I'm interested in developing a secure exchange platform. Not so sure what you mean by private---is it just that there's no public record of deposits/withdrawals/trades?

I think the stored-password-hash system is ultimately not secure enough for something like this. What I'd like to build is a stored-public-key system something like that for the #bitcoin-otc web of trust. A client sending a command to the exchange server would timestamp it and sign it with his public key, and the server would verify the signature before carrying out the command. I see no theoretical barrier to implementing this in Javascript so that, to the user, it looks just like entering a password at any other site---but it sounds hard, and you'd have to figure out where to store the private key on the client's end. Building a standalone client application that calls GPG for the signing would be easier but probably less used.

Didn't Lulzsex just admit to being behind the attack at MTGox? I think they just admitted it on their twitter; Hackavism for Silk Road no doubt, but they probably won't admit that.

I wonder if they really are messing with the FBI like they say they are? Or is that just social engineering?

And when L/S says it's been tested and all threats have been addressed... Your going to put your money in? After they have had a chance to check it all out?  No thanks.

Compromising security always leads to embarassment of the site that get's compromised.
We don't store any details on our members beside of their logins, emails and hashed passwords. The database is only readable by one user, which has very long and secure password. Database admin interface is not viewable from outside. We use a non-default SSH port. We make offsite backups of both our wallets and the db. I'm not sure what else you expect? We'll happily adapt to more security measures that we could not thought of.

Lulz Security® is not an entity you request, hackers are not people you want to associate yourself with.

How do you make sure that the people actually have the USD they are trading for BC.

The issue is addressed via centralization, or simply trading in person in your area, or via mail.

I just don't see your idea working.

wow what a fucked up thread

Yeah, I know. The whole trading transaction thing is all well and good - but I don't know how to handle the edges where a level of trust is required.

Just threw it out there in case someone has a 'satoshi' and figures it out.