<p>From a consumer standpoint, PCI compliance is a useful hurdle to expect companies to meet, as it helps ensure that some amount of due diligence has been applied to security.</p>

<p>But note that from the standpoint of a savvy IT department, there are times that PCI can get in the way.  E.g., potentially faced with a less-skilled PCI assessor without as much understanding of the technology, sometimes PCI can lead the team on a wild goose chase, or perhaps give management an excuse to under-invest in security, feeling they only have to satisfy the assessor.  See e.g.
<a href="https://security.stackexchange.com/questions/622/does-pci-compliance-really-reduce-risk-and-improve-security">Does PCI compliance really reduce risk and improve security? - IT Security - Stack Exchange</a></p>

CC BY-SA 3.0
2011-09-04T06:21:30.260Z
2011-09-04T06:21:30.260Z
2017-03-17T13:14:44.100Z
nealmcb
<p>It would be impractical to list every single expectation here, but the TradeHill exchange sets themselves up for PCI compliance. I think being PCI compliant is a great set of standards to keep your data safe and secure.</p>

<p>PCI compliance is basically security standards setup by the <a href="https://www.pcisecuritystandards.org/" rel="noreferrer">PCI Security Standards Concil</a> for merchants who accept credit cards, online or offline. They have 4 sets of levels of PCI compliance, which I believe TradeHill to abide to the first level (at the bottom).</p>

<p>Common sense comes into play when storing Bitcoins. Keep a small percentage of them online for immediate usage, when your hot storage gets empty, fill it back up with funds stored offline. Keep multiple secure backups of your wallet files, so a '<a href="http://siliconangle.com/blog/2011/08/01/third-largest-bitcoin-exchange-bitomat-lost-their-wallet-over-17000-bitcoins-missing/" rel="noreferrer">bitomat</a>' doesn't happen.</p>

<p>I don't think there is anything to protect a staff member from rubber hose attacks, but limiting the access of your staff members so that the information is accessed on a need-to-know basis through someone like you would help prevent sensitive data leaking. If they're attacking you, then you're fucked.</p>

CC BY-SA 3.0
2011-09-03T16:52:11.870Z
+1 for a good answer - I like the idea of having a PCI compliant expectation
Gary
CC BY-SA 3.0
2011-09-07T03:46:00.740Z
Depending on the services rendered it may be more appropriate to go for PA-DSS (formerly PABP) compliance, which is similar to PCI but with a few different points. In either case, PCI or PA-DSS guidelines should be considered the minimum necessary amount of security - barely meeting either standard should not be considered acceptable.
David Perry
CC BY-SA 3.0
2011-09-03T13:21:40.900Z
2011-09-03T16:17:45.527Z
2011-09-03T16:17:45.527Z
Tom Williams
<p>If you wanted to assess the security of an online wallet service such as a bitcoin bank or ewallet, what would expect to see addressed? </p>

<p>Obviously SSL connections, but what about authentication, authorization, protection of staff from rubber hose attacks and so on?</p>

<security><wallet>
What are the minimum security expectations of an online wallet service?
Gary
# What are the minimum security expectations of an online wallet service?

(Asked by: username_0 on 2011-09-03)

If you wanted to assess the security of an online wallet service such as a bitcoin bank or ewallet, what would expect to see addressed?

Obviously SSL connections, but what about authentication, authorization, protection of staff from rubber hose attacks and so on?

**Tags:** security, wallet


---

## 2 answers

### Answer by username_2 on 2011-09-03. Score: 7 | Accepted answer

It would be impractical to list every single expectation here, but the TradeHill exchange sets themselves up for PCI compliance. I think being PCI compliant is a great set of standards to keep your data safe and secure.

PCI compliance is basically security standards setup by the [PCI Security Standards Concil](https://www.pcisecuritystandards.org/) for merchants who accept credit cards, online or offline. They have 4 sets of levels of PCI compliance, which I believe TradeHill to abide to the first level (at the bottom).

Common sense comes into play when storing Bitcoins. Keep a small percentage of them online for immediate usage, when your hot storage gets empty, fill it back up with funds stored offline. Keep multiple secure backups of your wallet files, so a '[bitomat](http://siliconangle.com/blog/2011/08/01/third-largest-bitcoin-exchange-bitomat-lost-their-wallet-over-17000-bitcoins-missing/)' doesn't happen.

I don't think there is anything to protect a staff member from rubber hose attacks, but limiting the access of your staff members so that the information is accessed on a need-to-know basis through someone like you would help prevent sensitive data leaking. If they're attacking you, then you're fucked.

> **Comments:**
> **username_0**: +1 for a good answer - I like the idea of having a PCI compliant expectation  
> **username_3**: Depending on the services rendered it may be more appropriate to go for PA-DSS (formerly PABP) compliance, which is similar to PCI but with a few different points. In either case, PCI or PA-DSS guidelines should be considered the minimum necessary amount of security - barely meeting either standard should not be considered acceptable.  

---

### Answer by username_1 on 2011-09-04. Score: 2

From a consumer standpoint, PCI compliance is a useful hurdle to expect companies to meet, as it helps ensure that some amount of due diligence has been applied to security.

But note that from the standpoint of a savvy IT department, there are times that PCI can get in the way. E.g., potentially faced with a less-skilled PCI assessor without as much understanding of the technology, sometimes PCI can lead the team on a wild goose chase, or perhaps give management an excuse to under-invest in security, feeling they only have to satisfy the assessor. See e.g.
[Does PCI compliance really reduce risk and improve security? - IT Security - Stack Exchange](https://security.stackexchange.com/questions/622/does-pci-compliance-really-reduce-risk-and-improve-security)


---

