7 ms·
Coinbase Vault
- LeoPanthera 12y agoPreviously on HN: https://news.ycombinator.com/item?id=7976841 https://news.ycombinator.com/item?id=7976841
- korzun 12y ago> Withdrawals are time delayed with notifications delivered to your phones and emails. I see what they are trying to do here but why not just simply approve/deny transactions? Time delay seems a bit weird. I don't know much about it but if it's delayed by 1-2 hours attacker can simply make request at 4AM in the morning. > Up to 97% of bitcoin is stored entirely offline in geographically distributed safe deposit boxes and private safes. Again, I know what they are trying to do here but this does not make me feel safe. Drop the hardware and you have potential data loss. How are the logistics? Are they going out on the same truck to multiple locations? Etc. Just seems a bit too high level and does not contain any context.
- modeless 12y agoThe time delay is 48 hours. During that time they attempt to contact you at multiple previously specified email addresses and phone numbers (which can belong to multiple people if you want). This ensures that even if your account is hijacked without your knowledge and a withdrawal is started, you will be able to stop it before it happens. The offline storage is likely done in such a way that no one storage location is critical. This is easy to achieve with cryptography.
- schmidp 12y agoI once nearly lost access to my coinbase account when I got a new iPhone and lost my 2-factor-authentication codes I had stored with the Google Authenticator app. I then stupidly managed to delete my fallback phone number from coinbase. Luckily I had clicked "Remember this computer for 30 days" and managed to transfer all of my bitcoins away from coinbase before loosing access to the account. I tried their support, but they never really tried to help. While their vault seems like a good idea, I would not trust them with my bitcoins anymore :-/
- c0n5pir4cy 12y agoThat kind of thing just makes me trust them more, I don't want people to be able to talk around the support staff to get to my Bitcoins and I actually wish my bank done the same. That being said I don't trust any third party with any of my wallets full stop at the moment.
- schmidp 12y agoIf they would have denied helping me because of some security policy, I would agree with you, but their support didn't understand the problem and just stopped responding. What if you run into a bug? From my experience I would not expect to get any qualified help.
- javert 12y agoI wonder if you can sue them, or if there is other legal recourse. Probably.
- jonknee 12y agoProbably not. These days as a consumer you can't really sue companies you do business with because they make you agree to arbitrate any disputes. It's nutty. Briefly checking the Coinbase TOS reveals this: > 8.2. Arbitration; Waiver of Class Action. EXCEPT FOR CLAIMS FOR INJUNCTIVE OR EQUITABLE RELIEF OR CLAIMS REGARDING INTELLECTUAL PROPERTY RIGHTS (WHICH MAY BE BROUGHT IN ANY COMPETENT COURT WITHOUT THE POSTING OF A BOND), ANY DISPUTE ARISING UNDER THIS AGREEMENT SHALL BE FINALLY SETTLED ON AN INDIVIDUAL BASIS IN ACCORDANCE WITH THE AMERICAN ARBITRATION ASSOCIATION'S RULES FOR ARBITRATION OF CONSUMER-RELATED DISPUTES AND YOU AND COINBASE HEREBY EXPRESSLY WAIVE TRIAL BY JURY. https://coinbase.com/legal/user_agreement https://coinbase.com/legal/user_agreement
- deleted 12y ago[deleted]
- javert 12y ago
- brianwawok 12y agoQ: how do they do this with no fee? If some guy on the street corner offered to watch all my cash in a secure facility for free, I would worry a little bit. For as much fun as banks can be, they do provide some pretty good oversight and legal protection. The dude on the street corner, not so much.
- JoshTriplett 12y agoThey charge a fee when you purchase or sell coins through them. That also means they get a cut of all payments made through them. That gives them a significant interest in making sure the large volume of coins they hold and transmit remains secure.
- Jach 12y agoYou mean like Mt. Gox? Such incentives alone are not very reassuring. (I really don't know why an average Joe would trust any third party with his bitcoins. At least banks give a tiny bit of interest and a piece of plastic to use the money whenever.)
- inthewoods 12y agoI've searched all over their website and I can't find any page where I can see the fees associated with these transactions - that makes me skeptical. Maybe I'm slow but this doesn't build trust for me.
- deleted 12y ago[deleted]
- mrb 12y agoBank checking accounts are also free, typically. Banks, like Coinbase, make their money from other services their customers invariably end up using (ATM/withdrawal fees, credit card fees, etc).
