4 ms·

Keys are created and encrypted in the browser Key hijack in 5... 4... 3... Browser crypto isn't secure. One way to offset the risk is to use a browser plugin

Keys are created and encrypted in the browser Key hijack in 5... 4... 3... Browser crypto isn't secure. One way to offset the risk is to use a browser plugin to perform the crypto operations, and even that isn't really a security guarantee. When you combine an incentive to break crypto (money) with a straightforward route to breaking it (browser crypto), you get a pretty dangerous situation.

drcode 12y ago
Though I agree with you this leads to risky security issues, the mere fact that a major Bitcoin exchange is allowing users to hold their own private keys really puts a smile on my face today. It is completely unheard of in the financial industry (and usually technically impossible before cryptocurrencies) to have a bank give away their "middle man" access of people's money and empowering their customers with complete control over their finances.
- jerguismi 12y ago
  Which makes me wonder... The keys are generated in-browser. What if the users computer is compromised, and a malware succeeds in capturing the keys + bip38 passphrase? I don't know if this product will be pain in the ass for coinbase, if the user funds start disappearing from these multisig addresses. All the best luck for this product, though.
  - adrianmacneil 12y ago
    If the computer is infected, then yes it would be possible to steal both the private keys, and the passphrase. To avoid this attack scenario, we're investing pretty heavily in technologies such as CSP. However, this can be mitigated with our group multisig vault, where separate users create their own keys. For malware to steal these, it would require infecting multiple computers.
    - icebraining 12y ago
      Seems like the next step would be to allow the users to store their copies on a smart card instead of a PC.
      - wcoenen 12y ago
        Like the Trezor[1] hardware wallet. [1] http://www.bitcointrezor.com http://www.bitcointrezor.com
        icebraining 12y ago
        Yes, but maintaining the encrypted copy on Coinbase's servers, to ensure that losing the card doesn't mean losing the wallet.
    - wcummings 12y ago
      CSP?
      - floatrock 12y ago
        Content Security Policy -- http://en.wikipedia.org/wiki/Content_Security_Policy http://en.wikipedia.org/wiki/Content_Security_Policy basically headers that can tell the browser not to execute stuff that leads to injection like inline javascript or inline styling, allows for whitelists of domains (so the browser won't run script src="http://hackercdn.com/malicious.js" http://hackercdn.com/malicious.js"), etc.
adrianmacneil 12y ago
The only argument here is that crypto on internet connected (and potentially compromised) devices is insecure. There's nothing inherently more insecure about browser crypto. Our multisig vault relies on BitcoinJS, which we had audited by an external consulting firm. We also don't allow multisig vault creation on browsers which don't support crypto.getRandomValues()
- sillysaurus3 12y ago
  The only argument here is that crypto on internet connected (and potentially compromised) devices is insecure. Actually, that's pretty far from the standard arguments: http://matasano.com/articles/javascript-cryptography/ http://matasano.com/articles/javascript-cryptography/ That's pretty much the seminal work of why browser crypto is insecure. The issue isn't whether the primitives you're using are secure. It's that the security of your primitives can be hijacked by any third-party javscript you load into the page. Any attacker that can gain a foothold into your javascript execution environment can trivially subvert your security.
  - firepacket 12y ago
    Assuming your are using SSL, what exactly is the attack vector for getting a "foothold into your javascript execution" besides hacking Coinbase itself? Also, any attacker who gains a foothold of your operating system execution environment can trivially subvert your security as well. Does that mean crypto is broken on PCs?
    - wmf 12y ago
      what exactly is the attack vector for getting a "foothold into your javascript execution"? Browser extensions? Those have been stealing BTC for a while.
    - sillysaurus3 12y ago
      any attacker who gains a foothold of your operating system execution environment can trivially subvert your security as well. Does that mean crypto is broken on PCs? Yes, of course your crypto is broken if an attacker has malware running on your device. The difference between that scenario and Coinbase is that your device only affects you. A break in Coinbase's security will affect hundreds of thousands of people. Assuming your are using SSL, what exactly is the attack vector for getting a "foothold into your javascript execution" besides hacking Coinbase itself? There are at least three vectors. First, XSS. If Coinbase ever has an XSS vuln which allows JS to execute in the same context as their crypto key generation, then that attacker can silently siphon keys as they're being generated. Once enough keys are under their control, they can transfer the BTC of every account they control to the attackers' own wallet. Second attack vector: Third-party JS libraries. If Coinbase is loading JS from any external source, any rogue employee from that source can launch the above attack. This attack may seem unlikely, but greed makes people do strange things, and the amount of money able to be stolen from a successful attack on Coinbase will be in the range of millions, if enough users start using multisig vault. The third attack vector, which a sibling comment mentioned, is a rogue browser extension. Several extensions request permissions on "all websites," and users happily approve them. Now, you can say "Those people deserve what they get," but that's unproductive victim blaming. The fact is that users already behave this way, and letting them lose thousands of dollars for approving some silly extension like "Cloud To Butt" isn't a good thing. Banks do a pretty good job of defending people's money. If they lose people's money because they're attacked, the bank will still credit the money. Would Coinbase?

