3 ms·

Does this exchange offer insurance against catastrophic insolvency? Someone went from millionaire to poor overnight when Mt. Gox failed, so it's a real concern

Does this exchange offer insurance against catastrophic insolvency? Someone went from millionaire to poor overnight when Mt. Gox failed, so it's a real concern. No one should keep their coins in any wallet except their own, and they need to make sure they have the technical understanding of how to properly manage their wallet. If your personal wallet isn't encrypted and backed up, it's not managed properly. If you want to store coins on someone's exchange or webwallet, never store more than 25% of what you're comfortable with losing. (It turns out that "what you're comfortable with losing" is way, way more than the reality of waking up one day and realizing you've lost it all.) This is an interesting move, but I'm worried that these new exchanges will increase the attack surface of Bitcoin's reputation. If the new ones fail, it will shake the public's confidence in Bitcoin yet again. Not that that matters, since Bitcoin seems to go along fine whether or not people are confident in it. I don't know whether it would even be possible to insure against losing all cold storage reserves, but nobody should trust large sums to any webwallet (including Coinbase's current website, BTC-e, Bitstamp, etc) until protection against that worst-case scenario is in place. EDIT: From the paywalled article: The exchange could bring needed legitimacy to the currency, which isn’t backed by a central government and is traded over virtual exchanges, primarily overseas. Coinbase said it has insurance, offering traders some assurance that their money won’t disappear. Until details about this insurance are released, do not trust large sums to Coinbase or anyone else. And unless the insurance protects against every coin disappearing tomorrow, never trust them at all. Trusting them is equivalent to gambling your savings for no benefit.