- rsynnott 12y agoHowever, unlike Coinbase, banks also make money from money on deposit. Banks here will waive all fees if you have over a certain amount (usually ~2000 euro) in your account.
- jeremyrwelch 12y agoMulti-signature security via Coinbase accounts is a great first step, but true multi-signature via Bitcoin private keys is the feature that will make transactions and storage much more secure -- regardless of whether you store them personally or with a company like Coinbase.
- FatalLogic 12y agoIf they're only doing multi-sig internally, that's a bit disappointing. I think the Copay wallet from Coinbase's competitor, Bitpay, does true multi-signature. Coinbase's current solution is a significant improvement for people who must use Coinbase for some other reason, I suppose. Anyone else should think about the advantages of true multi-sig on the blockchain
- jasonlingx 12y agoBeware - keeping your bitcoin in a wallet you do not absolutely control (like Coinbase), you can and almost certainly will lose them at a moment's notice, sooner or later.
- gfodor 12y ago"can" is true "almost certainly will" is pure speculation.
- jasonlingx 12y agoNothing is more certain actually, like how the sun will one day surely die.
- gfodor 12y agoit's not nearly certain that your bitcoins will be stolen, particularly if you don't consider what happens to them after your death.
- jellicle 12y agoYou're right, just because 100% of bitcoin businesses have stolen all their users' money and disappeared, there's no guarantee that this one will too.
- tlrobinson 12y agoWhile I agree, the same can be said about running your own wallet unless you are meticulous about backups and security.
- LeoPanthera 12y agoThis is not necessarily true. Electrum generates your addresses deterministically from a list of words given to you which are generated from a random seed. You just write down these words and store them in a safe place, and you will always be able to recover your coins. (This doesn't prevent against your computer being hacked, of course, but it does encrypt your private keys and require a password before sending anything, which is reasonable.)
- ForHackernews 12y agoI wonder how long it will take for this to get Goxed?
- tinco 12y agoI generally like coinbase, and I'd trust them with some spending money, but this blog post does not come across as trustworthy at all. They very well know the risks involved with sending your bitcoin savings to an address you don't control and they make no effort at all of alleviating any of the concerns. There's no mention at all of how you can verify they actually control the bitcoin you gave them to, even though there's been schemes for doing this for years. You might as well send your money into a black hole.
- callesgg 12y agoYeap i will sleep well knowing they are safe on my OWN computer.
- kovrik 12y agoI've just tried to sign up at Coinbase - they require my Full name. Really? What's the point of cryptocurrency if you enter your email + full name?
- dmix 12y agoThey also openly do Javascript font probing to fingerprint your browser, circumventing privacy tools like VPNs. Coinbase is not at all known for caring about privacy or pseudonymity. They've become somewhat of a counterpoint to how BTC started out ideologically. They are building a mainstream, government regulation friendly business.
- peteretep 12y agoIronically, the point of a cryptocurrency is that you don't need to rely on a provider who is asking you for information you don't want to give.
- starnix17 12y agoAnother terrible Coinbase story. A bug in their backend caused a transaction to go through to my bank account, withdraw funds, but not credit me coins. Contacting support yielded no results at all. I had to go through my bank, close my account (which is a nightmare in itself), and get the money refunded via the bank's fraudulent ACH reversal process. I would not trust this company.
- javert 12y agoSo we should instead trust a different payment processor that undoubtedly also has bugs, but has not yet detected and fixed them? (This is supposed to be a playful comment, not a bitter or sarcastic comment, it kind of came out the wrong way.)
- patio11 12y agoInterestingly, unless you're large enough that your particular account moves the needle, the only thing this changes for you is introducing a delay to cash out (which is in general a plus security-wise). If you have some nominal number of Bitcoins, say 100, then vaulting them still gives you an unsecured receivable against Coinbase and a row in their database. That that row is tagged "vault" vs. "demand deposit" doesn't particularly obligate them to segregate 100 BTC and cold store them. You still get aggregated with 10k other accounts and have your withdraws covered by a hot wallet. Also, in case a particular bankruptcy proceeding taking place in Tokyo hasn't demonstrated it enough, "cold storage" is attributed with vastly more security by Bitcoiners than is warranted. If implemented correctly it minimizes Bitcoins lost by one genre of attack, but have no doubt, there are many, many more ways to lose your Bitcoins. My guess is this is primarily marketing designed to convince people that keeping Bitcoins is safe and secondarily a product decision to reduce loss caused by poor user password management rather than by sophisticated attacks.