4 ms·

They have a reassuring security page[0]. It's nice to see they're enforcing good practices, I especially appreciate their "no-link email policy" where they will

by tetrep 11y ago

They have a reassuring security page[0]. It's nice to see they're enforcing good practices, I especially appreciate their "no-link email policy" where they will never send you links in emails, which seems like a great way to head off phishing attempts. I hope they actually present this to users in some way during sign-up though, or it won't be of much help unless a user manually navigates to the security page and reads through most of it. I'm a little disappointed that they only have level 2[1] HSMs in the cloud, as I would be uncomfortable protecting my hot wallet keys with only tamper evident protections, rather than level 3+ that actually attempt to detect intrusion and delete keys. Bitcoin makes for very quick stealing once you have keys, so reactive defenses against key loss don't help much as you're literally in a race condition with the attacker to empty the wallet (you into a non-compromised one, the attacker into their own). But I would assume they weighed cost/risk and I've never heard of a security compromise of Amazon's HSMs so it was probably a reasonable choice. edit: I should also applaud their use of PGP and (explicit) respect for responsible disclosure. [0]: https://exchange.gemini.com/security https://exchange.gemini.com/security [1]: https://en.wikipedia.org/wiki/FIPS_140-2#Level_2 https://en.wikipedia.org/wiki/FIPS_140-2#Level_2

dtwhitney 11y ago
I personally know many of the engineers at Gemini and have worked with some of them in the recent past. If I were going to choose a team to build a bitcoin exchange, the people I know at Gemini would be on it. If you're into bitcoin, I think this is the place to put your money.
- cenal 11y ago
  What benefit do they offer over something like Coinbase to a casual Bitcoin observer like me?
  - benmmurphy 11y ago
    Looking at Coinbase and Gemini as a user I would probably prefer Gemini marginally because their bullshit about using HSM. They both seem to be hosted in AWS which from my POV is a major fuckup. Gemini and Coinbase are basically running a CTF where if you can find a hypervisor exploit and get lucky you can drain their hot wallet.
    - silverbax88 11y ago
      I saw a presentation at OWASP a couple of weeks ago by Coinbase, where they stated that the BTC are stored on air gapped servers, and that 97% of the Bitcoins never exist on routable servers.
benmmurphy 11y ago
I don't understand Amazon's cloud HSM product. Amazon says they don't have access to your HSM but presumably they do if they wanted to. Also, how does HSM protect the hot wallet if an attacker is able to get access to a machine that is using the HSM for signing? Your only hope is that you can obscure the credentials for the HSM from the attacker. HSM for the hot wallet probably provides greater security than no HSM for the hot wallet but I don't think it gives you that much extra security.
- ecdavis 11y ago
  The value proposition of an HSM is that sensitive key material never leaves the hardware in plaintext (or at all, in the case of the SafeNet HSMs used by Amazon). An attacker who compromises a machine with access to the HSM is therefore able to perform whatever operations that machine is authorized to perform, but nothing more. Crucially, they cannot steal the key material and then go off and use it elsewhere. They have to stay connected to the machine that has the access they need. Protecting against offline attacks is a pretty big gain. > Amazon says they don't have access to your HSM but presumably they do if they wanted to. I wouldn't be so sure. As far as I can tell, once you've provisioned an HSM from Amazon you have full administrator access. That includes control over all trusted SSH certs, users, etc. Of course Amazon has physical access, but that doesn't give them access to the HSM's crypto functions or the key material.
  - benmmurphy 11y ago
    The problem is that an attacker who compromises a machine that has access to the HSM will have the privilege to drain the wallet. Unless there is some rate limit or some higher access control the attacker will be able to initiate a bunch of BTC transactions that will dump the wallet. Also if they are intelligent about it they will batch the signatures and release them to the network in one hit. If Amazon is a bad actor they trivially have access to the HSM because they could just write some software that pretends to be the HSM. However, this is probably not in the threat model because the amount Amazon loses by fucking a client like this is much more than the amount they would gain by fucking a client. The real thread is rogue Amazon employees and I guess it would be be hard for them to MITM the HSM from the start. Your only protection for the hot wallet is to obscure the credentials you use to connect to HSM. Good luck with that against and a determined adversary that has a lot to gain from dumping the HSM key. (if it is not clear this 'only protection' thing is when the adversary has root access to your machine) Oh.. and if you are a gemini dev. Obscure your code encrypt your HSM credentials in memory. :) Security through obscurity is actually a useful thing against attackers.

by tetrep 11y ago

dtwhitney 11y ago

I personally know many of the engineers at Gemini and have worked with some of them in the recent past. If I were going to choose a team to build a bitcoin exchange, the people I know at Gemini would be on it. If you're into bitcoin, I think this is the place to put your money.

cenal 11y ago
What benefit do they offer over something like Coinbase to a casual Bitcoin observer like me?
- benmmurphy 11y ago
  Looking at Coinbase and Gemini as a user I would probably prefer Gemini marginally because their bullshit about using HSM. They both seem to be hosted in AWS which from my POV is a major fuckup. Gemini and Coinbase are basically running a CTF where if you can find a hypervisor exploit and get lucky you can drain their hot wallet.
  - silverbax88 11y ago
    I saw a presentation at OWASP a couple of weeks ago by Coinbase, where they stated that the BTC are stored on air gapped servers, and that 97% of the Bitcoins never exist on routable servers.

benmmurphy 11y ago

I don't understand Amazon's cloud HSM product. Amazon says they don't have access to your HSM but presumably they do if they wanted to. Also, how does HSM protect the hot wallet if an attacker is able to get access to a machine that is using the HSM for signing? Your only hope is that you can obscure the credentials for the HSM from the attacker. HSM for the hot wallet probably provides greater security than no HSM for the hot wallet but I don't think it gives you that much extra security.

ecdavis 11y ago
The value proposition of an HSM is that sensitive key material never leaves the hardware in plaintext (or at all, in the case of the SafeNet HSMs used by Amazon). An attacker who compromises a machine with access to the HSM is therefore able to perform whatever operations that machine is authorized to perform, but nothing more. Crucially, they cannot steal the key material and then go off and use it elsewhere. They have to stay connected to the machine that has the access they need. Protecting against offline attacks is a pretty big gain. > Amazon says they don't have access to your HSM but presumably they do if they wanted to. I wouldn't be so sure. As far as I can tell, once you've provisioned an HSM from Amazon you have full administrator access. That includes control over all trusted SSH certs, users, etc. Of course Amazon has physical access, but that doesn't give them access to the HSM's crypto functions or the key material.
- benmmurphy 11y ago
  The problem is that an attacker who compromises a machine that has access to the HSM will have the privilege to drain the wallet. Unless there is some rate limit or some higher access control the attacker will be able to initiate a bunch of BTC transactions that will dump the wallet. Also if they are intelligent about it they will batch the signatures and release them to the network in one hit. If Amazon is a bad actor they trivially have access to the HSM because they could just write some software that pretends to be the HSM. However, this is probably not in the threat model because the amount Amazon loses by fucking a client like this is much more than the amount they would gain by fucking a client. The real thread is rogue Amazon employees and I guess it would be be hard for them to MITM the HSM from the start. Your only protection for the hot wallet is to obscure the credentials you use to connect to HSM. Good luck with that against and a determined adversary that has a lot to gain from dumping the HSM key. (if it is not clear this 'only protection' thing is when the adversary has root access to your machine) Oh.. and if you are a gemini dev. Obscure your code encrypt your HSM credentials in memory. :) Security through obscurity is actually a useful thing against attackers.