As previously mentioned I have been looking into a way to offer a working substitute for the now long gone mitm.io that I used to recommend. Now I’m happy to announce that the Dogecoin based marketplace for commerce between users, SuchList.com, has a working escrow service on the site.
As previosly mentioned it does not store any coins on the site so there’s no central wallet that could be the target of an attack. Instead all coins are held secure on the block chain and is protected by secret keys chosen by the buyer and seller. These two keys that must be known to be able to withdraw any coins are not saved on the site making it a very secure solution.
It’s currently in open BETA and I must urge everyone to use the system at their own risk. I have done dozens of transactions suing the test network and several with real coins and not had any issues at all. All coins have been withdrawn without issues. But if any issue were to arise I just want to make sure I have warned people.
I have not spend to much time on graphics, so I’ll give that some love asap. But I wanted to get the functionality out to you all as soon as possible to make sure you have some kind of secure way of sending coins when doing commerce.
Anyway, let’s take a look at how it works.
Using the escrow service
As a seller you are contacted regarding one of your listings. You and the buyer agree on terms (such as price etc) and you go to Register a Deal. Most of this looks familiar.
But after all the normal things like price, quantity and who the deal is being made with, a few new options present itself. Here the seller now has the option to specify the type of transaction that is connected to the deal. Right now the user has two choices. External which means that the seller and the buyer handle this on their own. They are perhaps meeting in person or sending coins in some other way. The second option is the interesting one for this article, the Multi Signature Escrow. This option allow the seller to “attach” a transaction request to the deal.
Selecting the Multi Signature Escrow option a few more options and some information presents itself. Here the seller is asked how he wished to protect his “part” of the transaction. The first option is to use your SuchList.com password. What in fact happens here is that a 512 char secret key is generated for you and this is encrypted and needs you SuchList.com password to be decrypted. Since the password itself is only stored in an encrypted form on the site and all communication is encrypted using SSL this is very secure.
The second option is to use a specific secret pass phrase for this single transaction. This pass phrase is not stored on the site and it’s up to the user to remember this. If a user opts-in to use this approach I probably recommend having the key stored somewhere, especially if you are doing many deals at once and have to remember a lot of keys.
Once the deal is registered a mail is dent to the buyer as usual and he is presented with the fact that there are unconfirmed deals by a notification on the site.
Clicking this link the user will see a list of deals that are not yet confirmed. But now, the list also includes information about what type of transaction the deal was created with.
The user is free to Cancel a deal here like normal or Confirm it. Once the deal is confirmed and it is a deal with a transaction type of Multi Signature Escrow a second screen will be displayed for the user.
Here the user see an overview of the attached transaction request. The user is also asked to secure his “part” of the transaction in the same way as the seller did when creating it. The deal is not confirmed until this part is done. So the user can spot things here that are not part of what the seller and buyer agreed upon and go back an Cancel the deal if they want to. Once the transaction request is also confirmed the transaction will be added to the sellers Active Transactions list.
Here the seller will see a quick overview of all active transactions. Clicking Details on any transaction brings up a more detailed view of the specific transaction.
The same is true for the buyer who will also see the transaction among the list of Active Transactions.
If the buyer clicks the Details button for the transaction he will see the current state. Right now the transaction is awaiting coins to be deposited to cover the transaction. The seller can see how much coins have been deposited and how much remain to cover the transaction.
When the buyer clicks the Details view information about how much to deposit and into what address to deposit to is presented. Any coins already deposited and confirmed are visible here (if the buyer makes several smaller deposits to cover the transaction for instance).
The buyer now transfers coins into the given address using any means he feel comfortable with. In this example we use the Dogecoin Core Wallet software.
When the coins have been transferred a green check mark appear to let the users know that enough coins have been deposited.
When the buyer clicks Details now information about the fact that enough coins have been deposited and that the seller can now request a release is presented. At this stage the seller can be confident that coins to cover the transaction exists and can not be retaken by the buyer. So, it’s safe to transfer any purchased item and then request a release of the coins.
In the sellers Details window for the transaction the option to request a release of the coins present a few fields of information for the seller to enter. The address to which the coins should be withdrawn should be entered (and reentered to minimize the risk of the seller entering the wrong address) and the users password (or unique pass phrase if that was used) to sign the withdraw request. The reason the address to withdraw to has to be entered here is to make sure there is no single site wide address used for the user that could in some way be manipulated. Here the seller instead has the power to decide the destination at the point of requesting the withdraw.
After the release request has been sent the seller will see information about the release awaiting the buyer to confirm it.
After the seller has sent a request to release the coins, the buyer will have the option to release the coins. The key used to protect the transaction must be entered and after that the coins are withdrawn and sent to the address supplied by the seller.
The transaction will now move into the users Historic Transactions list and buyer will see information about the fact that the coins are released.
The seller will see that the coins have been released and the TxId of the transaction.
Clicking this link will take the seller to detailed information about the transaction.
To get this functionality into your hands as quickly as possible a few things had to wait. For instance, the UI could use some love. I will probably do this along with the site wide graphical update. Also, Auctions (that don’t register deals in the same way) don’t use this system yet. Those of you who use auctions a lot could tell me how they would like it to work for auctions. One option is to allow auctions to close like normal and then have a button to Create Transaction Request for that deal after the auction is closed. Another option would be to allow the seller to select if the escrow system is to be used when creating the ad. Then the transaction request could be automatically created when the auction closes.
External escrow service
I intend to provide the option to use the escrow system even when not connecting transactions to deals on the site. But that will come at a later date once all possible kinks have been worked out.