References: <27395C55-CF59-4E65-83CA-73F903272C5F@gmail.com>
	<54CE3816.6020505@bitwatch.co>
	<68C03646-02E7-43C6-9B73-E4697F3AA5FD@gmail.com>
	<CALkkCJbk0czFj5mdMB6_0+Umw5V-fo-4tdBHgvg92zhyRZWiYQ@mail.gmail.com>
	<CANEZrP0QjPm+TTgV9Fh84vt2zLaGp0R2Wt2ZL2ZXYhxzOFPHVA@mail.gmail.com>
	<CALkkCJYuM_T=_nfBOCF4S8XhVecUZA0ug==Y_n+qdFpb-F628g@mail.gmail.com>
	<CANEZrP1QZqP6wSxcNJt81c4=xXLJsEsPF-CN71NZzwdOFSpB2A@mail.gmail.com>
	<57186618-F010-42E6-A757-B617C4001B5B@gmail.com>
Mime-Version: 1.0 (1.0)
In-Reply-To: <57186618-F010-42E6-A757-B617C4001B5B@gmail.com>
Content-Type: text/plain;
	charset=utf-8
Content-Transfer-Encoding: quoted-printable
Message-Id: <F4C9E954-6A29-4A31-B09B-7F0B62270EF8@voskuil.org>
From: Eric Voskuil <eric@voskuil.org>
Date: Mon, 2 Feb 2015 11:45:49 -0700
To: Brian Erdelyi <brian.erdelyi@gmail.com>
Cc: Bitcoin Dev <bitcoin-development@lists.sourceforge.net>
Subject: Re: [Bitcoin-development] Proposal to address Bitcoin malware
Precedence: list

Confusing or not, the reliance on multiple signatures as offering greater se=
curity than single relies on the independence of multiple secrets. If the se=
crets cannot be shown to retain independence in the envisioned threat scenar=
io (e.g. a user's compromised operating system) then the benefit reduces to m=
aking the exploit more difficult to write, which, once written, reduces to n=
o benefit. Yet the user still suffers the reduced utility arising from great=
er complexity, while being led to believe in a false promise.


> On Feb 2, 2015, at 11:35 AM, Brian Erdelyi <brian.erdelyi@gmail.com> wrote=
:
>=20
>=20
>> Bitcoin Authenticator is a desktop app+mobile app pair. It pairs with you=
r phone over wifi, cloud push, maybe Bluetooth as well. I forget exactly.=20=

>>=20
>> It's done in the same way as Lighthouse, so it runs Win/Mac/Linux on desk=
top and Android on mobile.
>>=20
>> It could be adapted to use BitGo as a third party key holder with SMS aut=
henticator relatively easily, I think. We did the bulk of all the needed wor=
k last year as part of the bitcoinj multisig work. Then you'd have a server i=
nvolved, but not a web app.
>=20
> I really like the concept of Bitcoin Authenticator and think it=E2=80=99s e=
xactly what I was describing (without a third-party).
>=20
> I think it=E2=80=99s a bit confusing when they describe Bitcoin Authentica=
tor as 2FA.  I think it may be more accurate to describe it as out of band t=
ransaction verification/signing or dual transaction signing.  Regardless, it=
=E2=80=99s very exciting to see others are thinking about this too.
>=20
> Brian Erdelyi
> --------------------------------------------------------------------------=
----
> Dive into the World of Parallel Programming. The Go Parallel Website,
> sponsored by Intel and developed in partnership with Slashdot Media, is yo=
ur
> hub for all things parallel software development, from weekly thought
> leadership blogs to news, videos, case studies, tutorials and more. Take a=

> look and join the conversation now. http://goparallel.sourceforge.net/
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development