Hacker News new | ask | show | jobs
by JonathanBeuys 1317 days ago
And you do that with pencil and paper?

If you use software by a 3rd party, we are back to squear one.

3 comments

You don't use 3rd party software to generate the wallet. Electrum, Specter, or another FOSS app can do it fine.

The keys have 3rd-party software, but all they do is sign. Don't have a quorum from the same manufacturer. If it takes 3 signatures of 5, don't use 3 from the same company.

That's what I mean with 3rd party software.

If you use Electrum, you are hoping that Electrum is not buggy or malicious.

It's open-source. Read the code. You don't have to trust anybody.
Nobody can read all the code of Electrum and all its dependencies and be sure it is secure. It is much too complex.
By that logic, nothing can ever be secure for any reason. We should all abandon the internet and go home.

From the string of your comments throughout this conversation, you seem to be making some weird, "I can't do it, so nobody can do it," false equivalency.

I don't know you from anybody, but I'm reasonably confident you're not more intelligent than all the highly incentivized people who have been, on the one hand, solving these problems against adversaries on the other hand who are every bit as incentivized to unsolve them.

None of the points I've made have been in any way groundbreaking or insightful. They're basic "I spent my free time for a year going down the bitcoin rabbit hole" stuff. You're throwing out incredibly basic objections as though they somehow mean the whole system is an unreliable fraud, but all it's really showing is that you haven't done even a cursory overview of the topic.

I'm really not trying to be rude here. People can understand code, even lots of it. People do understand it. They even understand the high-level cryptography these systems are built on. You might not, but that doesn't mean nobody does, much less that nobody can.

Nothing can ever be completely secure, but one can increase the security.

The aspect of security I talked about is reducing counterparty risk. What one can do to reduce counterparty risk is to have multiple systems, make them as independent as possible, and compare the output they create.

Example:

1: An air gapped Dell laptop with Electrum on Linux

2: Another air gapped laptop. From Lenovo with Specter on Windows.

Create your seed phrase offline with dice and put them into both.

Every address you create, every transaction you sign - do it on both systems and compare the output.

Now, both systems would have to be faulty/malicious in the same way to harm you.

OP explained this, if the signing is required by multiple 3rd parties then you’re good. You can do this with pencil and paper btw and write down keys. It’s not far fetched.
Still sounds far fetched to me.

Do these types of smart contracts exist on Bitcoin?

I don't want to be rude, but you're not the only smart person who's thought of counterparty risks. There's tremendous incentive to all sorts of people to break the cryptographic security that secures these networks. And, thus, also incentive to stay ahead of those people.
I'm not very worried about the cryptographic security of the Bitcoin blockchain.

I am worried that in 5 years we will learn that some hardware wallets used side channels to transfer bits of your private key out to make it easier to guess for someone who worked at the manufacturer.

But you can check this. You can monitor whether info is leaving on other channels. And you can sign on an air-gapped computer and transfer only the signed transaction hash (never the privkey) to a connected one to broadcast. You can do all but the actual signature with open source tools.

Just because you haven't taken the time to learn how this stuff works doesn't mean there aren't thousands of incredibly intelligent people who have been working on it for a decade and have actually solved the low-level concerns you have.

You cannot monitor all channels when you use just a single way to create your hashes.

Example: If you use a single hardware wallet to sign your transactions, you have no way to know if the wallet transmits data out via the hashkey:

https://news.ycombinator.com/item?id=32181462

They don't need to. Multisig is built directly into the protocol for BTC.

Search BTC multisig and you can learn all about it.

I know Bitcoin multisigs.

But nobody is creating them with pencil and paper.

I don't know what that comment was about. That would be a weird way to do it. I don't know why anyone would want to.
Write the smart contract yourself and deploy it to the blockchain