From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from sog-mx-3.v43.ch3.sourceforge.com ([172.29.43.193] helo=mx.sourceforge.net) by sfs-ml-4.v29.ch3.sourceforge.com with esmtp (Exim 4.76) (envelope-from ) id 1YIM0n-0006rK-2o for bitcoin-development@lists.sourceforge.net; Mon, 02 Feb 2015 18:46:17 +0000 X-ACL-Warn: Received: from mail-pa0-f44.google.com ([209.85.220.44]) by sog-mx-3.v43.ch3.sourceforge.com with esmtps (TLSv1:RC4-SHA:128) (Exim 4.76) id 1YIM0m-0006nW-1P for bitcoin-development@lists.sourceforge.net; Mon, 02 Feb 2015 18:46:17 +0000 Received: by mail-pa0-f44.google.com with SMTP id rd3so85528712pab.3 for ; Mon, 02 Feb 2015 10:46:10 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:references:mime-version:in-reply-to:content-type :content-transfer-encoding:message-id:cc:from:subject:date:to; bh=4zBn0ykEs2CMhLXMqXm8Ntc8Qc+y/hsnU4hVn32EoLQ=; b=FjbaBVaHs8S/1UPJ4SR1317CaRaEg7FhIEDI2444e6oqAkw9ZFbRea2G5CQTTbhLNL +fM5vkorVOI/oAt5jgAmd/UPAd9qm6WqlZw8QL5xz+XA3hol/uD2/okAFjQ+4/Iasf5x yw3WNx4hVpinL3MoA3bab55dvKKZWGZIyVtQD5K5QyMypdv+NRn7FsIOvluxZARbaf9o OqjbaBTHAuLoT7CjIzVKcUL/EZFNnzaUIxHdOXLmL8oMU/D3y5yl9LJQ/fDENNEOgkZk SfTllypQwSGCxco/tnpMhVJR+NBOl+XYWjBgs0+IcqDhDyxUfWP4xHmmoNMJaFfCG0zy qfyg== X-Gm-Message-State: ALoCoQnUW7jV4q7c1AwUIaGWxVu3pOggrnhOfcN+pRPMm8weEteOlbqMs7aGyxqjT8c1oU+cRSD3 X-Received: by 10.66.249.133 with SMTP id yu5mr31680824pac.116.1422902770211; Mon, 02 Feb 2015 10:46:10 -0800 (PST) Received: from [10.85.245.255] (mobile-166-171-123-207.mycingular.net. [166.171.123.207]) by mx.google.com with ESMTPSA id g11sm19767896pat.24.2015.02.02.10.46.07 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Mon, 02 Feb 2015 10:46:09 -0800 (PST) References: <27395C55-CF59-4E65-83CA-73F903272C5F@gmail.com> <54CE3816.6020505@bitwatch.co> <68C03646-02E7-43C6-9B73-E4697F3AA5FD@gmail.com> <57186618-F010-42E6-A757-B617C4001B5B@gmail.com> Mime-Version: 1.0 (1.0) In-Reply-To: <57186618-F010-42E6-A757-B617C4001B5B@gmail.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Message-Id: X-Mailer: iPhone Mail (12B440) From: Eric Voskuil Date: Mon, 2 Feb 2015 11:45:49 -0700 To: Brian Erdelyi X-Spam-Score: 0.0 (/) X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. X-Headers-End: 1YIM0m-0006nW-1P Cc: Bitcoin Dev Subject: Re: [Bitcoin-development] Proposal to address Bitcoin malware X-BeenThere: bitcoin-development@lists.sourceforge.net X-Mailman-Version: 2.1.9 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 02 Feb 2015 18:46:17 -0000 Confusing or not, the reliance on multiple signatures as offering greater se= curity than single relies on the independence of multiple secrets. If the se= crets cannot be shown to retain independence in the envisioned threat scenar= io (e.g. a user's compromised operating system) then the benefit reduces to m= aking the exploit more difficult to write, which, once written, reduces to n= o benefit. Yet the user still suffers the reduced utility arising from great= er complexity, while being led to believe in a false promise. > On Feb 2, 2015, at 11:35 AM, Brian Erdelyi wrote= : >=20 >=20 >> Bitcoin Authenticator is a desktop app+mobile app pair. It pairs with you= r phone over wifi, cloud push, maybe Bluetooth as well. I forget exactly.=20= >>=20 >> It's done in the same way as Lighthouse, so it runs Win/Mac/Linux on desk= top and Android on mobile. >>=20 >> It could be adapted to use BitGo as a third party key holder with SMS aut= henticator relatively easily, I think. We did the bulk of all the needed wor= k last year as part of the bitcoinj multisig work. Then you'd have a server i= nvolved, but not a web app. >=20 > I really like the concept of Bitcoin Authenticator and think it=E2=80=99s e= xactly what I was describing (without a third-party). >=20 > I think it=E2=80=99s a bit confusing when they describe Bitcoin Authentica= tor as 2FA. I think it may be more accurate to describe it as out of band t= ransaction verification/signing or dual transaction signing. Regardless, it= =E2=80=99s very exciting to see others are thinking about this too. >=20 > Brian Erdelyi > --------------------------------------------------------------------------= ---- > Dive into the World of Parallel Programming. The Go Parallel Website, > sponsored by Intel and developed in partnership with Slashdot Media, is yo= ur > hub for all things parallel software development, from weekly thought > leadership blogs to news, videos, case studies, tutorials and more. Take a= > look and join the conversation now. http://goparallel.sourceforge.net/ > _______________________________________________ > Bitcoin-development mailing list > Bitcoin-development@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/bitcoin-development