Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Multisig Vault

coinbase.com

Post reply on HN
Print view View original

21–30 of 40 posts

Re: Multisig Vault

#21

Post by sillysaurus3 »

adrianmacneil wrote: post #20
sillysaurus3 wrote: post #10

Keys are created and encrypted in the browser Key hijack in 5... 4... 3... Browser crypto isn't secure. One way to offset the risk is to use a browser plugin to perform the crypto operations, and even that isn't really a security guarantee. When you combine an incentive to break crypto (money) with a straightforward route to breaking it (browser crypto), you get a pretty dangerous situation.

The only argument here is that crypto on internet connected (and potentially compromised) devices is insecure. There's nothing inherently more insecure about browser crypto. Our multisig vault relies on BitcoinJS, which we had audited by an external consulting firm. We also don't allow multisig vault creation on browsers which don't support crypto.getRandomValues()

The only argument here is that crypto on internet connected (and potentially compromised) devices is insecure.

Actually, that's pretty far from the standard arguments: http://matasano.com/articles/javascript-cryptography/

That's pretty much the seminal work of why browser crypto is insecure.

The issue isn't whether the primitives you're using are secure. It's that the security of your primitives can be hijacked by any third-party javscript you load into the page. Any attacker that can gain a foothold into your javascript execution environment can trivially subvert your security.

Re: Multisig Vault

#22

Post by firepacket »

sillysaurus3 wrote: post #21
adrianmacneil wrote: post #20

Earlier quoted context omitted.

The only argument here is that crypto on internet connected (and potentially compromised) devices is insecure. There's nothing inherently more insecure about browser crypto. Our multisig vault relies on BitcoinJS, which we had audited by an external consulting firm. We also don't allow multisig vault creation on browsers which don't support crypto.getRandomValues()

The only argument here is that crypto on internet connected (and potentially compromised) devices is insecure. Actually, that's pretty far from the standard arguments: http://matasano.com/articles/javascript-cryptography/ That's pretty much the seminal work of why browser crypto is insecure. The issue isn't whether the primitives you're using are secure. It's that the security of your primitives can be hijacked by an…

Assuming your are using SSL, what exactly is the attack vector for getting a "foothold into your javascript execution" besides hacking Coinbase itself?

Also, any attacker who gains a foothold of your operating system execution environment can trivially subvert your security as well. Does that mean crypto is broken on PCs?

Re: Multisig Vault

#23

Post by wmf »

firepacket wrote: post #22
sillysaurus3 wrote: post #21

Earlier quoted context omitted.

The only argument here is that crypto on internet connected (and potentially compromised) devices is insecure. Actually, that's pretty far from the standard arguments: http://matasano.com/articles/javascript-cryptography/ That's pretty much the seminal work of why browser crypto is insecure. The issue isn't whether the primitives you're using are secure. It's that the security of your primitives can be hijacked by an…

Assuming your are using SSL, what exactly is the attack vector for getting a "foothold into your javascript execution" besides hacking Coinbase itself? Also, any attacker who gains a foothold of your operating system execution environment can trivially subvert your security as well. Does that mean crypto is broken on PCs?

what exactly is the attack vector for getting a "foothold into your javascript execution"?

Browser extensions? Those have been stealing BTC for a while.

Re: Multisig Vault

#25

Post by sillysaurus3 »

firepacket wrote: post #22
sillysaurus3 wrote: post #21

Earlier quoted context omitted.

The only argument here is that crypto on internet connected (and potentially compromised) devices is insecure. Actually, that's pretty far from the standard arguments: http://matasano.com/articles/javascript-cryptography/ That's pretty much the seminal work of why browser crypto is insecure. The issue isn't whether the primitives you're using are secure. It's that the security of your primitives can be hijacked by an…

Assuming your are using SSL, what exactly is the attack vector for getting a "foothold into your javascript execution" besides hacking Coinbase itself? Also, any attacker who gains a foothold of your operating system execution environment can trivially subvert your security as well. Does that mean crypto is broken on PCs?

any attacker who gains a foothold of your operating system execution environment can trivially subvert your security as well. Does that mean crypto is broken on PCs?

Yes, of course your crypto is broken if an attacker has malware running on your device. The difference between that scenario and Coinbase is that your device only affects you. A break in Coinbase's security will affect hundreds of thousands of people.

Assuming your are using SSL, what exactly is the attack vector for getting a "foothold into your javascript execution" besides hacking Coinbase itself?

