5 ms·

Isn't this just security theater? Does moving coins to one of their "vaults" actually do anything in the event coinbase is hacked?

detaro 9y ago
I don't think that's what they are intended to defend against. They are supposed to help if your login data gets compromised.
0xdada 9y ago
It's not theater. These features will do nothing if Coinbase is hacked but they can prevent your coins being stolen if someone compromises you.
- billmalarky 9y ago
  Moreover, Coinbase has insurance that protects your assets against Coinbase getting compromised (FDIC for USD and an insurance policy through Lloyd's of London for crypto). If _you_ are at fault for your account being compromised (ie someone steals your password) then you are not protected by these insurance policies. That's why this new vault functionality is so important, it protects your assets from personal negligence. With these new features, all your bases are covered.
  - korzun 9y ago
    This could get hairy, very quickly. I thought Coinbase had insurance that only covered the online portion but not offline vaults, where most of the 'money' is stored? If an offline vault is compromised through their system then what? The promise of keeping things separate doesn't guarantee anything.
  - mjhoyer 9y ago
    Not exactly. 'All digital currency that Coinbase holds online is fully insured. 'Coinbase holds less than 2% of customer funds online. The rest is held in offline storage.' They only insure less than 2% of their coins. This does nothing to protect private keys that go missing or are destroyed in their offline wallets. I would love to know that I'm wrong. https://support.coinbase.com/customer/portal/articles/1662379-how-is-coinbase-insured- https://support.coinbase.com/customer/portal/articles/166237...
    - billmalarky 9y ago
      I'm not associated with Coinbase so my knowledge extends to that same article you linked. You appear to be correct so far as the text of the article goes. In the future I imagine crypto wealth will be secured by breaking it into multiple wallets stored in vaults controlled by different organizations. That protects you from total asset loss due to institutional failure. And this type of failure isn't limited to crypto (see Bernie Madoff's hedgefund).
IkmoIkmo 9y ago
When they say vaults, they're actually vaults. 98%, according to them, of their funds are stored offline. The only attack vectors are cryptographically, which you can pretty much rule out (safe for human error), and some kind of human attack. (blackmail, social engineering etc) But there's procedures in place there, too. The offline keys are multi-signature, requiring multiple executives in multiple locations to clear industry security protocols, then come together and commit a crime. The remaining 2% of online funds are insured. If anything goes wrong, it's extremely likely to be on the customer side. They offer the usual secure connections, multisig etc, and the vault adds an extra 48h withdrawal period ontop. If you know the basics of bitcoin's cryptography, it's pretty trivial to store bitcoins on private keys that never saw the light of day, using a bunch of dice and an offline open source bit of software. But if you have to use a service, I'd say Coinbase is pretty damn secure. Just make sure your side's clean. Accessing secure systems from compromised phones/laptops is a losing battle, and as there's no real recourse with bitcoin, that's usually where things go wrong even when using secure services.
- s17n 9y ago
  > If anything goes wrong, it's extremely likely to be on the customer side. Since this is also true of their ordinary wallet product, I think "security theatre" isn't totally unfair here. The only thing this really adds is the 48 hour delay.
- thinkloop 9y ago
  Anyone have any idea of the specific mechanics they use to withdraw from the vault? Do several executives meet in a special room at a certain hour, with their keys on paper/usb, and type them into an air-gapped machine one-by-one? I wonder how they handle a lost key, do they have to move $1 billion+ of Bitcoin to a new wallet each time?
- gst 9y ago
  There are a lot of things outside of technical issues that can go wrong - here's an example: https://www.reddit.com/r/CoinBase/comments/6hcu0n/coinbase_cuba_lawsuit/ https://www.reddit.com/r/CoinBase/comments/6hcu0n/coinbase_c... If you have control over your own keys (such as in the case of the "old" Coinbase vault) those things are a non-issue. But with the way how the new vault works a hardware wallet looks like a better solution.
toomim 9y ago
It's not for coinbase being hacked. It's for the much more common case of user accounts being hacked.
homakov 9y ago
Even if it's an offline wallet, who said a physical attack isn't an option? Governments get nasty sometimes.

detaro 9y ago

I don't think that's what they are intended to defend against. They are supposed to help if your login data gets compromised.

