17 ms·

Coinbase introduces Vault

183 points by mihar 12y ago

spacefight 12y ago
In other news - "use vault, the regular wallet is insecure".
- kolev 12y ago
  Yes, there shouldn't be degrees in security - a system is either secure or not.
  - josephlord 12y ago
    Well then nothing is secure. At least as far as a whole system goes including the soft squishy components designing, developing and operating it. Even for cryptography the only absolute proven secure method is the one time pad which has very real practical flaws and risks if you try to operate it in the real world.
  - wmf 12y ago
    The threat model here is people leaking their own Coinbase passwords (via phishing, compromised PC, etc.), so the 48-hour delay and out-of-band verification ought to actually help.
    - kolev 12y ago
      So, 72-hour delay is even more secure?
      - AndrewGaspar 12y ago
        Yep, and if you dump all your coins into an account with no private key, nobody can get your bitcoins ever, so that's really what everybody should do.
        kolev 12y ago
        All sarcasm aside, Bitcoin is becoming more and more centralized everyday.
  - mhluongo 12y ago
    Of course that's not true. Convenience / security trade-offs are common, and lie on a spectrum.
    - spacefight 12y ago
      Hardly a valid point if it's money related, but that's just me then, as the downvotes imply.
      - weavejester 12y ago
        Even if it's money related. Carrying physical cash around with you is convenient, but not as secure as storing it in a bank.
xfour 12y ago
Is anyone else picturing the digital equivalent of this Al Pacino snl video? http://kristenwiigdaily.tumblr.com/post/27009841161/mygiftismysongand-snl-al-pacino-checks-his http://kristenwiigdaily.tumblr.com/post/27009841161/mygiftis...
PabloOsinaga 12y ago
I wonder how well Xapo is doing - because this seems like a copycat.
- buttsex 12y ago
  Same with BitGo.
- kanzure 12y ago
  > I wonder how well Xapo is doing - because this seems like a copycat. And there's going to be even more copycats than there already are. Making APIs on top of Bitcoin's API is going to get way, way more competitive because that's basically the first idea that every player entering the market has. It's extremely low capital to spin up a new API, so everyone and their mom's dog have been doing it. Transaction fees will be driven down by the copycats, and many of them will probably cut their transaction fees to zero for a long time (ahem, Coinbase).
white_eskimo 12y ago
Why is multi-sig in quotes? Is Coinbase providing its users with a '3' address that is on-block chain, or does this "multi-sig" approach still reside entirely off-block chain. Edit: I presume that Coinbase still holds on to all of the private keys for Vault accounts. Can someone verify otherwise?
- michaelt 12y ago
  Some people use quotes to imply "this is not my term" - this is sometimes used for jargon and words you won't find in a dictionary. For example: The economist said I should consider my "BATNA" or GPS receivers measure "pseudoranges". Just as using jargon can indicate you are part of an group, putting quote marks around jargon indicates you stand apart from that group.
enra 12y ago
Actual launch page and a video about how it works https://coinbase.com/vault https://coinbase.com/vault
sejje 12y ago
I'm assuming the vault doesn't improve security at all in the event that coinbase gets hacked and loses all of their btc?
- tlrobinson 12y ago
  Multisig might. "To complete the Coinbase Vault offering, we will be adding multi-signature (“multi-Sig”) technology in the coming weeks to enable customers to manage their own vault security." It's not clear exactly how that will work, but if it's, say, 2-of-3 and Coinbase only holds one of the keys then it would.
  - ukd1 12y ago
    Multisig would be good, especially if it's actually a address keypair, as it would allow you to verify the balance held exists.
- aeharding 12y ago
  They're all offline, stored in real safety deposit boxes and bank vaults...
  - danielweber 12y ago
    The keys are stored offline, but the BTC are always online. They are relatively safe against someone compromising your computers remotely. Against physical intrusions or insider attacks, not as much.
    - icebraining 12y ago
      Physical intrusions can be dealt with by encrypting the keys, which I hope they are doing. Using a secret sharing scheme with physical tokens (e.g. smartcards) carried by chosen employees should reduce the danger of both of those attacks.
      - TheMakeA 12y ago
kolev 12y ago
How about fixing the web app before adding more features? Their Ajax page loading hangs most of the time. Going straight to the URL works immediately, but it's not always possible.
- flexo0r 12y ago
  I thought I was the only one experiencing this. My feeling is that the sometimes extreme slowness of their website is not unintentional, kind of like their arbitrary canceling or delaying of transactions and blaming it on false positives in their "high risk detection algorithm".
  - kolev 12y ago
