Received-SPF: pass (sog-mx-2.v43.ch3.sourceforge.com: domain of gmail.com
	designates 209.85.212.177 as permitted sender)
	client-ip=209.85.212.177; envelope-from=mh.in.england@gmail.com;
	helo=mail-wi0-f177.google.com; 
MIME-Version: 1.0
Sender: mh.in.england@gmail.com
In-Reply-To: <CALkkCJbk0czFj5mdMB6_0+Umw5V-fo-4tdBHgvg92zhyRZWiYQ@mail.gmail.com>
References: <27395C55-CF59-4E65-83CA-73F903272C5F@gmail.com>
	<54CE3816.6020505@bitwatch.co>
	<68C03646-02E7-43C6-9B73-E4697F3AA5FD@gmail.com>
	<CALkkCJbk0czFj5mdMB6_0+Umw5V-fo-4tdBHgvg92zhyRZWiYQ@mail.gmail.com>
Date: Mon, 2 Feb 2015 18:59:54 +0100
Message-ID: <CANEZrP0QjPm+TTgV9Fh84vt2zLaGp0R2Wt2ZL2ZXYhxzOFPHVA@mail.gmail.com>
From: Mike Hearn <mike@plan99.net>
To: =?UTF-8?Q?Martin_Habov=C5=A1tiak?= <martin.habovstiak@gmail.com>
Content-Type: multipart/alternative; boundary=001a11c3f51ab8c6cb050e1eb87c
Cc: Bitcoin Dev <bitcoin-development@lists.sourceforge.net>
Subject: Re: [Bitcoin-development] Proposal to address Bitcoin malware
Precedence: list

--001a11c3f51ab8c6cb050e1eb87c
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

We're way ahead of you guys ;)

On Mon, Feb 2, 2015 at 6:54 PM, Martin Habov=C5=A1tiak <
martin.habovstiak@gmail.com> wrote:

> Good idea. I think this could be even better:
>
> instead of using third party, send partially signed TX from computer
> to smartphone. In case, you are paranoid, make 3oo5 address made of
> two cold storage keys, one on desktop/laptop, one on smartphone, one
> using third party.
>

https://www.bitcoinauthenticator.org/      - does this already, currently
in alpha


> > It should be possible to use multisig wallets to protect against
> malware.  For example, a user could generate a wallet with 3 keys and
> require a transaction that has been signed by 2 of those keys.  One key i=
s
> placed in cold storage and anther sent to a third-party.
>

BitGo, CryptoCorp and (slight variant) GreenAddress all offer this model.

--001a11c3f51ab8c6cb050e1eb87c
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">We&#39;re way ahead of you guys ;)<br><div class=3D"gmail_=
extra"><br><div class=3D"gmail_quote">On Mon, Feb 2, 2015 at 6:54 PM, Marti=
n Habov=C5=A1tiak <span dir=3D"ltr">&lt;<a href=3D"mailto:martin.habovstiak=
@gmail.com" target=3D"_blank">martin.habovstiak@gmail.com</a>&gt;</span> wr=
ote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex=
;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style=
:solid;padding-left:1ex">Good idea. I think this could be even better:<br>
<br>
instead of using third party, send partially signed TX from computer<br>
to smartphone. In case, you are paranoid, make 3oo5 address made of<br>
two cold storage keys, one on desktop/laptop, one on smartphone, one<br>
using third party.<br></blockquote><div><br></div><div><a href=3D"https://w=
ww.bitcoinauthenticator.org/">https://www.bitcoinauthenticator.org/</a> =C2=
=A0 =C2=A0 =C2=A0- does this already, currently in alpha</div><div>=C2=A0</=
div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;bor=
der-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:sol=
id;padding-left:1ex"><div class=3D""><div class=3D"h5">&gt; It should be po=
ssible to use multisig wallets to protect against malware.=C2=A0 For exampl=
e, a user could generate a wallet with 3 keys and require a transaction tha=
t has been signed by 2 of those keys.=C2=A0 One key is placed in cold stora=
ge and anther sent to a third-party.<br></div></div></blockquote><div><br><=
/div><div>BitGo, CryptoCorp and (slight variant) GreenAddress all offer thi=
s model.=C2=A0</div></div></div></div>

--001a11c3f51ab8c6cb050e1eb87c--