bobbygoodlatte 12y ago
"No one should keep their coins in any wallet except their own" That's just not going to fly if Bitcoin becomes mainstream. There's too much dogmatism around this in the Bitcoin community. Sometimes a hosted wallet is the right solution for a particular user.
- sillysaurus3 12y ago
  It's not about whether it's going to fly. It's certifiably insane to trust your coins to any third party unless you either have multisig control to prevent those coins from leaving, or they have insurance to replace your coins. Do not ever trust anyone, or you'll lose your money like I did. They won't replace it unless they're legally obligated to replace it (insurance) or they're technically incapable of losing it (multisig). Anything else is magical thinking at its most dangerous, since it can ruin lives.
  - beaner 12y ago
    This is a religious view speaking. More bitcoin has probably been lost due to people thinking they should handle it themselves, and doing it wrong, than has been lost to all the big hacks including Mt. Gox. A survey from a while ago reflects this likeliness: http://www.reddit.com/r/Bitcoin/comments/2bjefu/results_of_a_3000_person_bitcoin_survey/ http://www.reddit.com/r/Bitcoin/comments/2bjefu/results_of_a...
    - sillysaurus3 12y ago
      I didn't say everyone should manage their own bitcoin. I said people should manage it themselves if they have the technical ability to do so. For everyone else, stick with banks. If you're borderline unsure whether you can store your coins in an encrypted wallet and make regular backups and not lose those backups, then keep your money in an FDIC-insured bank. But sticking your coins into a webwallet like Coinbase without multisig control is a recipe for unmitigated personal disaster. A mental exercise is useful: "I've lost all my money." How would that affect your life? I strongly disagree with anyone who would push the view that it's okay to sweep the issues under the rug in the name of making Bitcoin more popular. Putting people's fortunes at risk is almost equivalent to putting their lives at risk, because your quality of life is directly proportional to your fortune. If Bitcoin sounds risky, that's because it is. No amount of regulated exchanges will change that. What will change it is giving consumers multisig control over their coins, or insuring against a total loss of all coins including cold storage. There's literally no other option. One of those two things must happen, or you must not use the services. Or if you do use them, don't put in more than a quarter of what you're comfortable with losing. If that's $100, then never deposit more than $25 in BTC. Remember, Bitstamp just lost $5 million USD to hackers, or half their most recent investment round. It's unknown whether they're currently insolvent. Everyone thinks they might have enough money to cover the losses, but nobody knows for sure. They could currently be a fractional reserve. So Mt. Gox wasn't a one-off. Nobody is safe from hackers, technical issues, or even rogue employees that want to become millionaires. Due to the untraceable nature of Bitcoin, all exchanges and webwallets are extremely attractive targets.
      - 12y ago
- mirimir 12y ago
  Bitcoin arguably cannot become mainstream without secure hosted wallets. Most people won't use Bitcoins until wallets start looking like debit cards, with authenticated access, insurance, and so on. Even so, prudent investors will keep large balances in offline wallets, securely encrypted and backed up. In my experience, it's simplest to use multiple offline wallets, each in its own VM. To start using a wallet, one merely copies its VM to an online host, and appropriately configures network access for the VM.
  - tlrobinson 12y ago
    Not sure I'd call that "simple". A hardware wallet like Trezor seems like a much better solution.
    - mirimir 12y ago
      That's too proprietary for me. Too much could go wrong. If someone has enough Bitcoins to bother with offline wallets, knowing how to use VMs isn't too much to expect.
      - tlrobinson 12y ago
        Trezor uses BIP-32 hierarchical deterministic wallets, BIP-39 mnemonic seeds, an open communication protocol, and entirely open source software and hardware (firmware and schematics, no PCB). If you have concerns about the RNG you can import BIP-32/39 wallets from elsewhere. It also now supports multisig. I'm not really sure what storing entire VMs as "wallets" gets you. VMs don't protect the guest VM from a compromised host OS, so at best you're protecting the host (and therefore other guests) from a compromised wallet VM. But then why not spin up a fresh VM and type in the wallet's mnemonic seed? I suppose you could argue it protects against unsophisticated attacks like malware on the host OS looking for "wallet.dat", but that's about it. With hardware wallets, assuming the firmware is bug-free (which is difficult, but easier on a simple embedded device than a PC running millions of lines of code), you could plug it into the most malware infested machine imaginable and still securely send your bitcoins to the intended address (excluding DOS attacks, and assuming you verify the address out of band) There are a couple ways to use a hardware wallet to manage funds. You could use a single wallet with a single seed and multiple addresses, but if the host AND device are compromised you'd lose all the funds, so ideally you'd split offline funds across a bunch of seeds that are either stored in individual Trezors, or on paper to be entered into a Trezor when they need to be transferred. Multisig adds another strong layer of protection, and would be wise especially in organizations where you don't want to trust funds to individuals.
lappa 12y ago
The way Coinbase words it, they may be only insuring 3% of your funds. The online wallet is insured[1], but there may only be 3% online[2] meaning a malicious employee or just a mistake leading to their cold wallet being lost probably isn't protected. [1] http://blog.coinbase.com/post/95927658922/coinbase-is-insured http://blog.coinbase.com/post/95927658922/coinbase-is-insure... [2] https://www.coinbase.com/security https://www.coinbase.com/security

bobbygoodlatte 12y ago

"No one should keep their coins in any wallet except their own" That's just not going to fly if Bitcoin becomes mainstream. There's too much dogmatism around this in the Bitcoin community. Sometimes a hosted wallet is the right solution for a particular user.

