Is Bitcoin security worth $1B? • Hacker News Board

Re: Is Bitcoin security worth $1B?

#31

Post by asdfaoeu » Tue, Jul 01, 2014, 6:31 PM UTC

CatheryneN wrote: post #12

jimrandomh wrote: post #8

Yes, multi-signature transactions can greatly improve security. But this idea of using a third party to write your transactions for you is a very, very bad idea. It introduces an additional point of failure for security: someone can break into their server, and make it start generating transactions that send coins somewhere other than where you said. Writing software that uses this API would be negligence.

Someone can also break into your servers and manipulate your transactions. It's our business to run a secure and reliable service. Bitcoin infrastructure is fairly complex and so the probably that you'll miss something are pretty high. Isn't it better to focus on your own business rather that spend all your time and money building and maintaining the backend piece?

> Someone can also break into your servers and manipulate your transactions. It's our business to run a secure and reliable service

And now they have two servers they can break into?

Re: Is Bitcoin security worth $1B?

#32

Post by mriou » Tue, Jul 01, 2014, 6:32 PM UTC

asdfaoeu wrote: post #30

mriou wrote: post #11

Earlier quoted context omitted.

This is incorrect. You can have servers using multisig too, it increases the overall security of the transactions, especially if the different private keys are stored in different environments (different datacenters, different OS, etc.). Regarding the blind signature: yes, you can check it and in most cases it's just checking a series of bytes at a given position in an array. One line of code. Building a multisig tra…

> Regarding the blind signature: yes, you can check it and in most cases it's just checking a series of bytes at a given position in an array. One line of code. Building a multisig transaction locally? Good-luck doing that. Code? Better yet include it on your examples.

Will do, thanks a lot for the feedback.

Re: Is Bitcoin security worth $1B?

#33

Post by kordless » Wed, Jul 02, 2014, 5:35 PM UTC

moe wrote: post #26

kordless wrote: post #23

Earlier quoted context omitted.

I don't understand multisig well, but isn't the point that 2 or more people sign a transaction to cooperate on an address? You claim BlockCypher is asking the user to sign a transaction they created for him, but from what I understand that has to happen with multisig to work. There has to be a common destination everyone agrees on to fund - someone has to create that destination and the rules governing it. From their…

From what I see their API attempts to decouple two things that can not be decoupled; the creation and the signing of transactions (whether they are multisig or not). I'm not even sure what benefit that is supposed to bring, but apparently they believe it is easier for developers to use a remote JSON API instead of a local bitcoin library[1] to generate transaction payloads. The problem is that it is not trivial to in…

Thank you for the detailed answer. It would appear wording/code that shows how to validate the transaction is in order.