Announcing Ethereum and Litecoin vaults
blog.coinbase.com
blog.coinbase.com
This feature will not make your coins more secure or prevent coinbase from being hacked. However your coins will most likely be moved to "Cold storage" which will make your coins extremely difficult to steal in the event that either coinbase or your account is breached.
As far as cryptocurrency exchanges go, Coinbase is among the most secure, practicing what they call "Paranoid Security".
Brian has written about it in the past. https://engineering.coinbase.com/how-coinbase-builds-secure-...
It does make your coins more secure, by requiring 48 hours and additional confirmation emails before they can be withdrawn.
If a hacker manages to get your password and (if enabled) the Google Auth app on your phone, they will now additionally have to wait 48 hours, while you are receiving email warnings about the withdrawal, before they can withdraw any of your vaulted coins.
(I worked at Coinbase a little while back)
I'm sure crypto projects and experience are a plus :)
Your coins are not safe/secure while they are with coinbase, and will never be because you do not own the private keys. It does not prevent you from losing your money in the event of worst case scenarios, it just makes it harder for someone to steal your money while it is in the care of coinbase.
This is the part I was responding to. It sounds like you're saying that using the vault feature will move your coins into cold storage. In fact, they were always in cold storage.
This product is the opposite! One-key. Same security (in terms of Coinbase being hacked) and less convenience than the regular wallet! In fact they even took the multi-sig BTC wallet away. You used to be able to create more than one multi-sig BTC wallet in your Coinbase account. Now I only have one and I don't see an option to create another.
Maybe in practice, the risk of people getting phished is much higher than the risk of Coinbase getting hacked.
In fact, the multi-sig wallets were nice too because you could retrieve your coins even in the case where Coinbase went away completely. e.g. if they pulled a Cryptsy or a BTCe
Not holding the keys for my own coins is not an option (see https://www.youtube.com/watch?v=vt-zXEsJ61U for why), but at least there are alternatives such as Ledger hardware wallets.
An exchange that doesn't follow KYC laws is at the very least under threat of being shut down by the US.
It's part of the reason why I like coinbase so much, they are clearly following all the required laws.
Even outside of privacy issues, Coinbase goes down during critical periods often. Price crashing and you want to buy/sell quick? The site will likely be down.
Outside of accessibility issues, Having Bitcoin on coinbase is more like an I-O-U and defeats the purpose of cryptocurrency imo, which is having the private keys to your funds which only you control.
I recommend this guide to set a multisignature wallet through CoPay and Glidera. And managing your keys with a password manager like Enpass.
https://gist.github.com/paOol/d6c78c339cc5c4df6dd745d3bc2cc5...
This is very useful if you want to set up a long term investing strategy. For example you can set your debit card or bank transfer to automatically buy $500 of BTC each week, then monthly or quarterly transfer those coins to your private wallet based on your individual risk tolerance/free time.
(answer is nothing)
Eventually, I gave up and went somewhere else.
As opposed to? I mean, if you travel anywhere, the US government has a scan of your passport.
Surely the bigger concern here is not the passport but the money you desire to give away to any company in exchange for a database entry that assigns you a fraction of a nascent digital currency.
If you do sign-up - and you should if you believe in Bitcoin's future - make sure to buy Bitcoin on Gdax. It's Coinbase's trading platform. Buy your coins there and you avoid the outrageous fees (as you're making the trade yourself rather than paying Coinbase to do it for you).
What? The government makes the passports.
That's why this new vault functionality is so important, it protects your assets from personal negligence.
With these new features, all your bases are covered.
I thought Coinbase had insurance that only covered the online portion but not offline vaults, where most of the 'money' is stored?
If an offline vault is compromised through their system then what? The promise of keeping things separate doesn't guarantee anything.
'All digital currency that Coinbase holds online is fully insured.
'Coinbase holds less than 2% of customer funds online. The rest is held in offline storage.'
They only insure less than 2% of their coins. This does nothing to protect private keys that go missing or are destroyed in their offline wallets.
I would love to know that I'm wrong.
https://support.coinbase.com/customer/portal/articles/166237...
In the future I imagine crypto wealth will be secured by breaking it into multiple wallets stored in vaults controlled by different organizations. That protects you from total asset loss due to institutional failure. And this type of failure isn't limited to crypto (see Bernie Madoff's hedgefund).
The only attack vectors are cryptographically, which you can pretty much rule out (safe for human error), and some kind of human attack. (blackmail, social engineering etc) But there's procedures in place there, too. The offline keys are multi-signature, requiring multiple executives in multiple locations to clear industry security protocols, then come together and commit a crime.
The remaining 2% of online funds are insured.
If anything goes wrong, it's extremely likely to be on the customer side. They offer the usual secure connections, multisig etc, and the vault adds an extra 48h withdrawal period ontop.
If you know the basics of bitcoin's cryptography, it's pretty trivial to store bitcoins on private keys that never saw the light of day, using a bunch of dice and an offline open source bit of software. But if you have to use a service, I'd say Coinbase is pretty damn secure. Just make sure your side's clean. Accessing secure systems from compromised phones/laptops is a losing battle, and as there's no real recourse with bitcoin, that's usually where things go wrong even when using secure services.
Since this is also true of their ordinary wallet product, I think "security theatre" isn't totally unfair here. The only thing this really adds is the 48 hour delay.
I wonder how they handle a lost key, do they have to move $1 billion+ of Bitcoin to a new wallet each time?
If you have control over your own keys (such as in the case of the "old" Coinbase vault) those things are a non-issue. But with the way how the new vault works a hardware wallet looks like a better solution.
Cryptocurrencies are so volatile that there's a non-negligible risk that locking away a large sum for 48 hours could potentially cost you nearly all of it.
And they're so hackable that not putting a time delay on withdrawals could also potentially cost you all of it.
Just as with fiat USD, depositing it into any third party that is not FDIC is silly. Same here, however there is no FDIC like entity to return your money, so the only true secure way is to only hold them yourself.
Of course that makes mass adoption much more difficult...
Until Gov. Treasuries and central banks really jump into the game...