Hacker News Reader

Comment by sejje | Hacker News Reader

I'm assuming the vault doesn't improve security at all in the event that coinbase gets hacked and loses all of their btc?

View on HN

Probably not as much as they'd like it to.

Brian Armstrong, CEO of Coinbase once said in an interview (http://techcrunch.com/video/coinbase-founder-brian-armstrong...) that they are dividing their bitcoins in hot and cold wallets.

A hot wallet only contains about 5% of the bitcoins the company has. Meanwhile, the other 95% of bitcoins they're holding are stored savely in a key-split cold wallet.

Now, the problem is: if some user wants a large amount of his bitcoins out of coinbase, the guys owing their part of the split private key need to take action to transfer that amount of bitcoins from the cold to the hot wallet, assuming the amount is > 5%.

So what I think "Vault" does is give them a better architecture for planing and organizing their hotwallet-coldwallet-process.

Multisig might.

"To complete the Coinbase Vault offering, we will be adding multi-signature (“multi-Sig”) technology in the coming weeks to enable customers to manage their own vault security."

It's not clear exactly how that will work, but if it's, say, 2-of-3 and Coinbase only holds one of the keys then it would.

Multisig would be good, especially if it's actually a address keypair, as it would allow you to verify the balance held exists.

If they truly have cold storage of their btc - yes, this system does improve security, as their cold-storage bitcoins aren't subject to electronic hacking, just physical intrusion. And, the use of encryption and HSMs can mitigate against even a physical intrusion as well.

Sometime in the next couple years, someone is going to come up with a relatively fool proof vault storage for bitcoins, we just haven't see it yet. (And Coinbase isn't sharing enough details yet for us to know whether they've put one together)

What makes you so sure that Coinbase even has all of our bitcoin in the first place?

I said all of their bitcoin. Coinbase certainly doesn't have all of my bitcoin.

I didn't intend to make a conspiracy theory out of my question.

The question means all of our Bitcoin at Coinbase. He's not making a conspiracy theory out of it - he's asking a legitimate question about whether or not Coinbase has all deposits accounted for or not.

Perhaps legitimate, but not in response to my comment.

That's a rationalization around the original blaming statement you made. You asked how we should know if they are secure. He said how do you know they haven't been hacked already? Both legitimate, up to the point you said he was making conspiracy theories.

I think it's a jump to say "hacked already."

I assumed he was talking like they had just spent the bitcoin (Mt Gox stylee). Even if they were hacked, I would expect Coinbase to disclose that information--to presume that they've been hacked, lost bitcoin, and are hiding that from everyone is a pretty wild theory in my book.

You can make sure that Coinbase has none of your bitcoins if you transfer them to your own wallet as soon as possible.

They're all offline, stored in real safety deposit boxes and bank vaults...

The keys are stored offline, but the BTC are always online. They are relatively safe against someone compromising your computers remotely. Against physical intrusions or insider attacks, not as much.

Physical intrusions can be dealt with by encrypting the keys, which I hope they are doing. Using a secret sharing scheme with physical tokens (e.g. smartcards) carried by chosen employees should reduce the danger of both of those attacks.

They claim the physical copies are encrypted [1].

[1] http://blog.coinbase.com/post/33197656699/coinbase-now-stori...

That's a terrible assumption.

Reply on news.ycombinator.com