Added Strongcoin

[ianpurton]

StrongCoin has been around 2.5 years now and we're actively developing the site to make it easy to use whilst still keeping the cryptography in the browser.

Let me know any amendments you think I would need to make to get this included. Thanks.

[saivann]

For the record, strongcoin has been previously submitted, and got hacked before being accepted:
bitcoin#73

There is also various other concerning claims about strongcoin on bitcointalk and reddit, although I don't know if they are true.

[ianpurton]

Previously we had a problem where a ruby on rails upgrade caused our encrypted private keys to become visible. We fixed that as soon as we became aware and notified all users.

We have now been almost 1 year without incident.

We are hosted on heroku which has the following security policy. https://www.heroku.com/policy/security

We are also fronted by cloudflare which protects us from DDOS and various other attacks.

We have several warnings on our account creation to ensure users select strong passwords for the AES key encryption.

But, at the end of the day Strongcoin was designed such that a major server hack would still save our clients Bitcoins.

I feel that we provide a clean and easy to use experience for new users and would be a valuable addition to the web wallets.

[saivann]

AFAIK, no wallet currently listed on bitcoin.org have an history of being hacked and not reimbursing customers ( it is my understanding that no customer has been reimbursed ). BIPS was removed not so long ago for the same reason. Just my opinion, but I am uncertain if StrongCoin should be listed for this reason.

Also, the description of the previous security issue seems very concerning:
"It was possible to change the id in a URL and see another users encrypted key."
https://bitcointalk.org/index.php?topic=165588.msg1729785#msg1729785

Perhaps this pull request should be kept on hold until clearer guidelines for wallets inclusion on bitcoin.org are discussed.

[sunnankar]

Perhaps we need to be clearer for new users about what is important for control of funds (private keys) and help new users understand better who has or could have access to them. For example, some wallets can generate and store them completely offline (Armory) while others 'touch' or 'hold' the private keys in some way (Blockchain.info, Bitgo, Coinbase, etc.). Helping new users understand some of these concepts are important.