Why rely on hardware wallets use Escrow

[Di3twater]

Why rely on hardware wallets store your XRP securely on the XRP Blockchain in Escrow.

https://www.secureblockchains.com/reservoir

https://www.secureblockchains.com/reservoir/about

Reservoir is an escrow application that allows XRP investors to store their XRP directly on the ledger. As of now we believe it's the most secure way to store XRP long term.

https://www.secureblockchains.com/help

Edited November 30, 2017 by Di3twater

[zenkert]

I would not touch this site, just mouse_over. Potential Scam.

[rootvegetable]

I took a look at the site, nice design! I don't understand the escrow project though. Could you provide more details? Maybe a non technical yet in depth explanation of what happens to your xrp, and why you might that? Things I would want to know are does the xrp remain at my address (it looks like not really, but then what happens to them during and after escrow)? Do I need to provide my secret key in order to escrow my xrp? What are the fees? If escrow is a native feature of the xrpledger, the tech savy could do it themselves, and trusted wallet providers will be adding this feature in the future? Why is escrow more secure than a hardware wallet or a cold wallet? If the account using escrow is compromised, the funds won't be stolen until the end of the escrow period, true, but they could be as soon as it expires. Also, on the reservoir page is that the number of xrp in your escrow project, or the total number of xrp in escrow on the xrpledger? If someone had a detailed stats page of all xrp in escrow on the ledger that would be a site I would visit.

Good luck with your project!

[Di3twater]

1. The xrp you send to escrow does not remain in your wallet but is stored on the ledger as in object, effectively removing the xrp from the circulating supply, this is the same method ripple is using with their lockup, ripple does a great job explaining use cases for escrow here https://ripple.com/build/escrow/#why-escrow  and here you can find  an explanation of objects on the ledger https://ripple.com/build/reserves/#owner-reserves.
2. You do not need to provide a secret key we generate an xrp address for you much like an exchange, which you would fund and then use to escrow your xrp.  Upon creation of an escrow your default destination address which you provided at signup will be used as the destination address for that escrow. Your destination account can be changed before you submit an escrow but once the escrow is created it can not have its destination address changed. Once again ripple does a fine job explain this https://ripple.com/build/escrow-tutorials/ upon creation and release of your escrow we provide you all the info you need to monitor and verify your escrow.
3.  We take a 3% fee with current limitations being a minimum of 1 xrp and a minimum of 5min in the future for the mature date.
4. Escrow is a native feature of the xrp ledger and ripple encourages the industry to use it. 
5. Yes the number displayed on the Reservoir page is the current amount of xrp in escrow through Reservoir.
6. I'm happy you asked about a detailed stat page the guys over at toast wallet did an awesome job creating one which shows our escrow transactions.
7. In regards to the security of escrow I believe this quote from ripple does a fine job here is a link for reference https://ripple.com/build/escrow/#why-escrow  

   Quote

   Placing the money into escrow does not directly protect Ripple's holdings from malicious actors, but it sharply reduces the amount of XRP that can be quickly stolen or redirected if a malicious actor gains temporary control over Ripple's XRP accounts. This reduces the risk of catastrophic losses of XRP and increases the time for Ripple to detect, prevent, and track down unintended uses of Ripple's XRP assets.

    

[Sukrim]

 

16 minutes ago, Di3twater said:

In regards to your question about our libraries, users should not have an assumption that developer libraries are public by default and visible for all to see. Our libraries are only for use by our company and there are currently no plans to make them publicly available or "open source".

So users are expected to interact with your closed source service and trust you with their private keys while paying 3% fees + 20 XRP for a useless new account (which is spamming the ledger!) for a nicer interface to something that XRPL already natively supports? Security by obscurity doesn't work and at least visible code is an integral part of the trust model of cryptocurrency systems. Why would you be deserving trust from the community if you are acting contrary to best practices and industry standards?

[Di3twater]

@Sukrim You are mistaken we do not require or ask for your private key if you do not believe me just create an account. We generate an address that you fund with only the amount you need. I also don't understand why you are misrepresenting things, yes escrow is a native feature of the RCL but to access that feature on your own you need to write code its not something that exist as some simple GUI, and most people can't do this. You made an obvious misrepresentation and made it seem like we made a "nicer interface" for something that people can easily access. People can not easily access the RCL Escrow service with out significant amount of code and time.

We do not offer our source code which is actually best practice. Do you realize how easily companies could be compromised  by providing their source code to the public. You are confusing two different things a decentralized blockchain benefits from an open and public source code but a centralized company that is based around security does not.  Coinbase, Bitstamp and many other trusted centralized sites do not provide their source code to the public, what I think you believe to be source code on their respective GitHub pages are not source code to the  actual site but libraries that allow developers like me to interact with their services programmatically. Open source is truly a buzz word that most have just up and ran with with no understanding of its use cases.   

Quote

Why would you be deserving trust from the community if you are acting contrary to best practices and industry standards?

You have not even used the site before you started swinging at something that took more people and more time then the post you made. My team is worth more the free99 to allude that our fee is not justified is disrespectful to them. This is a post I made earlier I believe it is fitting now.

Quote

I hate to say it but the worst thing right now stopping a booming xrp developer ecosystem in some respect is the xrp community, there is way to many pessimistic members of the community I'm not sure where it comes from and why it is so prevalent but from my own experience and what I have seen of others, presenting an xrp based project to the community no matter the scope gets flagged down with the immortal words of SCAM! This is the first wall most developers will face with xrp.

