I can't believe they aren't using multi-signature internally. This is crazy.
Re:Coinbase Exchange
by danielweber on Monday January 26, 2015 @01:31PM
(#8948635)
Can they demonstrate the procedure works well enough that an insurance company would underwrite them for the full value of the cold wallet?
Re:Coinbase Exchange
by tedunangst on Monday January 26, 2015 @02:52PM
(#8949163)
What happens after an accident when they come up one secret short? The 98% are apparently not insured.
Re:Coinbase Exchange
by tlrobinson on Monday January 26, 2015 @03:54PM
(#8949498)
Shamir's Secret Sharing and multisig Bitcoin transactions support arbitrary n-of-m pieces/keys, e.x. a 3-of-6 scheme would require 3 of the 6 pieces to reconstitute the key/sign a transaction, so any 3 pieces could be lost.
2-of-3 is common for end-user multisig. Generally you'd have 1 key physically backed up on paper in a secure place, 1 key on one of your devices (phone or computer), and 1 key either on another device (hardware wallet or phone) or controlled by a 3rd party that does risk analysis/fraud detection on your transactions.
Coinbase is hopefully not entrusting individual employees with cold storage keys. Their security page suggests they're using Shamir's Secret Sharing or similar (https://www.coinbase.com/security), though multisig would be even better.