    I honestly doubt that. For example, I tried to create a new wallet yesterday. The line indicator bar took its time (over 5 minutes) and never completed. Refreshed the page, it was there. Renamed another wallet - same thing. I'm not sure how this UI that never confirms that some operation completed can be intentional! This always happens to me - at least on Firefox as haven't used Chrome recently. Switching from Buy to Sell, for example, is the same. Any navigation, which is using history.pushState(), obviously, takes minutes, and almost never completes. I just know the routes by heart and key them in (no kidding), or click to get the route updated and then refresh. Honestly, I can't wait for Circle to grant me access... or Buttercoin or whatever alternative as we need redundancy. expresscoin seems nice, but its fees are much higher.
- mhluongo 12y ago
  This. And the API.
  - coinbase-craig 12y ago
    Hi, Craig here from Coinbase. What changes would you like to see to the API?
    - chris-martin 12y ago
state 12y ago
Is this where Tim is going to store his coins?
- wmf 12y ago
  Obviously not if he bought them to provide liquidity for competitor Vaurum.
peteretep 12y ago
If it's not insured, what's the point?
- josu 12y ago
  From a customer's perspective a false sense of security. From Coinbase's point of view, it decreases their need for liquidity and their chances of a run.
- mhluongo 12y ago
  If this is their jumping-off point for multi-sig I'd be interested.
woah 12y ago
What's up with the cold storage? That is absolutely no security, it is purely an operational detail on Coinbase's side. You are still trusting them with all your coins. Once they get multi-sig, that might actually be something interesting. For all we know, the "Vault" might just be a new menu item and some css.
arasmussen 12y ago
I disagree with the direction Coinbase is going. Of all the things they could have built next, this is what they chose? Why not develop a button that says "Pay with Bitcoin by Coinbase" that allows one-click payments on third party websites/mobile apps? Or why not compete with Bitstamp and btc-e on the exchange front? There's definitely tons of room for competition there. Consider a traditional USD/EUR bank account. If your bank offers you a "vault" option to store your large balance to offer better reassurance that it won't get stolen from your "regular account"/wallet, aren't you going to have some serious concerns about security of the regular account? Instead of offering a "more secure account" why don't think just work on the fact that people feel that their regular accounts are insecure. This seems like a bandaid on the problem rather than the proper fix. It's also overcomplicated. Now I have two account types and have to worry myself over what the differences are for accessing my money in each and how to use each. They're increasing the amount of friction it takes to get started rather than basing their model off a bank's model of "your account is as secure as it needs to be, just use one".
- veemjeem 12y ago
  I don't really agree here. A bank is safe because your money is FDIC backed even if a robber raided their coffers, BTC doesn't have that level of security yet and given the number of thefts in the last few years, I think security is something that is on everyone's minds when they choose a bank to hold their coins.
  - arasmussen 12y ago
    This is a good point. I guess what I should say is that I'm looking forward to the day when Bitcoin banks are FDIC backed and we can move on from being paranoid about security.
- jerf 12y ago
  I am at a loss as to why you think this is the thing they built.
- flexo0r 12y ago
  I don't see how this is complicated or confusing and I completely disagree with you. I think this is absolutely the right direction to be going if coinbase (and bitcoin) want to become mainstream. An exchange is mainly for traders and most people like myself don't want to look at candlestick charts to know when to purchase or make a bid without any certainty of obtaining coins or worse compete with bots. On the other hand many people I know have kept away from bitcoin because of how seemingly complicated and confusing it is to supposedly keep secure -don't keep coins on exchange, use paper wallet, encrypt backups of private keys. This is definitely a step in the right direction towards attracting a more mainstream audience. As for a 'Pay with Bitcoin' button, are you kidding, how do you think overstock, newegg etc accept bitcoin payments - this is one of the first things they did.
vijayboyapati 12y ago
Multi-sig is a very powerful innovation for corporate use of bitcoin. Not because you can have arbitrarily many M of N signing a transaction, but that you can outsource complex policy in a trusted way. E.g., create policy that lower level employees can control a small percentage of a company's holdings, while higher level employees can control a higher percent. It allows you to implement flexibility that exists in the credit system, without giving up the trust/control that comes from the blockchain system.