drcode 12y ago

Though I agree with you this leads to risky security issues, the mere fact that a major Bitcoin exchange is allowing users to hold their own private keys really puts a smile on my face today. It is completely unheard of in the financial industry (and usually technically impossible before cryptocurrencies) to have a bank give away their "middle man" access of people's money and empowering their customers with complete control over their finances.

jerguismi 12y ago
Which makes me wonder... The keys are generated in-browser. What if the users computer is compromised, and a malware succeeds in capturing the keys + bip38 passphrase? I don't know if this product will be pain in the ass for coinbase, if the user funds start disappearing from these multisig addresses. All the best luck for this product, though.
- adrianmacneil 12y ago
  If the computer is infected, then yes it would be possible to steal both the private keys, and the passphrase. To avoid this attack scenario, we're investing pretty heavily in technologies such as CSP. However, this can be mitigated with our group multisig vault, where separate users create their own keys. For malware to steal these, it would require infecting multiple computers.
  - icebraining 12y ago
    Seems like the next step would be to allow the users to store their copies on a smart card instead of a PC.
    - wcoenen 12y ago
      Like the Trezor[1] hardware wallet. [1] http://www.bitcointrezor.com http://www.bitcointrezor.com
      - icebraining 12y ago
        Yes, but maintaining the encrypted copy on Coinbase's servers, to ensure that losing the card doesn't mean losing the wallet.
  - wcummings 12y ago
    CSP?
    - floatrock 12y ago
      Content Security Policy -- http://en.wikipedia.org/wiki/Content_Security_Policy http://en.wikipedia.org/wiki/Content_Security_Policy basically headers that can tell the browser not to execute stuff that leads to injection like inline javascript or inline styling, allows for whitelists of domains (so the browser won't run script src="http://hackercdn.com/malicious.js" http://hackercdn.com/malicious.js"), etc.

adrianmacneil 12y ago

The only argument here is that crypto on internet connected (and potentially compromised) devices is insecure. There's nothing inherently more insecure about browser crypto. Our multisig vault relies on BitcoinJS, which we had audited by an external consulting firm. We also don't allow multisig vault creation on browsers which don't support crypto.getRandomValues()

sillysaurus3 12y ago
The only argument here is that crypto on internet connected (and potentially compromised) devices is insecure. Actually, that's pretty far from the standard arguments: http://matasano.com/articles/javascript-cryptography/ http://matasano.com/articles/javascript-cryptography/ That's pretty much the seminal work of why browser crypto is insecure. The issue isn't whether the primitives you're using are secure. It's that the security of your primitives can be hijacked by any third-party javscript you load into the page. Any attacker that can gain a foothold into your javascript execution environment can trivially subvert your security.
- firepacket 12y ago
  Assuming your are using SSL, what exactly is the attack vector for getting a "foothold into your javascript execution" besides hacking Coinbase itself? Also, any attacker who gains a foothold of your operating system execution environment can trivially subvert your security as well. Does that mean crypto is broken on PCs?
  - wmf 12y ago
    what exactly is the attack vector for getting a "foothold into your javascript execution"? Browser extensions? Those have been stealing BTC for a while.
  - sillysaurus3 12y ago
    any attacker who gains a foothold of your operating system execution environment can trivially subvert your security as well. Does that mean crypto is broken on PCs? Yes, of course your crypto is broken if an attacker has malware running on your device. The difference between that scenario and Coinbase is that your device only affects you. A break in Coinbase's security will affect hundreds of thousands of people. Assuming your are using SSL, what exactly is the attack vector for getting a "foothold into your javascript execution" besides hacking Coinbase itself? There are at least three vectors. First, XSS. If Coinbase ever has an XSS vuln which allows JS to execute in the same context as their crypto key generation, then that attacker can silently siphon keys as they're being generated. Once enough keys are under their control, they can transfer the BTC of every account they control to the attackers' own wallet. Second attack vector: Third-party JS libraries. If Coinbase is loading JS from any external source, any rogue employee from that source can launch the above attack. This attack may seem unlikely, but greed makes people do strange things, and the amount of money able to be stolen from a successful attack on Coinbase will be in the range of millions, if enough users start using multisig vault. The third attack vector, which a sibling comment mentioned, is a rogue browser extension. Several extensions request permissions on "all websites," and users happily approve them. Now, you can say "Those people deserve what they get," but that's unproductive victim blaming. The fact is that users already behave this way, and letting them lose thousands of dollars for approving some silly extension like "Cloud To Butt" isn't a good thing. Banks do a pretty good job of defending people's money. If they lose people's money because they're attacked, the bank will still credit the money. Would Coinbase?