    

[Sukrim]

It is trivial to do EscrowCreate transactions (https://ripple.com/build/transactions/#escrowcreate), they are one of the more simpler transaction types. It can be done even via a simple curl call (the whole "code" for that is smaller than this paragraph) and there is no need to fund an extra account for that. Some current wallets seem to lack support for this though, which is why I consider your solution as a nice(r) interface to submit a single transaction type, though with some flawed ideas.

There is no way for me to use your website since I don't agree to the ToS. If your code were public, I'd at least be able to take a look at that, otherwise all I can see is what you publish - and from what I see there is that you seem to have a nice idea in theory, but don't really understand XRPL concepts (as well as open source software).

Who holds the private keys for that "generated" account and (if it is the user, not you as a service provider) which software interacts with it? If it is your software, without source code, users need to trust you, even if they hold the key. You are NOT a productive member of the developer ecosystem here, you are just a service provider - and your service sounds bad, even though it seems to have some nice ideas in it.

[Di3twater]

@Sukrim It is not good to proclaim that you speak for a whole xrp community and it is not good to assume that every xrp investor has the skills to use terminal and knowledge of how to interface with the RCL. These things are in ripple's development section because ripple themselves meant for these tools to be used by developers to bring RCL functionality to others not for people to sit in a terminal window all day. It appears you never had any intent to use our service and it also appears you believe xrp investors would rather manage their xrp through terminal.

For those that do not know @Sukrim would have you interface with the xrp blockchain through this or some bash shell he believes this to be trivial for everyone .

If any of you are waiting for ripple or some other large "trusted entity" to start creating xrp solutions for consumers then keep waiting but if not we and other creators of this community will keep making awesome tools. I have put my personal identity out their for all to see and so has my co founder you are hiding behind an account name and claim to be the representative of the xrp developer community. 

[Sukrim]

I don't believe running a command through curl is trivial for everyone. I believe it does not take a "significant amount of code and time".

[Di3twater]

If you want low quality trash that is buggy, vulnerable and that just plain sucks sure copy and paste way but we are creating a service for end users not just for our personal use. 

[XRP200]

I personally have liked the idea of escrow since it’s inception and have wanted to try it, but know nothing about coding or programming. So for me, I like the idea of this service and would be willing to pay a small fee for it, if it works properly. I can only imagine how much time and effort goes into all this, and that certaintly is not free. I can see why people hesitate with new projects, because nobody wants to have their investments compromised, but people can be cautious and open minded at the same same. Anyone can try this service with a tiny amount of XRP, which is what I plan on doing. And you can even see the transaction on the ledger to confirm it. If people don’t like the project they don’t need to bash it, just ignore it. It’s disappointing because of all the communities, I would expect the XRP community to be one of the most tolerant and open minded, just look at what we’ve put up with over the years. At any rate, I appreciate the project and am interested to try it. I look forward to some of your other projects and that personal node/wallet idea from the video was really cool too.

[XRP200]

15 minutes ago, Sukrim said:

I don't believe running a command through curl is trivial for everyone. I believe it does not take a "significant amount of code and time".

For me and many of the people I personally know, it is. I don’t even know what curl is lol. I’m just saying, people value things differently based on knowledge, interests, time, etc, and for some a service like this might be worth it.

Edited December 2, 2017 by XRP200

[Di3twater]

@XRP200 We are pushing to bring the hardware wallet to prototype. We ran into some issues with arm processor compatibility which was addressed by David himself check it out and thanks for the support.

 

[Sukrim]

There were already ARM builds of rippled out there (https://forum.ripple.com/viewtopic.php?t=9724&p=62811#p63048), though I'm not so sure if running a full rippled node is the best way forward for a hardware wallet (it'll need a LOT of RAM for starters compared to most available mini computers like RPis). 

Just now, XRP200 said:

For me and many of the people personally know, it is. I don’t even know what curl is lol. I’m just saying, people value things differently based on knowledge, interests, time, etc, and for some a service might be worth it.

I could give you an app/website where you just need to enter your secret, an address a date+time and an amount of XRP, click send and you have created an escrow transaction. No email signup or password or iPhone app needed. I prefer not to though, since OP apparently based parts of his business on this idea and I don't really see a point in re-implementing something just for the sake of demonstrating how easy it actually is. On the other hand, it seems like he'll anyways thinks that it'll be buggy, vulnerable and just plain suck, so I might have a go at it when I have some spare time.

2 minutes ago, XRP200 said:

Anyone can try this service with a tiny amount of XRP, which is what I plan on doing.

Good luck. If they fund a full account for you, that's going to be at least 25 XRP locked up in addition to their fee, but I agree that the service itself might be a nice thing to have. Just make sure to not use too small amounts of XRP, there's a reason why they recommend 100+ USD in value.

Unfortunately the "if it works properly" part is not really verifiable even for experts since what is actually happening is internal to their service, so you have to trust the service operators (which are based somewhere on the internet and have an LLC). Hopefully they are worth that trust and also have appropriate measures in place to keep your data safe (after all they collect your email and combine it with a Ripple address from the get-go).

[Graine]

@Di3twater walk me through the process of using your service, please? 

1.  I deposit my XRP to the address your app generates for me. 
2. I select the time of release and the amount to be escrowed. 
3. Your app makes an EscrowCreate tx with parameters specified. 
4. Time passes
5. Your app sends EscrowFinish tx, escrow is released. 
   
   Question: do you specify expiration time, i.e. can you issue an EscrowCancel tx?