📅 Original date posted:2015-02-02 📝 Original message:Confusing or not, the ...

Eric Voskuil [ARCHIVE] /

npub1sgs…px3c

2023-06-07 15:29:17

in reply to nevent1q…2jqy

📅 Original date posted:2015-02-02
📝 Original message:Confusing or not, the reliance on multiple signatures as offering greater security than single relies on the independence of multiple secrets. If the secrets cannot be shown to retain independence in the envisioned threat scenario (e.g. a user's compromised operating system) then the benefit reduces to making the exploit more difficult to write, which, once written, reduces to no benefit. Yet the user still suffers the reduced utility arising from greater complexity, while being led to believe in a false promise.

> On Feb 2, 2015, at 11:35 AM, Brian Erdelyi <brian.erdelyi at gmail.com> wrote:
>
>
>> Bitcoin Authenticator is a desktop app+mobile app pair. It pairs with your phone over wifi, cloud push, maybe Bluetooth as well. I forget exactly.
>>
>> It's done in the same way as Lighthouse, so it runs Win/Mac/Linux on desktop and Android on mobile.
>>
>> It could be adapted to use BitGo as a third party key holder with SMS authenticator relatively easily, I think. We did the bulk of all the needed work last year as part of the bitcoinj multisig work. Then you'd have a server involved, but not a web app.
>
> I really like the concept of Bitcoin Authenticator and think it’s exactly what I was describing (without a third-party).
>
> I think it’s a bit confusing when they describe Bitcoin Authenticator as 2FA. I think it may be more accurate to describe it as out of band transaction verification/signing or dual transaction signing. Regardless, it’s very exciting to see others are thinking about this too.
>
> Brian Erdelyi
> ------------------------------------------------------------------------------
> Dive into the World of Parallel Programming. The Go Parallel Website,
> sponsored by Intel and developed in partnership with Slashdot Media, is your
> hub for all things parallel software development, from weekly thought
> leadership blogs to news, videos, case studies, tutorials and more. Take a
> look and join the conversation now. http://goparallel.sourceforge.net/
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development

Author Public Key

npub1sgs97fe0n9wehe6zw7drcxdz4cy9yt9pfqjv8gasz5jlk4zezc0quppx3c

Show more details

Published at

2023-06-07 15:29:17

Kind type

1 Short Text Note

Event JSON

{ "id": "541117cce66136b852807f3c018c123cc7bd6c4cc2dd6ab72618b506a8bad078", "pubkey": "82205f272f995d9be742779a3c19a2ae08522ca14824c3a3b01525fb5459161e", "created_at": 1686151757, "kind": 1, "tags": [ [ "e", "541657d412739d9d2a5bc263564b0f2ef650e16ac828484a06cbef551e18c76c", "", "root" ], [ "e", "9dd960b5ea81321e34373f272bb43a7d13f3498ca2f366b5be1817e54355b40c", "", "reply" ], [ "p", "5f57805600aff24704ce401a57e78ba1631be95f18e62e28fb3168e3be1ea5c5" ] ], "content": "📅 Original date posted:2015-02-02\n📝 Original message:Confusing or not, the reliance on multiple signatures as offering greater security than single relies on the independence of multiple secrets. If the secrets cannot be shown to retain independence in the envisioned threat scenario (e.g. a user's compromised operating system) then the benefit reduces to making the exploit more difficult to write, which, once written, reduces to no benefit. Yet the user still suffers the reduced utility arising from greater complexity, while being led to believe in a false promise.\n\n\n\u003e On Feb 2, 2015, at 11:35 AM, Brian Erdelyi \u003cbrian.erdelyi at gmail.com\u003e wrote:\n\u003e \n\u003e \n\u003e\u003e Bitcoin Authenticator is a desktop app+mobile app pair. It pairs with your phone over wifi, cloud push, maybe Bluetooth as well. I forget exactly. \n\u003e\u003e \n\u003e\u003e It's done in the same way as Lighthouse, so it runs Win/Mac/Linux on desktop and Android on mobile.\n\u003e\u003e \n\u003e\u003e It could be adapted to use BitGo as a third party key holder with SMS authenticator relatively easily, I think. We did the bulk of all the needed work last year as part of the bitcoinj multisig work. Then you'd have a server involved, but not a web app.\n\u003e \n\u003e I really like the concept of Bitcoin Authenticator and think it’s exactly what I was describing (without a third-party).\n\u003e \n\u003e I think it’s a bit confusing when they describe Bitcoin Authenticator as 2FA. I think it may be more accurate to describe it as out of band transaction verification/signing or dual transaction signing. Regardless, it’s very exciting to see others are thinking about this too.\n\u003e \n\u003e Brian Erdelyi\n\u003e ------------------------------------------------------------------------------\n\u003e Dive into the World of Parallel Programming. The Go Parallel Website,\n\u003e sponsored by Intel and developed in partnership with Slashdot Media, is your\n\u003e hub for all things parallel software development, from weekly thought\n\u003e leadership blogs to news, videos, case studies, tutorials and more. Take a\n\u003e look and join the conversation now. http://goparallel.sourceforge.net/\n\u003e _______________________________________________\n\u003e Bitcoin-development mailing list\n\u003e Bitcoin-development at lists.sourceforge.net\n\u003e https://lists.sourceforge.net/lists/listinfo/bitcoin-development", "sig": "927f2ea12646d5c02a33840646d5616c85a399b0d2ea121004b044986e7c3e0cd13a8bf197c51a6a24d5f65ccf67d315fd4efc966d14eeacbe3c8e5706925c7e" }