From: Eric Voskuil <eric@voskuil•org>
To: Brian Erdelyi <brian.erdelyi@gmail•com>
Cc: Bitcoin Dev <bitcoin-development@lists•sourceforge.net>
Subject: Re: [Bitcoin-development] Proposal to address Bitcoin malware
Date: Mon, 2 Feb 2015 11:45:49 -0700 [thread overview]
Message-ID: <F4C9E954-6A29-4A31-B09B-7F0B62270EF8@voskuil.org> (raw)
In-Reply-To: <57186618-F010-42E6-A757-B617C4001B5B@gmail.com>
Confusing or not, the reliance on multiple signatures as offering greater security than single relies on the independence of multiple secrets. If the secrets cannot be shown to retain independence in the envisioned threat scenario (e.g. a user's compromised operating system) then the benefit reduces to making the exploit more difficult to write, which, once written, reduces to no benefit. Yet the user still suffers the reduced utility arising from greater complexity, while being led to believe in a false promise.
> On Feb 2, 2015, at 11:35 AM, Brian Erdelyi <brian.erdelyi@gmail•com> wrote:
>
>
>> Bitcoin Authenticator is a desktop app+mobile app pair. It pairs with your phone over wifi, cloud push, maybe Bluetooth as well. I forget exactly.
>>
>> It's done in the same way as Lighthouse, so it runs Win/Mac/Linux on desktop and Android on mobile.
>>
>> It could be adapted to use BitGo as a third party key holder with SMS authenticator relatively easily, I think. We did the bulk of all the needed work last year as part of the bitcoinj multisig work. Then you'd have a server involved, but not a web app.
>
> I really like the concept of Bitcoin Authenticator and think it’s exactly what I was describing (without a third-party).
>
> I think it’s a bit confusing when they describe Bitcoin Authenticator as 2FA. I think it may be more accurate to describe it as out of band transaction verification/signing or dual transaction signing. Regardless, it’s very exciting to see others are thinking about this too.
>
> Brian Erdelyi
> ------------------------------------------------------------------------------
> Dive into the World of Parallel Programming. The Go Parallel Website,
> sponsored by Intel and developed in partnership with Slashdot Media, is your
> hub for all things parallel software development, from weekly thought
> leadership blogs to news, videos, case studies, tutorials and more. Take a
> look and join the conversation now. http://goparallel.sourceforge.net/
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development@lists•sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
next prev parent reply other threads:[~2015-02-02 18:46 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-01-31 22:15 Brian Erdelyi
2015-01-31 22:38 ` Natanael
2015-01-31 23:04 ` Brian Erdelyi
2015-01-31 23:37 ` Natanael
2015-01-31 23:41 ` Natanael
2015-02-01 12:49 ` Brian Erdelyi
2015-02-01 13:31 ` Martin Habovštiak
2015-02-01 13:46 ` Mike Hearn
2015-02-01 13:54 ` Brian Erdelyi
2015-02-01 13:48 ` Mike Hearn
2015-02-01 14:28 ` mbde
2015-02-02 17:40 ` Brian Erdelyi
2015-02-02 17:54 ` Martin Habovštiak
2015-02-02 17:59 ` Mike Hearn
2015-02-02 18:02 ` Martin Habovštiak
2015-02-02 18:25 ` Mike Hearn
2015-02-02 18:35 ` Brian Erdelyi
2015-02-02 18:45 ` Eric Voskuil [this message]
2015-02-02 19:58 ` Brian Erdelyi
2015-02-02 20:57 ` Joel Joonatan Kaartinen
2015-02-02 21:03 ` Brian Erdelyi
2015-02-02 21:09 ` Pedro Worcel
2015-02-02 21:30 ` devrandom
2015-02-02 21:49 ` Brian Erdelyi
2015-02-02 21:42 ` Brian Erdelyi
2015-02-02 21:02 ` Pedro Worcel
2015-02-03 7:38 ` Eric Voskuil
2015-02-02 18:10 ` Brian Erdelyi
2015-02-02 18:07 ` Brian Erdelyi
2015-02-02 18:05 ` Eric Voskuil
2015-02-02 18:53 ` Mike Hearn
2015-02-02 22:54 ` Eric Voskuil
2015-02-03 0:41 ` Eric Voskuil
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=F4C9E954-6A29-4A31-B09B-7F0B62270EF8@voskuil.org \
--to=eric@voskuil$(echo .)org \
--cc=bitcoin-development@lists$(echo .)sourceforge.net \
--cc=brian.erdelyi@gmail$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox