Re: [Bitcoin-development] Proposal to address Bitcoin malware

[Brian Erdelyi <brian.erdelyi@gmail.com>]

Martin,

Yes, the second signing could be done by a mobile device that I owned and controlled (I wasn't thinking that initially).  I was thinking that online services are popular because of convenience and there should be a better way to address security (privacy issues not withstanding).

I think these are practical approaches and just doing a sanity check.  Thanks for the vote of confidence.

Brian Erdelyi

Sent from my iPad

> On Feb 2, 2015, at 1:54 PM, Martin Habovštiak <martin.habovstiak@gmail.com> wrote:
> 
> Good idea. I think this could be even better:
> 
> instead of using third party, send partially signed TX from computer
> to smartphone. In case, you are paranoid, make 3oo5 address made of
> two cold storage keys, one on desktop/laptop, one on smartphone, one
> using third party.
> If it isn't enough, add requirement of another four keys, so you have
> three desktops with different OS (Linux, Windows, Mac) and three
> mobile OS (Android, iOS, Windows Phone), third party and some keys in
> cold storage. Also, I forgot HW wallets, so at least Trezor and
> Ledger. I believe this scheme is unpenetrable by anyone, including
> NSA, FBI, CIA, NBU...
> 
> Jokes aside, I think leaving out third party is important for privacy reasons.
> 
> Stay safe!
> 
> 2015-02-02 18:40 GMT+01:00 Brian Erdelyi <brian.erdelyi@gmail.com>:
>> Another concept...
>> 
>> It should be possible to use multisig wallets to protect against malware.  For example, a user could generate a wallet with 3 keys and require a transaction that has been signed by 2 of those keys.  One key is placed in cold storage and anther sent to a third-party.
>> 
>> It is now possible to generate and sign transactions on the users computer and send this signed transaction to the third-party for the second signature.  This now permits the use of out of band transaction verification techniques before the third party signs the transaction and sends to the blockchain.
>> 
>> If the third-party is malicious or becomes compromised they would not have the ability to complete transactions as they only have one private key.  If the third-party disappeared, the user could use the key in cold storage to sign transactions and send funds to a new wallet.
>> 
>> Thoughts?
>> ------------------------------------------------------------------------------
>> Dive into the World of Parallel Programming. The Go Parallel Website,
>> sponsored by Intel and developed in partnership with Slashdot Media, is your
>> hub for all things parallel software development, from weekly thought
>> leadership blogs to news, videos, case studies, tutorials and more. Take a
>> look and join the conversation now. http://goparallel.sourceforge.net/
>> _______________________________________________
>> Bitcoin-development mailing list
>> Bitcoin-development@lists.sourceforge.net
>> https://lists.sourceforge.net/lists/listinfo/bitcoin-development