5 ms·

>One specific customization we implemented is the ability to enforce that cold wallets can only send funds to a Square-owned hot wallet. This actually seems li

>One specific customization we implemented is the ability to enforce that cold wallets can only send funds to a Square-owned hot wallet. This actually seems like a significant risk. Cold storage is based on the idea that hot wallets are more easily compromised. If someone does manage to compromise Square's hot wallet private keys, they can basically hold all cold storage funds hostage. Perhaps Square has some way to modify the allowed addresses, but that somewhat defeats the purpose of the restriction.

mcpherrinm 8y ago
The code which implements the restrictions on destination is just code. We can add new destinations if needed, but that requires a quorum of codesigners and a more arduous process than simply withdrawing funds. The goal here is the normal operation, cold withdrawal, is very low risk. If we ever did suspect our hot wallet keys were breached, we'd have to do that or else we would be stuck as you suggested.
- aeternus 8y ago
  Makes sense, thanks for the explanation.
- jstanley 8y ago
  So what's the material difference between the cold wallet and the hot wallet if funds from the cold wallet can be moved into the hot wallet freely?
  - sneak 8y ago
    Moving funds from multisig cold storage is not “freely” when it at the minimum requires two people to travel to two different key storage/signing locations. You’re generally looking at a 12-48h process at a minimum. “Cold” refers to it being entirely offline.
    - londons_explore 8y ago
      In this case, the people are really just part of the system. If an attacker can fool the people into getting funds out of the cold wallet, then they are available for an attacker to steal. The only way to avoid the people being fooled is to have full auditing of every customer account balance. One needs to ensure that hot wallet + cold wallet >= all customers account balances. Doing that auditing in a secure way is really hard.
      - qmarchi 8y ago
        Square tried to minimize the impact that a human can have on the system: * Several people would have to be compromised * The people are geographically diverse * Subzero will refuse to redirect funds to anything but a Square hotwallet. * And, they specifically built the Beancounter system for auditing of these accounts.
      - dwild 8y ago
        > If an attacker can fool the people into getting funds out of the cold wallet, then they are available for an attacker to steal. Sure but then you still have 12-48h to discover that they are being fooled. There's no foolproof method, there will always be people involved and anything you could make will only make it better because it give you more people/time to realize the mistake. They decided that 2 persons and 12-48h is enough and I agree with that.

mcpherrinm 8y ago

The code which implements the restrictions on destination is just code. We can add new destinations if needed, but that requires a quorum of codesigners and a more arduous process than simply withdrawing funds. The goal here is the normal operation, cold withdrawal, is very low risk. If we ever did suspect our hot wallet keys were breached, we'd have to do that or else we would be stuck as you suggested.

aeternus 8y ago
Makes sense, thanks for the explanation.
jstanley 8y ago
So what's the material difference between the cold wallet and the hot wallet if funds from the cold wallet can be moved into the hot wallet freely?
- sneak 8y ago
  Moving funds from multisig cold storage is not “freely” when it at the minimum requires two people to travel to two different key storage/signing locations. You’re generally looking at a 12-48h process at a minimum. “Cold” refers to it being entirely offline.
  - londons_explore 8y ago
    In this case, the people are really just part of the system. If an attacker can fool the people into getting funds out of the cold wallet, then they are available for an attacker to steal. The only way to avoid the people being fooled is to have full auditing of every customer account balance. One needs to ensure that hot wallet + cold wallet >= all customers account balances. Doing that auditing in a secure way is really hard.
    - qmarchi 8y ago
      Square tried to minimize the impact that a human can have on the system: * Several people would have to be compromised * The people are geographically diverse * Subzero will refuse to redirect funds to anything but a Square hotwallet. * And, they specifically built the Beancounter system for auditing of these accounts.
    - dwild 8y ago
      > If an attacker can fool the people into getting funds out of the cold wallet, then they are available for an attacker to steal. Sure but then you still have 12-48h to discover that they are being fooled. There's no foolproof method, there will always be people involved and anything you could make will only make it better because it give you more people/time to realize the mistake. They decided that 2 persons and 12-48h is enough and I agree with that.