0xdada 9y ago

It's not theater. These features will do nothing if Coinbase is hacked but they can prevent your coins being stolen if someone compromises you.

billmalarky 9y ago
Moreover, Coinbase has insurance that protects your assets against Coinbase getting compromised (FDIC for USD and an insurance policy through Lloyd's of London for crypto). If _you_ are at fault for your account being compromised (ie someone steals your password) then you are not protected by these insurance policies. That's why this new vault functionality is so important, it protects your assets from personal negligence. With these new features, all your bases are covered.
- korzun 9y ago
  This could get hairy, very quickly. I thought Coinbase had insurance that only covered the online portion but not offline vaults, where most of the 'money' is stored? If an offline vault is compromised through their system then what? The promise of keeping things separate doesn't guarantee anything.
- mjhoyer 9y ago
  Not exactly. 'All digital currency that Coinbase holds online is fully insured. 'Coinbase holds less than 2% of customer funds online. The rest is held in offline storage.' They only insure less than 2% of their coins. This does nothing to protect private keys that go missing or are destroyed in their offline wallets. I would love to know that I'm wrong. https://support.coinbase.com/customer/portal/articles/1662379-how-is-coinbase-insured- https://support.coinbase.com/customer/portal/articles/166237...
  - billmalarky 9y ago
    I'm not associated with Coinbase so my knowledge extends to that same article you linked. You appear to be correct so far as the text of the article goes. In the future I imagine crypto wealth will be secured by breaking it into multiple wallets stored in vaults controlled by different organizations. That protects you from total asset loss due to institutional failure. And this type of failure isn't limited to crypto (see Bernie Madoff's hedgefund).

IkmoIkmo 9y ago

When they say vaults, they're actually vaults. 98%, according to them, of their funds are stored offline. The only attack vectors are cryptographically, which you can pretty much rule out (safe for human error), and some kind of human attack. (blackmail, social engineering etc) But there's procedures in place there, too. The offline keys are multi-signature, requiring multiple executives in multiple locations to clear industry security protocols, then come together and commit a crime. The remaining 2% of online funds are insured. If anything goes wrong, it's extremely likely to be on the customer side. They offer the usual secure connections, multisig etc, and the vault adds an extra 48h withdrawal period ontop. If you know the basics of bitcoin's cryptography, it's pretty trivial to store bitcoins on private keys that never saw the light of day, using a bunch of dice and an offline open source bit of software. But if you have to use a service, I'd say Coinbase is pretty damn secure. Just make sure your side's clean. Accessing secure systems from compromised phones/laptops is a losing battle, and as there's no real recourse with bitcoin, that's usually where things go wrong even when using secure services.

s17n 9y ago
> If anything goes wrong, it's extremely likely to be on the customer side. Since this is also true of their ordinary wallet product, I think "security theatre" isn't totally unfair here. The only thing this really adds is the 48 hour delay.
thinkloop 9y ago
Anyone have any idea of the specific mechanics they use to withdraw from the vault? Do several executives meet in a special room at a certain hour, with their keys on paper/usb, and type them into an air-gapped machine one-by-one? I wonder how they handle a lost key, do they have to move $1 billion+ of Bitcoin to a new wallet each time?
gst 9y ago
There are a lot of things outside of technical issues that can go wrong - here's an example: https://www.reddit.com/r/CoinBase/comments/6hcu0n/coinbase_cuba_lawsuit/ https://www.reddit.com/r/CoinBase/comments/6hcu0n/coinbase_c... If you have control over your own keys (such as in the case of the "old" Coinbase vault) those things are a non-issue. But with the way how the new vault works a hardware wallet looks like a better solution.

toomim 9y ago

It's not for coinbase being hacked. It's for the much more common case of user accounts being hacked.

homakov 9y ago

Even if it's an offline wallet, who said a physical attack isn't an option? Governments get nasty sometimes.