Is Bitcoin security worth $1B?

http://www.blockcypher.com/#!Multisig-API-Is-bitcoin-security-worth-1B/cw46/8F43399F-FD98-49E0-A41D-58291EB436AA

by mriou • 12 years ago

42 31 12 years ago

FBT• 12 years ago

A quick read of the title left me rather confused: Are they seriously asking the question "Is Bitcoin worth 1฿?"

A tautology indeed. Only upon reading the article itself did I realize I misread the title: I had both skipped over the word "security", and misinterpreted the B as the Bitcoin symbol, rather than an abbreviation for a billion.

collyw• 12 years ago

prime numbers worth 1 billion....?

moe5• 12 years ago

Reminder: For anything but toy apps you do not want to relay your interactions with the blockchain through a third party.

asdfaoeu4• 12 years ago

To be clear really relaying transactions through a server is probably fine. The problem with this one is the api let's the server generate the transaction and the client just blindly signs it. You are completely trusting the server in this scenario.

mriou5• 12 years ago

Not blindly, you see both the generated transaction and the data to sign, you can validate either or both. And you are completely trusting a server in many other situations.

asdfaoeu4• 12 years ago

Multiple signature (multisig) transactions would have prevented all of it.

Yeah, no, there's still a need for hot wallets which can be spent automatically by a server and these were basically the only ones stolen. You actually have to keep the keys separate for it to make a difference.

Also their api is borderline retarded. The server passes back a hash to sign and the client is just supposed to blindly sign it. Sure I suppose it could check it but then why wouldn't you just build it locally.

cheez• 12 years ago

It is kind of ironic that people who are using a currency dependent on the security of crypto operations created an API that commits a fundamental mistake: trusting the data you receive.

CatheryneN3• 12 years ago

You don't have to trust our data - you can check it against the multitude of block explorers available in the market. However, if you use blockchain.info to check, be aware that they do not support pay-to-script transactions and will not show the transaction until it's confirmed. And you can easily check the received data.

The security of our APIs lies in the fact we don't store private keys - the user signs their own transaction.

Anderkent• 12 years ago

Yeah, no, there's still a need for hot wallets which can be spent automatically by a server and these were basically the only ones stolen.

The point is that you don't need a hot wallet if you support multisig - the coins never go to the service provider, they stay in the users wallet.

kolinko• 12 years ago

Depends on what you're trying to do. If you want to run an exchange, the exchange needs full access to keys. Unless it's an exchange running on a smart contract on distributed oracles ( http://orisi.org ) :)

mriou5• 12 years ago

This is incorrect. You can have servers using multisig too, it increases the overall security of the transactions, especially if the different private keys are stored in different environments (different datacenters, different OS, etc.).

Regarding the blind signature: yes, you can check it and in most cases it's just checking a series of bytes at a given position in an array. One line of code. Building a multisig transaction locally? Good-luck doing that.

Also I've heard many times arguments along the lines of "my security is better than yours, I don't trust you". It's reminiscent of those arguments about cloud providers like AWS, "my outages are better than yours". The point is we are focusing solely on block chain infrastructure: the security, performance,and reliability. It's our expertise. Is it yours?

moe5• 12 years ago

I guess this is where sufficiently advanced incompetence becomes indistinguishable from malice.

In either case, I strongly advise everyone to refrain from ever using any bitcoin service that you may be involved with.

asdfaoeu4• 12 years ago

Regarding the blind signature: yes, you can check it and in most cases it's just checking a series of bytes at a given position in an array. One line of code. Building a multisig transaction locally? Good-luck doing that.

Code? Better yet include it on your examples.

jimrandomh• 12 years ago

Yes, multi-signature transactions can greatly improve security. But this idea of using a third party to write your transactions for you is a very, very bad idea. It introduces an additional point of failure for security: someone can break into their server, and make it start generating transactions that send coins somewhere other than where you said.

Writing software that uses this API would be negligence.

CatheryneN3• 12 years ago

Someone can also break into your servers and manipulate your transactions. It's our business to run a secure and reliable service. Bitcoin infrastructure is fairly complex and so the probably that you'll miss something are pretty high. Isn't it better to focus on your own business rather that spend all your time and money building and maintaining the backend piece?

nightpool• 12 years ago

Then release/sell a library. Don't expect Bitcoin users (who, especially the early adopters, are almost tautologically more likely to distrust centralized services). Library code can be audited, and guaranteed to do what it advertizes.

asdfaoeu4• 12 years ago

Someone can also break into your servers and manipulate your transactions. It's our business to run a secure and reliable service

And now they have two servers they can break into?

Ryel• 12 years ago

Because of the amount of real money invested, I would (somewhat jokingly) say that securing Bitcoins is a business more valuable than Bitcoin itself.

matthewbauer• 12 years ago

We already spend a total of $15 million dollars per day in energy costs[1] making secure transactions in Bitcoin, so I think in a way we're already spending more than $5 billion on Bitcoin security.

[1] http://www.forbes.com/sites/timworstall/2013/12/03/fascinati...

kordless3• 12 years ago

I ran the numbers on newer mining rigs a few weeks ago and came up with a PH/s needing about 1 semi tractor trailer engine to run. The network is currently doing about 130PH/s, so that's about 130 semis engines running. Not anything to sneeze about, but also definitely not $15M a day.

Is Bitcoin security worth $1B?

Related Stories