183 points by mihar 12y ago

spacefight 12y ago

In other news - "use vault, the regular wallet is insecure".

kolev 12y ago
Yes, there shouldn't be degrees in security - a system is either secure or not.
- josephlord 12y ago
  Well then nothing is secure. At least as far as a whole system goes including the soft squishy components designing, developing and operating it. Even for cryptography the only absolute proven secure method is the one time pad which has very real practical flaws and risks if you try to operate it in the real world.
- wmf 12y ago
  The threat model here is people leaking their own Coinbase passwords (via phishing, compromised PC, etc.), so the 48-hour delay and out-of-band verification ought to actually help.
  - kolev 12y ago
    So, 72-hour delay is even more secure?
    - AndrewGaspar 12y ago
      Yep, and if you dump all your coins into an account with no private key, nobody can get your bitcoins ever, so that's really what everybody should do.
      - kolev 12y ago
        All sarcasm aside, Bitcoin is becoming more and more centralized everyday.
- mhluongo 12y ago
  Of course that's not true. Convenience / security trade-offs are common, and lie on a spectrum.
  - spacefight 12y ago
    Hardly a valid point if it's money related, but that's just me then, as the downvotes imply.
    - weavejester 12y ago
      Even if it's money related. Carrying physical cash around with you is convenient, but not as secure as storing it in a bank.

xfour 12y ago

Is anyone else picturing the digital equivalent of this Al Pacino snl video? http://kristenwiigdaily.tumblr.com/post/27009841161/mygiftismysongand-snl-al-pacino-checks-his http://kristenwiigdaily.tumblr.com/post/27009841161/mygiftis...

PabloOsinaga 12y ago

I wonder how well Xapo is doing - because this seems like a copycat.

buttsex 12y ago
Same with BitGo.
kanzure 12y ago
> I wonder how well Xapo is doing - because this seems like a copycat. And there's going to be even more copycats than there already are. Making APIs on top of Bitcoin's API is going to get way, way more competitive because that's basically the first idea that every player entering the market has. It's extremely low capital to spin up a new API, so everyone and their mom's dog have been doing it. Transaction fees will be driven down by the copycats, and many of them will probably cut their transaction fees to zero for a long time (ahem, Coinbase).

white_eskimo 12y ago

Why is multi-sig in quotes? Is Coinbase providing its users with a '3' address that is on-block chain, or does this "multi-sig" approach still reside entirely off-block chain. Edit: I presume that Coinbase still holds on to all of the private keys for Vault accounts. Can someone verify otherwise?

michaelt 12y ago
Some people use quotes to imply "this is not my term" - this is sometimes used for jargon and words you won't find in a dictionary. For example: The economist said I should consider my "BATNA" or GPS receivers measure "pseudoranges". Just as using jargon can indicate you are part of an group, putting quote marks around jargon indicates you stand apart from that group.

enra 12y ago

Actual launch page and a video about how it works https://coinbase.com/vault https://coinbase.com/vault

sejje 12y ago

I'm assuming the vault doesn't improve security at all in the event that coinbase gets hacked and loses all of their btc?

tlrobinson 12y ago
Multisig might. "To complete the Coinbase Vault offering, we will be adding multi-signature (“multi-Sig”) technology in the coming weeks to enable customers to manage their own vault security." It's not clear exactly how that will work, but if it's, say, 2-of-3 and Coinbase only holds one of the keys then it would.
- ukd1 12y ago
  Multisig would be good, especially if it's actually a address keypair, as it would allow you to verify the balance held exists.
aeharding 12y ago
They're all offline, stored in real safety deposit boxes and bank vaults...
- danielweber 12y ago
  The keys are stored offline, but the BTC are always online. They are relatively safe against someone compromising your computers remotely. Against physical intrusions or insider attacks, not as much.
  - icebraining 12y ago
    Physical intrusions can be dealt with by encrypting the keys, which I hope they are doing. Using a secret sharing scheme with physical tokens (e.g. smartcards) carried by chosen employees should reduce the danger of both of those attacks.
    - TheMakeA 12y ago

kolev 12y ago

How about fixing the web app before adding more features? Their Ajax page loading hangs most of the time. Going straight to the URL works immediately, but it's not always possible.

flexo0r 12y ago
I thought I was the only one experiencing this. My feeling is that the sometimes extreme slowness of their website is not unintentional, kind of like their arbitrary canceling or delaying of transactions and blaming it on false positives in their "high risk detection algorithm".
- kolev 12y ago
  I honestly doubt that. For example, I tried to create a new wallet yesterday. The line indicator bar took its time (over 5 minutes) and never completed. Refreshed the page, it was there. Renamed another wallet - same thing. I'm not sure how this UI that never confirms that some operation completed can be intentional! This always happens to me - at least on Firefox as haven't used Chrome recently. Switching from Buy to Sell, for example, is the same. Any navigation, which is using history.pushState(), obviously, takes minutes, and almost never completes. I just know the routes by heart and key them in (no kidding), or click to get the route updated and then refresh. Honestly, I can't wait for Circle to grant me access... or Buttercoin or whatever alternative as we need redundancy. expresscoin seems nice, but its fees are much higher.
mhluongo 12y ago
This. And the API.
- coinbase-craig 12y ago
  Hi, Craig here from Coinbase. What changes would you like to see to the API?
  - chris-martin 12y ago

state 12y ago

Is this where Tim is going to store his coins?

wmf 12y ago
Obviously not if he bought them to provide liquidity for competitor Vaurum.

peteretep 12y ago

If it's not insured, what's the point?

josu 12y ago
From a customer's perspective a false sense of security. From Coinbase's point of view, it decreases their need for liquidity and their chances of a run.
mhluongo 12y ago
If this is their jumping-off point for multi-sig I'd be interested.

woah 12y ago

What's up with the cold storage? That is absolutely no security, it is purely an operational detail on Coinbase's side. You are still trusting them with all your coins. Once they get multi-sig, that might actually be something interesting. For all we know, the "Vault" might just be a new menu item and some css.

arasmussen 12y ago

I disagree with the direction Coinbase is going. Of all the things they could have built next, this is what they chose? Why not develop a button that says "Pay with Bitcoin by Coinbase" that allows one-click payments on third party websites/mobile apps? Or why not compete with Bitstamp and btc-e on the exchange front? There's definitely tons of room for competition there. Consider a traditional USD/EUR bank account. If your bank offers you a "vault" option to store your large balance to offer better reassurance that it won't get stolen from your "regular account"/wallet, aren't you going to have some serious concerns about security of the regular account? Instead of offering a "more secure account" why don't think just work on the fact that people feel that their regular accounts are insecure. This seems like a bandaid on the problem rather than the proper fix. It's also overcomplicated. Now I have two account types and have to worry myself over what the differences are for accessing my money in each and how to use each. They're increasing the amount of friction it takes to get started rather than basing their model off a bank's model of "your account is as secure as it needs to be, just use one".

veemjeem 12y ago
I don't really agree here. A bank is safe because your money is FDIC backed even if a robber raided their coffers, BTC doesn't have that level of security yet and given the number of thefts in the last few years, I think security is something that is on everyone's minds when they choose a bank to hold their coins.
- arasmussen 12y ago
  This is a good point. I guess what I should say is that I'm looking forward to the day when Bitcoin banks are FDIC backed and we can move on from being paranoid about security.
jerf 12y ago
I am at a loss as to why you think this is the thing they built.
flexo0r 12y ago
I don't see how this is complicated or confusing and I completely disagree with you. I think this is absolutely the right direction to be going if coinbase (and bitcoin) want to become mainstream. An exchange is mainly for traders and most people like myself don't want to look at candlestick charts to know when to purchase or make a bid without any certainty of obtaining coins or worse compete with bots. On the other hand many people I know have kept away from bitcoin because of how seemingly complicated and confusing it is to supposedly keep secure -don't keep coins on exchange, use paper wallet, encrypt backups of private keys. This is definitely a step in the right direction towards attracting a more mainstream audience. As for a 'Pay with Bitcoin' button, are you kidding, how do you think overstock, newegg etc accept bitcoin payments - this is one of the first things they did.

vijayboyapati 12y ago

Multi-sig is a very powerful innovation for corporate use of bitcoin. Not because you can have arbitrarily many M of N signing a transaction, but that you can outsource complex policy in a trusted way. E.g., create policy that lower level employees can control a small percentage of a company's holdings, while higher level employees can control a higher percent. It allows you to implement flexibility that exists in the credit system, without giving up the trust/control that comes from the blockchain system.