📅 Original date posted:2014-05-23 📝 Original message:Multisig is great for ...

Kyle Jerviss [ARCHIVE] /

npub1545…8pjr

2023-06-07 15:21:56

in reply to nevent1q…5736

📅 Original date posted:2014-05-23
📝 Original message:Multisig is great for irreversible actions, but pointless most of the
time, which is why no PGP developer or user ever thought to implement it.

If you lose a key and an attacker signs a bogus email or commit with it,
we all roll back with no lasting harm done.

Wladimir wrote:
> On Thu, May 22, 2014 at 8:06 PM, Jeff Garzik <jgarzik at bitpay.com> wrote:
>> Related: Current multi-sig wallet technology being rolled out now,
>> with 2FA and other fancy doodads, is now arguably more secure than my
>> PGP keyring. My PGP keyring is, to draw an analogy, a non-multisig
>> wallet (set of keys), with all the associated theft/data
>> destruction/backup risks.
>>
>> The more improvements I see in bitcoin wallets, the more antiquated my
>> PGP keyring appears. Zero concept of multisig. The PGP keyring
>> compromise process is rarely exercised. 2FA is lacking. At least
>> offline signing works well. Mostly.
> Would be incredible to have multisig for git commits as well. I don't
> think git supports multiple signers for one commit at this point -
> amending the signature replaces the last one - but it would allow for
> some interesting multi-factor designs in which the damage when a dev's
> computer is compromised would be reduced.
>
> Sounds like a lot of work to get a good workflow there, though.
>
> My mail about single-signing commits was already longer than I
> expected when I started writing there. Even though the process is
> really simple.
>
> Though if anyone's interest is piqued by this, please pick it up.
>
> Wladimir
>
> ------------------------------------------------------------------------------
> "Accelerate Dev Cycles with Automated Cross-Browser Testing - For FREE
> Instantly run your Selenium tests across 300+ browser/OS combos.
> Get unparalleled scalability from the best Selenium testing platform available
> Simple to use. Nothing to install. Get started now for free."
> http://p.sf.net/sfu/SauceLabs
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development

Author Public Key

npub1545ndtu0dzkpr5tef46wpa4x47lds2t7tw7htm4l654sskf5zshsfw8pjr

Seen on

wss://relay.nostr.band

Show more details

Published at

2023-06-07 15:21:56

Kind type

1 Short Text Note

Event JSON

{ "id": "c65b20966ee9c15a7144651daf9adba5062cf786fbcc829e062a5b72e829496e", "pubkey": "a56936af8f68ac11d1794d74e0f6a6afbed8297e5bbd75eebfd52b085934142f", "created_at": 1686151316, "kind": 1, "tags": [ [ "e", "6ed0060b87c02af20d6af6fded563264095ae2a36fee168b566cb3b0da703edb", "", "root" ], [ "e", "4cb1554e5fa4caeb9a6d3f11a2c0499925bd64e1273217d7acaf6c3c01e73c9f", "", "reply" ], [ "p", "1c61d995949cbfaf14f767784e166bde865c7b8783d7aa3bf0a1d014b70c0069" ] ], "content": "📅 Original date posted:2014-05-23\n📝 Original message:Multisig is great for irreversible actions, but pointless most of the \ntime, which is why no PGP developer or user ever thought to implement it.\n\nIf you lose a key and an attacker signs a bogus email or commit with it, \nwe all roll back with no lasting harm done.\n\nWladimir wrote:\n\u003e On Thu, May 22, 2014 at 8:06 PM, Jeff Garzik \u003cjgarzik at bitpay.com\u003e wrote:\n\u003e\u003e Related: Current multi-sig wallet technology being rolled out now,\n\u003e\u003e with 2FA and other fancy doodads, is now arguably more secure than my\n\u003e\u003e PGP keyring. My PGP keyring is, to draw an analogy, a non-multisig\n\u003e\u003e wallet (set of keys), with all the associated theft/data\n\u003e\u003e destruction/backup risks.\n\u003e\u003e\n\u003e\u003e The more improvements I see in bitcoin wallets, the more antiquated my\n\u003e\u003e PGP keyring appears. Zero concept of multisig. The PGP keyring\n\u003e\u003e compromise process is rarely exercised. 2FA is lacking. At least\n\u003e\u003e offline signing works well. Mostly.\n\u003e Would be incredible to have multisig for git commits as well. I don't\n\u003e think git supports multiple signers for one commit at this point -\n\u003e amending the signature replaces the last one - but it would allow for\n\u003e some interesting multi-factor designs in which the damage when a dev's\n\u003e computer is compromised would be reduced.\n\u003e\n\u003e Sounds like a lot of work to get a good workflow there, though.\n\u003e\n\u003e My mail about single-signing commits was already longer than I\n\u003e expected when I started writing there. Even though the process is\n\u003e really simple.\n\u003e\n\u003e Though if anyone's interest is piqued by this, please pick it up.\n\u003e\n\u003e Wladimir\n\u003e\n\u003e ------------------------------------------------------------------------------\n\u003e \"Accelerate Dev Cycles with Automated Cross-Browser Testing - For FREE\n\u003e Instantly run your Selenium tests across 300+ browser/OS combos.\n\u003e Get unparalleled scalability from the best Selenium testing platform available\n\u003e Simple to use. Nothing to install. Get started now for free.\"\n\u003e http://p.sf.net/sfu/SauceLabs\n\u003e _______________________________________________\n\u003e Bitcoin-development mailing list\n\u003e Bitcoin-development at lists.sourceforge.net\n\u003e https://lists.sourceforge.net/lists/listinfo/bitcoin-development", "sig": "91289cd97d9cca8ec7d091fad63459248084e38dffb70b8e74a4807e67f1ad94f9b8e841d3bb991ffa0147b6d23c9b82c992acc89ad5ff1635194823eb8ee45f" }