sillysaurus3 12y ago
It's not about whether it's going to fly. It's certifiably insane to trust your coins to any third party unless you either have multisig control to prevent those coins from leaving, or they have insurance to replace your coins. Do not ever trust anyone, or you'll lose your money like I did. They won't replace it unless they're legally obligated to replace it (insurance) or they're technically incapable of losing it (multisig). Anything else is magical thinking at its most dangerous, since it can ruin lives.
- beaner 12y ago
  This is a religious view speaking. More bitcoin has probably been lost due to people thinking they should handle it themselves, and doing it wrong, than has been lost to all the big hacks including Mt. Gox. A survey from a while ago reflects this likeliness: http://www.reddit.com/r/Bitcoin/comments/2bjefu/results_of_a_3000_person_bitcoin_survey/ http://www.reddit.com/r/Bitcoin/comments/2bjefu/results_of_a...
  - sillysaurus3 12y ago
    I didn't say everyone should manage their own bitcoin. I said people should manage it themselves if they have the technical ability to do so. For everyone else, stick with banks. If you're borderline unsure whether you can store your coins in an encrypted wallet and make regular backups and not lose those backups, then keep your money in an FDIC-insured bank. But sticking your coins into a webwallet like Coinbase without multisig control is a recipe for unmitigated personal disaster. A mental exercise is useful: "I've lost all my money." How would that affect your life? I strongly disagree with anyone who would push the view that it's okay to sweep the issues under the rug in the name of making Bitcoin more popular. Putting people's fortunes at risk is almost equivalent to putting their lives at risk, because your quality of life is directly proportional to your fortune. If Bitcoin sounds risky, that's because it is. No amount of regulated exchanges will change that. What will change it is giving consumers multisig control over their coins, or insuring against a total loss of all coins including cold storage. There's literally no other option. One of those two things must happen, or you must not use the services. Or if you do use them, don't put in more than a quarter of what you're comfortable with losing. If that's $100, then never deposit more than $25 in BTC. Remember, Bitstamp just lost $5 million USD to hackers, or half their most recent investment round. It's unknown whether they're currently insolvent. Everyone thinks they might have enough money to cover the losses, but nobody knows for sure. They could currently be a fractional reserve. So Mt. Gox wasn't a one-off. Nobody is safe from hackers, technical issues, or even rogue employees that want to become millionaires. Due to the untraceable nature of Bitcoin, all exchanges and webwallets are extremely attractive targets.
    - 12y ago
mirimir 12y ago
Bitcoin arguably cannot become mainstream without secure hosted wallets. Most people won't use Bitcoins until wallets start looking like debit cards, with authenticated access, insurance, and so on. Even so, prudent investors will keep large balances in offline wallets, securely encrypted and backed up. In my experience, it's simplest to use multiple offline wallets, each in its own VM. To start using a wallet, one merely copies its VM to an online host, and appropriately configures network access for the VM.
- tlrobinson 12y ago
  Not sure I'd call that "simple". A hardware wallet like Trezor seems like a much better solution.
  - mirimir 12y ago
    That's too proprietary for me. Too much could go wrong. If someone has enough Bitcoins to bother with offline wallets, knowing how to use VMs isn't too much to expect.
    - tlrobinson 12y ago
      Trezor uses BIP-32 hierarchical deterministic wallets, BIP-39 mnemonic seeds, an open communication protocol, and entirely open source software and hardware (firmware and schematics, no PCB). If you have concerns about the RNG you can import BIP-32/39 wallets from elsewhere. It also now supports multisig. I'm not really sure what storing entire VMs as "wallets" gets you. VMs don't protect the guest VM from a compromised host OS, so at best you're protecting the host (and therefore other guests) from a compromised wallet VM. But then why not spin up a fresh VM and type in the wallet's mnemonic seed? I suppose you could argue it protects against unsophisticated attacks like malware on the host OS looking for "wallet.dat", but that's about it. With hardware wallets, assuming the firmware is bug-free (which is difficult, but easier on a simple embedded device than a PC running millions of lines of code), you could plug it into the most malware infested machine imaginable and still securely send your bitcoins to the intended address (excluding DOS attacks, and assuming you verify the address out of band) There are a couple ways to use a hardware wallet to manage funds. You could use a single wallet with a single seed and multiple addresses, but if the host AND device are compromised you'd lose all the funds, so ideally you'd split offline funds across a bunch of seeds that are either stored in individual Trezors, or on paper to be entered into a Trezor when they need to be transferred. Multisig adds another strong layer of protection, and would be wise especially in organizations where you don't want to trust funds to individuals.

lappa 12y ago

The way Coinbase words it, they may be only insuring 3% of your funds. The online wallet is insured[1], but there may only be 3% online[2] meaning a malicious employee or just a mistake leading to their cold wallet being lost probably isn't protected. [1] http://blog.coinbase.com/post/95927658922/coinbase-is-insured http://blog.coinbase.com/post/95927658922/coinbase-is-insure... [2] https://www.coinbase.com/security https://www.coinbase.com/security