin address."

Upon further reflection, it's clear why I expected that.

First, when a user goes through a typical online checkout/payment, they are not concerned about where the money is going to, they are concerned about where it is coming from, i.e., putting their credit card info in.

Second, the prior option is "Send using my coinbase account," which reinforces what I was talking about in the other point I just made. For the sake of consistency, both options should be about sending from somewhere, not sending to somewhere.

An alternative way to do this would be having the first option say "Send using Coinbase" and the second option be "Send using the Bitcoin network," or something to that effect.


Ok good feedback. While technically it is correct that you are sending to a single bitcoin address (your payment can actually come from multiple bitcoin addresses) I agree it's confusing and the the distinction isn't important to more users.

It now reads like this: http://cl.ly/image/2n3Y3F261o1s


Sweet, I like it much better that way.

Good point that your payment likely would come from multiple addresses, I had overlooked that.


Yes, I agree with the above comment, "Pay using bitcoin" or "Send bitcoins" or something like that would be less confusing I think.


Have you taken note of this possible vulnerability? You guys need to be more careful about security. You may only get one shot at this, if you get bad PR this early by getting hacked.

http://www.reddit.com/r/Bitcoin/comments/14c7q0/coinbase_lau...


This is another case of convenience vs. security.

The Stripe button poses a similar problem, even if credit card number and cvc are arguably not as bad as actual login data.

But it is much easier to create a frictionless user experience if you do not have to redirect people to somewhere outside your side.

I recently implemented paymill payments and also there the only assurance for the customers is the 3D-Secure iFrame, if their credit card is 3D secure enabled ...


> But it is much easier to create a frictionless user experience if you do not have to redirect people to somewhere outside your side.

Under this model, how do you train ordinary users to avoid phishing?


Beats me.

Of course the situation is unsatisfactory. But I like the 3D-Secure approach.

Unfortunately the implementation is card provider specific and quality varies.

I had a VISA once where I could enter a custom phrase that was displayed to me on every "verified by VISA" dialog.

Combined with displaying the dialogue in an iframe this practice seems strike the best balance between usability and security.

Of course as coinbase would have to implement something like this by themselves, but I that seems feasible.


Good advice.

But I can't help but ask, this isn't THE MtGox providing this info, is it? :P


I'd love to transparently accept BTC on a website I'm building, and have the merchant company send me a check every month..

I'm really hesitant to use (and thus implicitly recommend) Coinbase, since they're asking for Bank username/passwords from users.

Even thought it's not necessary, it makes these guys really look rather Shady to me, so I'm really reluctant to use their solution.

Has anyone else worked with Bitpay or other providers in this space? I'd love to hear how things went for you.


Founder here - just wanted to clarify that bank username/password is not required, you can also use deposit verification. But glad to hear you're interested in accepting bitcoin. Thanks!


I think it is reasonable to remove the bank username/password requirement. All it does is raise red flags for potential users.


Congrats Brian! I'll be integrating this on https://openexchangerates.org pretty soon (as well as including the BTC rate in the OXR API)

#edit - just wondering, would it be necessary to include another BTC checkout button, e.g. from mtgox? Or can any BTC user anywhere use this button to checkout?

Also - a big one - is there/will there be support for recurring payments? Actually, is that even possible?


Are there plans to make it possible to just receive the bitcoins directly rather than a cash payment in a bank account? I'd like to accept bitcoins but have the coins transferred to my wallet.


The default is just to receive bitcoins.

Cashing out to a bank account is optional and not on by default.


Can you set the price in BTC rather than USD?


How does refund work with Bitcoin? Since Bitcoin can have big swing, some users might opt to get the refund of bitcoin after a while.


On their own, bitcoins are like cash in that they cannot be taken back once spent. However merchants can issue refunds as much as they'd like, and payment processors might offer a chargeback option. (although I'm not sure coinbase does)


Merchants should refund an equivalent value of BTC, not the same amount paid.


Why? Serious question, if I get a refund the amount isn't compensated for changes in the Australian dollar.

