1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
|
Received: from sog-mx-1.v43.ch3.sourceforge.com ([172.29.43.191]
helo=mx.sourceforge.net)
by sfs-ml-4.v29.ch3.sourceforge.com with esmtp (Exim 4.76)
(envelope-from <pedro@worcel.com>) id 1YIOYd-0006DV-Nw
for bitcoin-development@lists.sourceforge.net;
Mon, 02 Feb 2015 21:29:23 +0000
X-ACL-Warn:
Received: from mail-ig0-f171.google.com ([209.85.213.171])
by sog-mx-1.v43.ch3.sourceforge.com with esmtps (TLSv1:RC4-SHA:128)
(Exim 4.76) id 1YIOYc-0007uH-Je
for bitcoin-development@lists.sourceforge.net;
Mon, 02 Feb 2015 21:29:23 +0000
Received: by mail-ig0-f171.google.com with SMTP id h15so5480381igd.4
for <bitcoin-development@lists.sourceforge.net>;
Mon, 02 Feb 2015 13:29:17 -0800 (PST)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20130820;
h=x-gm-message-state:message-id:date:from:user-agent:mime-version:to
:subject:references:in-reply-to:content-type
:content-transfer-encoding;
bh=94qdy4A6M1oyp1xxVELvuzjQvI5ZmMx5qkv5eWmdZTY=;
b=h/JktMXl/qI/TdgMj6RfbJaCFPTA89++WLBxRXgCCbl5ZsRzT2aLBFRAybMGFaP+Zn
Ix/ELn1Cv4uEqmRG1K0GcNA6t8lLr3FV8+C57xLgJdffKG/F76N4X3677uFzbm4qFw+d
yQFsMWOyuvZj0YyTNvtUKOUUHpANboNCTu76RpZp/Dcxu0pR2/WvW8BVncgafFDZQbZk
Dfn6wXvpu19FSQHOjuOGUFzFDJ1Ufmiu04u6wmKrPPUYv19NxoPb1olq89rm7QoAGi6W
IDLbgOot1EgUpMMMWl4vN5ivtH7tKTiMkYRQrrSH03Q+GUFgdkj/iITK/N0NSYieXnDl
JrvQ==
X-Gm-Message-State: ALoCoQnQl4pIA/PwrbMijKBBPc/qCijxvvmtrr11/dZ6GlZ8DYhYA7EZZZI1puV3sNhC8uRwWk1i
X-Received: by 10.107.47.217 with SMTP id v86mr24390326iov.86.1422910938850;
Mon, 02 Feb 2015 13:02:18 -0800 (PST)
Received: from [192.168.20.101] (203-97-255-117.cable.telstraclear.net.
[203.97.255.117])
by mx.google.com with ESMTPSA id b64sm6657820iob.42.2015.02.02.13.02.16
for <bitcoin-development@lists.sourceforge.net>
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Mon, 02 Feb 2015 13:02:17 -0800 (PST)
Message-ID: <54CFE5D5.2070908@worcel.com>
Date: Tue, 03 Feb 2015 10:02:13 +1300
From: Pedro Worcel <pedro@worcel.com>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
rv:31.0) Gecko/20100101 Thunderbird/31.4.0
MIME-Version: 1.0
To: bitcoin-development@lists.sourceforge.net
References: <27395C55-CF59-4E65-83CA-73F903272C5F@gmail.com> <54CE3816.6020505@bitwatch.co> <68C03646-02E7-43C6-9B73-E4697F3AA5FD@gmail.com> <CALkkCJbk0czFj5mdMB6_0+Umw5V-fo-4tdBHgvg92zhyRZWiYQ@mail.gmail.com> <CANEZrP0QjPm+TTgV9Fh84vt2zLaGp0R2Wt2ZL2ZXYhxzOFPHVA@mail.gmail.com> <CALkkCJYuM_T=_nfBOCF4S8XhVecUZA0ug==Y_n+qdFpb-F628g@mail.gmail.com> <CANEZrP1QZqP6wSxcNJt81c4=xXLJsEsPF-CN71NZzwdOFSpB2A@mail.gmail.com> <57186618-F010-42E6-A757-B617C4001B5B@gmail.com> <F4C9E954-6A29-4A31-B09B-7F0B62270EF8@voskuil.org>
<4B53C1B0-A677-4460-8A69-C45506424D7F@gmail.com>
In-Reply-To: <4B53C1B0-A677-4460-8A69-C45506424D7F@gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
X-Spam-Score: 0.5 (/)
X-Spam-Report: Spam Filtering performed by mx.sourceforge.net.
See http://spamassassin.org/tag/ for more details.
0.5 AWL AWL: Adjusted score from AWL reputation of From: address
X-Headers-End: 1YIOYc-0007uH-Je
Subject: Re: [Bitcoin-development] Proposal to address Bitcoin malware
X-BeenThere: bitcoin-development@lists.sourceforge.net
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: <bitcoin-development.lists.sourceforge.net>
List-Unsubscribe: <https://lists.sourceforge.net/lists/listinfo/bitcoin-development>,
<mailto:bitcoin-development-request@lists.sourceforge.net?subject=unsubscribe>
List-Archive: <http://sourceforge.net/mailarchive/forum.php?forum_name=bitcoin-development>
List-Post: <mailto:bitcoin-development@lists.sourceforge.net>
List-Help: <mailto:bitcoin-development-request@lists.sourceforge.net?subject=help>
List-Subscribe: <https://lists.sourceforge.net/lists/listinfo/bitcoin-development>,
<mailto:bitcoin-development-request@lists.sourceforge.net?subject=subscribe>
X-List-Received-Date: Mon, 02 Feb 2015 21:29:23 -0000
I think what he is saying is that there is no point in having three
signatures if they are not segregated in a secure manner. This is to
say, if you use your computer as one "factor", and a third party website
as another, but you use the same computer to access the website, there
is no gain in security.
Another example would be an android phone. If your computer is
compromised and your browser is authenticated to your Google account,
you could remotely install an "app" on your phone.
I don't know if I understood/explained myself correctly; I think two
factor is better than one and there is a security gain if implemented
securely.
Cheers!
Pedro
On 2/3/2015 8:58 AM, Brian Erdelyi wrote:
>> Confusing or not, the reliance on multiple signatures as offering greater security than single relies on the independence of multiple secrets. If the secrets cannot be shown to retain independence in the envisioned threat scenario (e.g. a user's compromised operating system) then the benefit reduces to making the exploit more difficult to write, which, once written, reduces to no benefit. Yet the user still suffers the reduced utility arising from greater complexity, while being led to believe in a false promise.
> Just trying to make sure I understand what you’re saying. Are you eluding to that if two of the three private keys get compromised there is no gain in security? Although the likelihood of this occurring is lower, it is possible.
>
> As more malware targets bitcoins I think the utility is evident. Given how final Bitcoin transactions are, I think it’s worth trying to find methods to help verify those transactions (if a user deems it to be high-risk enough) before the transaction is completed. The balance is trying to devise something that users do not find too burdensome.
>
> Brian Erdelyi
> ------------------------------------------------------------------------------
> Dive into the World of Parallel Programming. The Go Parallel Website,
> sponsored by Intel and developed in partnership with Slashdot Media, is your
> hub for all things parallel software development, from weekly thought
> leadership blogs to news, videos, case studies, tutorials and more. Take a
> look and join the conversation now. http://goparallel.sourceforge.net/
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
|
