From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from sog-mx-3.v43.ch3.sourceforge.com ([172.29.43.193] helo=mx.sourceforge.net) by sfs-ml-4.v29.ch3.sourceforge.com with esmtp (Exim 4.76) (envelope-from ) id 1YIY3d-0001sF-DZ for bitcoin-development@lists.sourceforge.net; Tue, 03 Feb 2015 07:38:01 +0000 X-ACL-Warn: Received: from mail-pa0-f42.google.com ([209.85.220.42]) by sog-mx-3.v43.ch3.sourceforge.com with esmtps (TLSv1:RC4-SHA:128) (Exim 4.76) id 1YIY3c-0002On-DC for bitcoin-development@lists.sourceforge.net; Tue, 03 Feb 2015 07:38:01 +0000 Received: by mail-pa0-f42.google.com with SMTP id bj1so93058392pad.1 for ; Mon, 02 Feb 2015 23:37:54 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:message-id:date:from:user-agent:mime-version:to :cc:subject:references:in-reply-to:content-type; bh=Aw7PChStORaRtALKvf02EsEAJqQ2aqQD70bEPZR4Ll8=; b=hBMY4zUURq9ARkYHFnJZ6Ee+UlEXO6HMx2IvwupJRXC1RQC3VSp+bB5NzWBYCNnCLT to52CzwfPqUvvQWB/ePQ4EAxM1iku3B124Oev05zSyPdsVQ1qtZ49mBAgNiQqrTimsny MyICaPlbgiQgnDmMPY2qXlmVs/fE8msjCJwxPmhWyCO825GbNePPA0nvoF3IZLZMLsaL y4CmJor4W43eWf1L60fdsDBMalHuFG5FWEk7xomseQiCXJHm11Sldyz6q9inChY9CCk+ T7lcnE4avVa0byprzA73HxoBbFH3nqIdBCQcpj2PJId7ZyAfleHF1IBtWnAqMBxMQvSD UPxw== X-Gm-Message-State: ALoCoQkZe/PmE2iji+uQXrDXaXBzRamSO9mL0kTHH45W562B95P33S0Ko5rzawc15dW7LSeGE8GR X-Received: by 10.66.157.67 with SMTP id wk3mr35727120pab.95.1422949074701; Mon, 02 Feb 2015 23:37:54 -0800 (PST) Received: from [10.0.1.3] (c-50-135-46-157.hsd1.wa.comcast.net. [50.135.46.157]) by mx.google.com with ESMTPSA id se7sm1157591pbc.84.2015.02.02.23.37.53 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 02 Feb 2015 23:37:53 -0800 (PST) Message-ID: <54D07ADF.8060809@voskuil.org> Date: Mon, 02 Feb 2015 23:38:07 -0800 From: Eric Voskuil User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.2.0 MIME-Version: 1.0 To: Brian Erdelyi References: <27395C55-CF59-4E65-83CA-73F903272C5F@gmail.com> <54CE3816.6020505@bitwatch.co> <68C03646-02E7-43C6-9B73-E4697F3AA5FD@gmail.com> <57186618-F010-42E6-A757-B617C4001B5B@gmail.com> <4B53C1B0-A677-4460-8A69-C45506424D7F@gmail.com> In-Reply-To: <4B53C1B0-A677-4460-8A69-C45506424D7F@gmail.com> Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="OePMnpOnUnTbefN7g2jiaeXFFiEBo2gKA" X-Spam-Score: 0.0 (/) X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. X-Headers-End: 1YIY3c-0002On-DC Cc: Bitcoin Dev Subject: Re: [Bitcoin-development] Proposal to address Bitcoin malware X-BeenThere: bitcoin-development@lists.sourceforge.net X-Mailman-Version: 2.1.9 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 03 Feb 2015 07:38:01 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --OePMnpOnUnTbefN7g2jiaeXFFiEBo2gKA Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 02/02/2015 11:58 AM, Brian Erdelyi wrote:> >>Confusing or not, the reliance on multiple signatures as offering >>greater security than single relies on the independence of multiple >secrets. If the secrets cannot be shown to retain independence in the >>envisioned threat scenario (e.g. a user's compromised operating >>system) then the benefit reduces to making the exploit more difficult >>to write, which, once written, reduces to no benefit. Yet the user >>still suffers the reduced utility arising from greater complexity, >>while being led to believe in a false promise. > >Just trying to make sure I understand what you=E2=80=99re saying. Are y= ou >eluding to that if two of the three private keys get compromised there >is no gain in security? Although the likelihood of this occurring is >lower, it is possible. No, that's not it. Sorry for not being clear. Independence of control is the central issue in the analysis of a multiple factor system. If an attack compromises one factor there must be no way for that attack to reduce the difficulty of obtaining the other factors. Some factors (secrets), like a fingerprint, aren't very secret at all. But getting someone's fingerprint doesn't also help the attacker get a PIN. That factor must be attacked independently. But if the PIN is encrypted with the fingerprint in a public store, then the PIN is not independent of the fingerprint and there is really only one secret. If multiple factors are coincident (located within the same security perimeter) they are compromized coincidentally. Coincidence has the same effect as dependence. Consider a credit card with a "security code" printed on the back. A successful attack on the leather wallet yields both secrets. Individual environments can be compromised with some difficulty (e.g. desktop malware, fingerprint lift, dictionary attack, brute force PIN, etc.). For the sake of simplicity, let that chance of successful independent attack on any factor be 1 in 2 and the resulting probability of successful concurrent attack on any n factors be 1 in 2^n. If m factors are dependent/coincident on others the relation becomes 1 in 2^(n-m). Any multi-factor web wallet that handles the user's keys in the browser and authenticates the user in the browser to authorize service signing is effectively single factor. One attack may be launched by an insider, or externally, against the web app, executing in the browser, gaining coincident access to two secrets. Browser/desktop malware can accomplish the same. The difficulty is 1 in 2 vs. the expected 1 in 4. >As more malware targets bitcoins I think the utility is evident. >Given how final Bitcoin transactions are, I think it=E2=80=99s worth try= ing to >find methods to help verify those transactions (if a user deems it to >be high-risk enough) before the transaction is completed. The balance >is trying to devise something that users do not find too burdensome. I'm not questioning the motive, I agree it's worth trying. But trying is not succeeding. Increasing user (and/or system) complexity without increasing integrity or privacy is a poor trade, and worse if the user is misled. e --OePMnpOnUnTbefN7g2jiaeXFFiEBo2gKA Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBAgAGBQJU0HrfAAoJEDzYwH8LXOFOm7wH/3Le7NkDCCuw740bIdxLQWjg Vk1eMXJSFaChc1cfpwTNqFJwbU+um5ZZtB6JRQMtrQnP85lwQoy1SQxEsbq/QUj/ AGLFw4sdFlhCQRW6qr8TLdS0KnZoKYUCbFbJ/6Q4Q+6DWpXELm5mUpTYH2l5Dk4o yVA3sMEZNU8vtTmghM/4c46zm1w3NvMM9XanVS9xFh9/BMkNCvhdq2dbtt/ioXEj gPM7Jqtv1GPUFbkWiB+0yUmmUKhNlKjh3J9RcPzDa/UXjBJGMqNcEEhnBEjkDNfI jh4MImTSkux5qrXZ35C8f+aCE0M12BXSXyfWOLlMofChUb2d4pX1Wy8pi30oY64= =xRqh -----END PGP SIGNATURE----- --OePMnpOnUnTbefN7g2jiaeXFFiEBo2gKA--