Either the buyer or seller will lose out if the value of bit-coins change, so is there a compelling reason for picking which party that is other than "merchants have the control to give whatever refund amount they want"


The main reason is because bitcoins are volatile. Most currencies are fairly stable, there won't be much fluctuation over the course of a week or month, for however long refunds are valid. This isn't true for bitcoins. Once you pay for something in bitcoins, you are trading those bitcoins for something of similar value at that time. I don't know what the bitcoin exchange rate is right now, so I'm just going to make up some numbers for an example. But say you buy a TV that has a value of $1000 USD. Let's say the current exchange rate is 10 bitcoins to 1 USD. Then you have to pay them 10,000 bitcoins for the TV. Say a month later, you decide you want a refund. So you return the TV. Well the TV still has a value of $1000 USD (ignoring deprecation) so you should get that same value back. If the bitcoin market has skyrocketed, to say 5 bitcoins to 1 usd, then you would get 5000bitcoins back, because those bitcoins have the same value. The merchant isn't acting as a bank to hold onto your coins for you, they are trading you something of value for something else, and if you want a refund, you'll get something of the same value back.


Considering that customers generally get to choose whether and when (within a certain window) to ask for a refund, refunding the same amount of BTC gives customers a license to steal.


If you visit a different country and pay for something in the local currency, and then later on you want a refund, you wouldn't expect the shop to refund you in your home currency?


Are other currencies immune from this?


Most currencies that are dealt with online are more stable than BTC. But no, not "immune".


Too late to edit, but I realize the problem is more likely to come up in the face of sudden and significant deflation, which isn't something we see in other currencies terribly often.


Surprisingly wide swings in fiat currency value can happen over the course of a month or two though. I imagine the volatility of BTC might cause problems for things like pre-orders.

I once placed a large order with a US company; unfortunately the order couldn't be filled for about two months.

I really wish they had billed me up front, because by the time they did bill me, the order cost 30% more in NZD.


While that's not quite the situation in question (you took my money and now I want a refund is stickier than "I want to pay you now rather than later" - in your case, you could always just cancel your order...), it's still relevant in that things could well have been reversed and (the bit I overlooked in my second comment) a rapid inflation in one currency looks a lot like a rapid deflation in others if you hold the inflating currency.


What are the limitations regarding the location of the users or merchants, if there are any? Can I send and receive Bitcoin through Coinbase to and from anywhere? I assume the bank thing only works with US banks?

I'm not sure about the color of the button. Seems rather dull to me, and might be easily missed. You might want to A/B test that.

I like what you're doing, though. An easy to use Paypal-like service is very needed in the Bitcoin world. Wasn't Reddit a YC company, too? Maybe you can convince them to use your service instead of Bitpay, since they were thinking about using Bitcoin anyway.


What is coinbase's strategy re dispute resolution?


Bitcoin merchant services sector is really heating up. Bitpay.com making big news with the recent Wordpress announcement, Walletbit (http://bitcoinmagazine.net/walletbit-launches-bank-transfers...) growing and adding more features and now Coinbase joining in. This open competition allowed by the open source nature of Bitcoin is great to see.


I am almost ready to use this service but have some questions first:

1. Are Instant Payment Notifications sent only once with 0 confirmations? (hoping no)

2. How do I verify that the IPN is really coming from Coinbase? (hoping some simple signature check)

3. If I created a button worth 1.99$ then will it adjust BTC amount based on the current exchange rate or will it be static? (hoping it will adjust itself over time)

4. Also is it possible to see and edit buttons at a later time(hoping yes)


This looks amazing. I've held off using bitcoins until now because of usability issues. This product looks like it can change that. I'm signing up today.


Now how about a one button way for my users to buy bit coins. Buying bitcoins is an exhausting user experience


You should just ask them to mail you cash. It's about equally reliable, from a buyer's perspective.


I can spend cash at the corner store if it comes down to it. Bitcoin, not so much.


Now, there's an argument for greenbacks. McDonalds takes greenbacks. Brb guys... fry cravings.


Someone already mentioned how easy it is to buy bitcoins on coinbase.com.

Another option is https://www.bitinstant.com : deposit cash in any CVS/Walmart/etc location and instantly receive your bitcoins.


For US users Coinbase is one of the easiest ways to buy bitcoins. Link your bank account like you would with paypal and it's straightforward from there on.