There are at least three vectors. First, XSS. If Coinbase ever has an XSS vuln which allows JS to execute in the same context as their crypto key generation, then that attacker can silently siphon keys as they're being generated. Once enough keys are under their control, they can transfer the BTC of every account they control to the attackers' own wallet.

Second attack vector: Third-party JS libraries. If Coinbase is loading JS from any external source, any rogue employee from that source can launch the above attack. This attack may seem unlikely, but greed makes people do strange things, and the amount of money able to be stolen from a successful attack on Coinbase will be in the range of millions, if enough users start using multisig vault.

The third attack vector, which a sibling comment mentioned, is a rogue browser extension. Several extensions request permissions on "all websites," and users happily approve them. Now, you can say "Those people deserve what they get," but that's unproductive victim blaming. The fact is that users already behave this way, and letting them lose thousands of dollars for approving some silly extension like "Cloud To Butt" isn't a good thing.

Banks do a pretty good job of defending people's money. If they lose people's money because they're attacked, the bank will still credit the money. Would Coinbase?

Re: Multisig Vault

#26

Post by icebraining »

adrianmacneil wrote: post #18
jerguismi wrote: post #12

Earlier quoted context omitted.

Which makes me wonder... The keys are generated in-browser. What if the users computer is compromised, and a malware succeeds in capturing the keys + bip38 passphrase? I don't know if this product will be pain in the ass for coinbase, if the user funds start disappearing from these multisig addresses. All the best luck for this product, though.

If the computer is infected, then yes it would be possible to steal both the private keys, and the passphrase. To avoid this attack scenario, we're investing pretty heavily in technologies such as CSP. However, this can be mitigated with our group multisig vault, where separate users create their own keys. For malware to steal these, it would require infecting multiple computers.

Seems like the next step would be to allow the users to store their copies on a smart card instead of a PC.

Re: Multisig Vault

#27

Post by wcummings »

adrianmacneil wrote: post #18
jerguismi wrote: post #12

Earlier quoted context omitted.

Which makes me wonder... The keys are generated in-browser. What if the users computer is compromised, and a malware succeeds in capturing the keys + bip38 passphrase? I don't know if this product will be pain in the ass for coinbase, if the user funds start disappearing from these multisig addresses. All the best luck for this product, though.

If the computer is infected, then yes it would be possible to steal both the private keys, and the passphrase. To avoid this attack scenario, we're investing pretty heavily in technologies such as CSP. However, this can be mitigated with our group multisig vault, where separate users create their own keys. For malware to steal these, it would require infecting multiple computers.

CSP?

Re: Multisig Vault

#28

Post by vijayboyapati »

The most powerful part of multi-sig is not that you can have arbitrarily many M of N, but that you can outsource complex policy in a trusted way. E.g., create policy that lower level employees can control a small percentage of a company's holdings, while higher level employees can control a higher percent. It allows you to implement flexibility that exists in the credit system, without giving up the trust/control that comes from the blockchain system. This is a very valuable upgrade to Coinbase's feature set. Great work guys!

Re: Multisig Vault

#29

Post by floatrock »

wcummings wrote: post #27
adrianmacneil wrote: post #18

Earlier quoted context omitted.

If the computer is infected, then yes it would be possible to steal both the private keys, and the passphrase. To avoid this attack scenario, we're investing pretty heavily in technologies such as CSP. However, this can be mitigated with our group multisig vault, where separate users create their own keys. For malware to steal these, it would require infecting multiple computers.

CSP?

Content Security Policy -- http://en.wikipedia.org/wiki/Content_Security_Policy

basically headers that can tell the browser not to execute stuff that leads to injection like inline javascript or inline styling, allows for whitelists of domains (so the browser won't run script src="http://hackercdn.com/malicious.js"), etc.

Re: Multisig Vault

#30

Post by BillinghamJ »

sillysaurus3 wrote: post #25
firepacket wrote: post #22

Earlier quoted context omitted.

Assuming your are using SSL, what exactly is the attack vector for getting a "foothold into your javascript execution" besides hacking Coinbase itself? Also, any attacker who gains a foothold of your operating system execution environment can trivially subvert your security as well. Does that mean crypto is broken on PCs?

any attacker who gains a foothold of your operating system execution environment can trivially subvert your security as well. Does that mean crypto is broken on PCs? Yes, of course your crypto is broken if an attacker has malware running on your device. The difference between that scenario and Coinbase is that your device only affects you. A break in Coinbase's security will affect hundreds of thousands of people. As…

Coinbase is insured, so in theory yes.
Post reply on HN