4 ms·
Maybe instead of a crypto brokerage holding your wallet, there can be a "key bank" which uses those more expensive methods of attestation and you can use it for
by nick3443 2y ago
Maybe instead of a crypto brokerage holding your wallet, there can be a "key bank" which uses those more expensive methods of attestation and you can use it for recovery if you lose your key up to once per year or something. It would be like having your key written down in a safety deposit box at a local or regional bank.
- firesteelrain 2y agoThis is the same problem that you run into with secret zero and commonly discussed in context of HashiCorp Vault. At some point you need to store the unlock keys then you need another repository under RBAC to protect that repository. They say to print out the keys and store them offline on paper but how many own a Class 5 safe ?
- tasuki 2y agoHow many own a lot of books? Just... pick one.
- firesteelrain 2y agoNot following? Do you know what I meant by a Class 5 safe? https://www.norfolksafe.com/ https://www.norfolksafe.com/
- tasuki 2y agoI don't. And frankly I don't think a safe is a good place to store secrets. It is too conspicuous.
- firesteelrain 2y agoThese safes are certified for all kinds of sensitive (GSA recommends them for Classified use from what I have read) use and they are safe. Ideally, you connect Vault to a HSM if you need that kind of security that’s being described. HSMs are electronic safes
- tasuki 2y ago> These safes are certified for classified use and they are safe. The website says "10 minutes against forced entry". That's not safe. No safe is safe against a state level actor. No safe is safe against "hit you with a crowbar until you open the safe". Whatever secrets you have, it's better to hide them than to put them in such a conspicuous place. The only reason one should use a safe is as a plausible decoy...
- firesteelrain 2y agoThis isn’t the safe to rule all safes. You have other mitigating factors like access control. If you have state level actors physically breaking into your facilities then we might be at war
- tasuki 2y agoIf you have enough books (which doesn't even have to be that many), it's much better to store your secrets in one or more of the books.
- firesteelrain 2y agoYea but you have multiple pieces of the secret to restart your Vault instance. Now you need to go to everyone’s office or home to get this secret to restore it. I am referring to Shamir algorithm that Vault uses
- grey-area 2y agoMaybe the key bank could hold your digital money as well. Then we wouldn’t need a blockchain and your transactions could be instant, free, private and reversible.
- thinkmassive 2y agoCollaborative custody multisig providers have been in business for years. Recently even Block (CashApp etc) has introduced a product with this feature. By geographically distributing your signing devices you improve both security and reliability. One of those keys can be hosted by a third party to be used for recovery, without providing them any ability to touch your funds without your involvement.