I would be very hesitant to give a new entrant my bank account information, no matter what they did with it:

http://news.ycombinator.com/item?id=4703704


My PayPal strategy, which I'd reuse for Coinbase et al, is to just create a separate checking account for that with a few clicks. I think the most they can screw me over is one or two overdraft fees before I tell my bank to stop ACH transactions.


Hi Brian, cool, congratulations on making it this far! Do you think the several hours latency to the bank account deposit is going to expose people to too much exchange rate volatility?


Since Bitcoin is unregulated, if they wanted to I guess Coinbase could lock in exchange rates at any time they choose (e.g. the time of the transaction) and then do the exchange later. Since that effectively shifts the currency risk from the merchant to Coinbase, they could choose to charge extra for such a service.


Compared to other Bitcoin exchanges, I have high hopes that you guys are more confident. Taking a page out of Stripe's book is the right move, because you look less like previous Bitcoin sites and more like a startup. If Coinbase suffered a security breach I would be very disappointed.


Great - now we only need a 'Why To Accept Bitcoin On Your Website' article.


Some good "Why To Accept Bitcoin" reasons in this article: http://www.forbes.com/sites/jonmatonis/2012/11/16/whats-your...


Suggestion 1: Offer to convert user funds to bitcoins (works as an annoying service). So you act as a money proxy.

Suggestion 2: Explain what bitcoins are for shopping cart users


#1 puts you in shaky legal territory at least in the united states, since cash exchange services have a huge litany of regulations.


I also find it hard to explain to users what and how to use Bitcoin. I'm running a women fashion e-commerce site and most of users are women and non-tech.


annoying?


Can my bitcoin payments be sent to an external site or external bitcoin address other than a US bank account since i don't have one.


The button is working on Chrome/Windows but not Firefox/Windows. (Amusingly, it also works in IE9/Windows)


Thanks for the bug report! Just pushed out a fix for Firefox. Live in 5 min. Thanks!


Also doesn't appear to work in Firefox/Ubuntu.


Are you working on plugins for integration with existing shopping carts?


Great job Brian. Seems similar to one click Stripe button.


Is this a dangerous thing to put on ones website at all?


Dangerous? The only danger is that you might pay 1% fee when sending/converting your earnings back to USD. Also possible that the value of bitcoin tanks overnight, but there are historical charts that show this has not really happened but just once.

What kind of danger are you thinking?

The exchange could also go under and/or rob you. You should be careful about to whom you give your bank account numbers.


>What kind of danger are you thinking?

My guess is he's referring to one of the many "dealers" that were hacked and had bitcoins stolen.


That would fall into the category of exchange going under.

Similar risk to cash in the mail, except with cash in the mail there's nothing you can do to protect yourself (or prove that delivery was accepted.)


It's actually somewhat riskier than cash through the mail (which is shockingly reliable), and you have no recourse, unlike the US postal service which is more than happy to insure cash mailings (up to $25k through Registered Mail) and investigate and prosecute fraud.


That was the first danger. How much is the insurance? We were talking about 1% at CoinBase, I think that MtGox was 0.65%, and that's only for buying and selling. Withdrawals are free. Bitcoin-to-bitcoin transfers are (still) free.

If it's $20,000 cash in the mail, it weighs about 200g (100 $100's) and to mail it about an hour from here (1 hour 30 minutes by car) Rochester to Buffalo, registered mail with $25,000 insurance, flat rate priority mail envelope is $53. I guess that price is the same across country.

OK, so it's actually cheaper to mail cash than to trade bank dollars for bitcoins. I'll get off my pulpit now.

(PS: I'm pretty sure you actually have to pay taxes on that cash you received by mail, especially if it's registered and insured, now that it's yours, it's income. Bitcoins on the other hand are not cash. I am a newbie to taxes, but I don't think you would have to pay tax on bitcoin income unless you were actually cashing them out. Maybe capital gains. Any experts?)


You owe tax on income regardless of the form. If your employer gives you stock, you owe tax based on the stock's value the day you get it. Capital gains (or losses) mostly only applies when you sell the stock, and only to the difference in value. Same deal for bitcoins. Hell, if you're caller #9 and you just won the two week cruise, you're getting a fat tax bill and cruises aren't cash either.


