Re: [Bitcoin-development] Proposal to address Bitcoin malware

[Eric Voskuil <eric@voskuil.org>]

Confusing or not, the reliance on multiple signatures as offering greater security than single relies on the independence of multiple secrets. If the secrets cannot be shown to retain independence in the envisioned threat scenario (e.g. a user's compromised operating system) then the benefit reduces to making the exploit more difficult to write, which, once written, reduces to no benefit. Yet the user still suffers the reduced utility arising from greater complexity, while being led to believe in a false promise.


> On Feb 2, 2015, at 11:35 AM, Brian Erdelyi <brian.erdelyi@gmail.com> wrote:
> 
> 
>> Bitcoin Authenticator is a desktop app+mobile app pair. It pairs with your phone over wifi, cloud push, maybe Bluetooth as well. I forget exactly. 
>> 
>> It's done in the same way as Lighthouse, so it runs Win/Mac/Linux on desktop and Android on mobile.
>> 
>> It could be adapted to use BitGo as a third party key holder with SMS authenticator relatively easily, I think. We did the bulk of all the needed work last year as part of the bitcoinj multisig work. Then you'd have a server involved, but not a web app.
> 
> I really like the concept of Bitcoin Authenticator and think it’s exactly what I was describing (without a third-party).
> 
> I think it’s a bit confusing when they describe Bitcoin Authenticator as 2FA.  I think it may be more accurate to describe it as out of band transaction verification/signing or dual transaction signing.  Regardless, it’s very exciting to see others are thinking about this too.
> 
> Brian Erdelyi
> ------------------------------------------------------------------------------
> Dive into the World of Parallel Programming. The Go Parallel Website,
> sponsored by Intel and developed in partnership with Slashdot Media, is your
> hub for all things parallel software development, from weekly thought
> leadership blogs to news, videos, case studies, tutorials and more. Take a
> look and join the conversation now. http://goparallel.sourceforge.net/
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development