Hacker News Reader

Comment by elorm | Hacker News Reader

For those who might be a bit confused......

This feature will not make your coins more secure or prevent coinbase from being hacked. However your coins will most likely be moved to "Cold storage" which will make your coins extremely difficult to steal in the event that either coinbase or your account is breached.

As far as cryptocurrency exchanges go, Coinbase is among the most secure, practicing what they call "Paranoid Security".

Brian has written about it in the past. https://engineering.coinbase.com/how-coinbase-builds-secure-...

View on HN

If it makes your coins extremely difficult to steal in the event that either coinbase or your account is breached, isn't that by definition making your coins more secure?

This is incorrect, customer funds go to cold storage regardless of whether they're in a vault or wallet. This feature is intended to protect against account takeover, not the Coinbase hot wallet getting hacked.

(I worked at Coinbase a little while back)

You seem to misunderstand my statement. Let me explain a little further please.

Your coins are not safe/secure while they are with coinbase, and will never be because you do not own the private keys. It does not prevent you from losing your money in the event of worst case scenarios, it just makes it harder for someone to steal your money while it is in the care of coinbase.

> However your coins will most likely be moved to "Cold storage"

This is the part I was responding to. It sounds like you're saying that using the vault feature will move your coins into cold storage. In fact, they were always in cold storage.

What kind of software engineers are they hiring? I'm senior CS student and want to work in this space (crypto). Could you recommend any subject to dive into?

https://www.coinbase.com/careers

I'm sure crypto projects and experience are a plus :)

> This feature will not make your coins more secure

It does make your coins more secure, by requiring 48 hours and additional confirmation emails before they can be withdrawn.

If a hacker manages to get your password and (if enabled) the Google Auth app on your phone, they will now additionally have to wait 48 hours, while you are receiving email warnings about the withdrawal, before they can withdraw any of your vaulted coins.

Additionally, they will have to wait until January to get your bitcoin cash from the fork! </s>

If I recall correctly, vault is used for them to plan how much coins to store between cold storage and hot wallet. Not just an account level authentication.

What happens if cold storage burns down.

it becomes quite warm storage

ok that brokw the Ice :D

I don't believe they use the traditional cold storage methods anymore(Usb/Device in a phyiscal vault or paper in a physical vault etc). They generate the keys offline and split the keys using a secret sharing method among a quorom of keyholders. So they are geographically dispersed and if one subset on keys were to be lost, there's still a possibility of regenerating by obtaining the other sets from the Quorom

Backups are important whether the thing being backed up is online or not.

Reply on news.ycombinator.com