Hacker News Reader

Comment by nawitus | Hacker News Reader

Apparently blockchain.info only provides the encrypted wallet after the alternative authentication is succesful. They don't have the ability to spend your coins.

"It is highly recommended you enable two factor authentication on your My wallet account. Your wallet data is still only encrypted with your password however a second authentication step will need to be passed before your encrypted wallet data is output."

There's also GreenAdress.it which has interesting security system in place using "nLockTime": http://www.reddit.com/r/Bitcoin/comments/20puhg/while_blockc...

View on HN

They don't have the ability to spend your coins.

If you trust every other aspect of their service (that they aren't capturing and storing your password, which of course they handle every time you use the service), then you can feel safe in knowing that you don't have to trust them not to spend your coins because they can't.

But only if you trust that every other part is honored.

That isn't a rational set of conditions. In the usage of Blockchain.info, they absolutely gain the capacity to capture your private keys. As does anyone who hacks the service.

The way it's supposed to work, and I guess does work today otherwise we'd have heard about it, is that your passphrase doesn't actually get sent anywhere. Instead, it all happens client-side.

So today they don't have your keys. Not to say they couldn't be malicious in the future, or get hacked, but that's not the case today. Again, as far as I know.

Yes, blockchain.info's security is snake oil, and they are completely overmarketing themselves as "hack-proof".

And of course the reason for this is because Javascript cryptography is an oxymoron [0].

[0] - http://www.matasano.com/articles/javascript-cryptography/

Apparently the password is never sent from the client-side, and I've read claims that the client-side JavaScript code is verified on this. You can install a plugin which notifies any changes to the JavaScript code.

blockchain.info is great compared to some black box wallet but their model can't provide per transaction two factor, meaning once malware has your keys in memory you are good to go and you are going to have a real bad time.

That's possible with multisig and GreenAddress offers 4 different kind of 2FA: Google Auth, SMS, email and Phone (robot call)

Reply on news.ycombinator.com