Hacker News Reader

Comment by maxtaco | Hacker News Reader

I wrote a little blog article on how to store the majority of your bitcoin using a security-enhanced brainwallet. Part of the argument is that exchanges and online wallets are and will continue to be magnets for good XSS/CSRF attacks. Mt.Gox/Coinbase Engineers are fighting a difficult fight against well-incentivized enemies.

http://maxtaco.github.io/bitcoin/2014/01/16/how-jason-bourne...

View on HN

I just submitted this to HN expecting to be taken to the most recent submission of it, but was surprised to discover it hasn't ever been submitted. Sorry. https://news.ycombinator.com/item?id=7083393

While your WarpWallet is a nice initiative, it doesn't meet the 5th demand of a storage system; immune to physical coercion.

I'll just leave this here; https://xkcd.com/538/

That's not a totally fair analogy. The adversary in this case shouldn't even know you have bitcoin or a WarpWallet; so why would they bother to torture it out of you in the first place?

Edit: but I guess I agree, it would be a nice feature to have that we didn't think much about. I wonder what a solution would even look like.

IIRC, Julian Assange worked on torture resistant passwords: users memorize a maze that they would have trouble doing under duress.

Ive been thinking about how to implement a dead mans switch for passwords or private keys. A remote server that is synced with your local login and will change the password to something random every x hours unless you 'check in'. If you do check in, your password works, if you dont check in because you are being held or have had your phone taken away from you then it will change it to something random.

Problems to solve at the moment are the security of the remote server, recovery after you let go of the switch and how ti implement the sync (instead of a remote connection, something like a shared secret used as a generation seed, like RSA tokens, that only needs to be synced once).

Yeah the issue is in recovery. As a general rule, when I've attempted to implement something like this, I run into the issue of "if I can recover, they can force me to" :( would be seriously interested in a solution if you come up with one!

I like that. I think there's a market for key combinations, passwords or even facial recognition to say "I've been compromised, scramble everything"

Reply on news.ycombinator.com