3 ms·

Good question. I answered it in the paper (just 8 pages) which you obviously haven't read before asking. Keybase is a single point of failure. Or your machine

Good question. I answered it in the paper (just 8 pages) which you obviously haven't read before asking. Keybase is a single point of failure. Or your machine that will do KDF. M-of-N multisig transactions are way safer because to sign a specific transaction you never need to have all secret material at once on a single machine. If my PC is compromised, I can still independently verify specific transaction I want to sign and send it out to my friends to sign. All their private keys are stored on independent machines which normally aren't compromised altogether by the same attacker. On specific problem with brainwallets - low entropy. One specific problem with web apps: no code signing. Even if your SSL pubkey is pinned (which is not supported by any browser yet), the code you receive from the server is never remembered and pinned (like with installed apps). If their server is silently compromised tomorrow, someone may humbly hijack keys of 1% of the users and go undetected for quite some time.

j_s 13y ago
> which you obviously haven't read before asking This blew my mind; so unkind!
- oleganza 13y ago
  Sorry, but the question was quite disrespectful. We are presenting a high-security solution to an important problem and the ignorant observer proposes to use something extremely unsafe and insecure as an alternative without even trying to understand the problem. Here's the motivation, right on the first page: "This can be viewed as an ultimate solution for secure storage of bitcoins as no individual computer system can be fully trusted (e.g. even RNG may leak information about private keys through ECDSA signatures [5]). By spreading the trust between several independently operating computers the risk is significantly reduced. The attacker not only has to compromise several computers instead of just one, but beforehand they must find out which computers are involved (which is made much harder when blind signatures are being exchanged). Therefore the scheme enables safer Bitcoin storage on conventional personal computers and smartphones without need for specialized hardware or compromising privacy." To my excuse, I only allowed myself to be a bit arrogant while providing a respectful answer anyway. This both answers the question and signals that something can be improved in the discussion.

j_s 13y ago

> which you obviously haven't read before asking This blew my mind; so unkind!

oleganza 13y ago
Sorry, but the question was quite disrespectful. We are presenting a high-security solution to an important problem and the ignorant observer proposes to use something extremely unsafe and insecure as an alternative without even trying to understand the problem. Here's the motivation, right on the first page: "This can be viewed as an ultimate solution for secure storage of bitcoins as no individual computer system can be fully trusted (e.g. even RNG may leak information about private keys through ECDSA signatures [5]). By spreading the trust between several independently operating computers the risk is significantly reduced. The attacker not only has to compromise several computers instead of just one, but beforehand they must find out which computers are involved (which is made much harder when blind signatures are being exchanged). Therefore the scheme enables safer Bitcoin storage on conventional personal computers and smartphones without need for specialized hardware or compromising privacy." To my excuse, I only allowed myself to be a bit arrogant while providing a respectful answer anyway. This both answers the question and signals that something can be improved in the discussion.