Ahm... but if you paid cash for the bitcoins, you don't owe any tax on it, right... until they appreciate in value, then it's capital gains?

And then, only if you actually cashed out, right? If you leave them as bitcoins and the value drops below what you paid, now you've got a loss and maybe deduction instead...

It would make sense that you should pay taxes on mining income (if they can find you).


If you paid cash for the cash you received in the mail, it wouldn't be income either, would it? (though it makes little sense.)

Most people earning income in bitcoin probably aren't doing it by mining, especially after ASIC arrives. Just to point out that mining is only one of many ways to earn bitcoin income.


Right, there's also arbitrage trading on markets which have fluctuating market rates, plus regular buying and selling over longer periods of times, transaction fees (both from mining and from trading), and simply accepting Bitcoin as payment for services.

I am not so sure that ASIC will kill the small-time mining scene, the low-end ASIC miners are cheaper and less power hungry than video cards (though you can't play games on them), it will just mean that if you want to mine bitcoins, you'll have to get one (or more), and you can't rely on your video card anymore. So a lot of people will be pushed out.


> That would fall into the category of exchange going under.

Bitcoin exchanges are not like Paypal, it's a terrifically bad idea to keep your coins in a wallet controlled by a third party for any length of time.


It might be a better idea than keeping them in a wallet controlled by your personal computer, depending on how vulnerable that computer is.


What do you do with them, then? I thought the point of Coinbase was to have a hosted wallet. I'm not sure I trust my security better than theirs. If the reply to that is that I should not be using Bitcoin, that's probably a sign of an issue that may limit widespread adoption.


Treat your local bitcoin wallet like your bank account, and treat your hosted bitcoin wallet like your leather wallet in your pocket. Only keep what you need in the leather wallet / hosted wallet.

Local wallets are easy to keep secure. Just keep it on a flashdrive, don't let it touch your harddrive, and don't use it on a pwnd computer. If you want, you can even keep that flashdrive in a real bank.


Evidence shows that the track record of hosted bitcoin accounts is a bit disappointing.

But the evidence seems to show that the track record of bitcoin accounts kept by individuals is significantly worse. For instance, http://arstechnica.com/tech-policy/2012/10/78-percent-of-bit... and I think I am safe in concluding that a significant portion of those "non-circulating" bitcoins are actually lost.

So my financial advice would be that you are better off trusting an exchange than trusting your own storage and backup procedures.


7 million bitcoins are "lost" because they haven't circulated in the last 3 months?

Maybe you have found evidence of an elaborate ponzi scheme that we are all played by, but I don't buy your conclusion, and it's not the conclusion of the linked article.

If only 90,000 bitcoins held by/moved through a small group is driving most of a total of 423,000,000 bitcoins transacted, then I'd say the rest of the owners of the 9mil bitcoins in existence owe those guys a debt for stress-testing the grid.

You can use a cloud bitcoin wallet, like BitcoinSpinner, which is implemented on top of the BCCAPI. While I have not read the actual API, and I'm not sure this program is open source, I can tell you that it promises your bitcoins cannot be stolen from the cloud!

If that's not good enough for you, and you don't trust your own safe box in your own house, then I'd suggest you run back to your FDIC insured bank, or better, start reading. It's shameful to hear Hacker News readers saying they don't trust their own data to stay safe.


> It's shameful to hear Hacker News readers saying they don't trust their own data to stay safe.

Look, I am a reasonably skilled programmer, and I work for a bank. I know a great deal about keeping data safe and keeping it backed up well. I have written simple cryptography algorithms for addressing these sorts of issues (like secret sharing). And I know enough to realize that these are HARD problems, and leaving them to professionals works better than thinking you are smarter than the rest of the world.

As an example, it sounds like you store your bitcoins in a safe in your house. Nice system... I'm going to assume that your safe is fireproof, and that you were careful about not storing the data elsewhere. Now here's a question: if you die, will your heirs know how to retrieve the value, or will it be lost forever? Those are the sorts of hard problems that an institution can probably handle better than you can.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: