pull down to refresh
Thank you for the reply.
I understand the theory of what you say, but when I think about what a practical setup might look like it is still tricky to me:
Hiding 3 multi-sig seeds in 3 locations is a lot of real work. Can you access them all within an hour if an emergency comes up? Are they hidden enough to not be disturbed, but also not so well hidden that they may be accidentally lost?
Do you keep the 3 signing devices in the same place or distributed? If the wallets are together then wrench attack is still a real issue.
Do the multisig seeds share any common faults that could mean a majority become inaccessible? For example, we just had a big earthquake here in Japan the other day. It did not impact me - but it is quite possible that a safe deposit box, your own home, and a family member's home could all simultaneously become inaccessible in an earthquake = no way to get the seeds or devices together.
The hard piece for redundancy is that we want to maximise both distribution (going so far as having seeds in different continents...) but also something that can be quickly accessed if need be. There is an inherent contradiction there.
A single sig seed with passphrase duplicated in two places is more redundant and self-contained to me than than a multi-sig distributed over three places.
In the case of wrench attack, a passphrase does similar work as the multisig - there is at least some additional "thing" required to access the funds.
I am pushing and pursuing this topic as my goal is to find the best way for myself even, really just trying to wrap my head around all of this.
I wonder if we simply don't have the right language to practically describe this kind of security / redundancy stuff properly – It is all "geeky" theory focussing on the signatures and the devices, but fails to account for the way Shit Actually Goes Wrong in the world.
Real life is messy and people forget things, nature lashes out, life is unpredictable etc. IMO the fragility of multisig is not in the initial setup - that is a straight-forward process, but in the active practical maintenance of that setup for years / decades.
P.S. My other recent post tries to explore another mechanism for maintaining failsafe redundancy by using unbroadcast signed transactions – Request for comment: Unbroadcast Bitcoin transactions as failsafe
CE
I actually agree with this, and the mental burden of where to split the different parts of the multisig is probably the main thing that has prevented me from using it so far. For me (and I think many), coming up with more than one safe-but-hidden location over a long term is more difficult than is often acknowledged.
With single-sig + passphrase, you have only one off-site location to worry about for the seed phrase, and then the passphrase can be portable, stored in a password manager or whatever, just for the case that the seed phrase location is uncovered or there turns out to be a vulnerability in the seed's original generation.
With multi-sig, you have three seeds plus a data descriptor. If the three seeds are kept together, then the wallet can be spent from immediately if somebody were to uncover their location, making it less secure than the single-sig + remote passphrase would have been. So if we wanted to retain the same convenience of the single-sig setup, but with the additional security of a multi-sig against a compromised wallet, then could we keep two of the signatures together in the same location, and then the third signature (and descriptor) made effectively as your "passphrase", kept as portable copies in a password manager or encrypted USB? This is assuming that it is absolutely impossible to spend from two signatures without the descriptor, which I believe to be the case but have not yet tested personally.
In that scenario, keeping the mental location burden the same:
- Single-sig 24 words on steel in one location | portable 12-word passphrase (could also be offline, e.g. on encrypted USB)
- Multi-sig two signatures 12 words + 12 words on steel in one location | portable 12-word third signature + descriptor (could also be offline, e.g. on encrypted USB/Tails)
There the number of words and data to keep track of is essentially the same, but are we any more secure in the multisig setup to make it worth storing an opaque descriptor too? Unless we want to introduce additional complexity of multiple seed locations, then a strong passphrase may be enough to negate the need for all the extra gymnastics. With a 12-word passphrase typed into a PC on Tails+Electrum rather than a weak passphrase fumbled into a hardware wallet, you basically have the security of a second required signature regardless.
Or am I missing something new?
It absolutely gives you real redundancy to misplacing a seed and losing a device. General screwups, no. Medical emergency, no. Wrench attack yes if you have to go to multiple public places to get signatures. It can also help with natural disasters over single seed if your signers are geographically distributed.
I don't think the logistics are that hard. Why keep them together? The point is redundancy. It's not hard to keep track of 3 places. I don't understand why people act like rolling dice or remembering three locations are some kind of insurmountable obstacles. Descriptors are held with each device/seed or encrypted online or anywhere else you want to keep them. They can only leak privacy they can't sign anything. Key rotation, pain in the ass that's true. Also not great in an emergency that's true.
It is more complex that's true but it's much easier than it was in the past. Just following along with a BTCSessions multisig guide a couple times and you will get the hang of it. I really don't think it's that much to remember.
These are just my thoughts, of course it's up to everyone to decide what setup works best for them!