Blockstream Green Wallet Security

Question

I am trying to understand how secure the green wallet is. I thought of a few scenarios where my funds might be in danger:

1. If GreenAddress service becomes unavailable, they have a nlocktime transaction that allows me to recover the funds after 90 days. My funds should be accessible after 90 days.

2. If GreenAddress service gets hacked and it automatically cosigns malicious transactions. My understanding is that I should be able to use the recovery tool (https://github.com/greenaddress/garecovery) to send the coins to a new wallet independent of GreenAddress. Is this right?

3. I lose access to both my phone and seed phrase.

Are there other possible scenarios that would result in a loss of my funds due to an error on the Green Address side? How secure really is the green wallet? How much funds should one trust it with? Thanks!!

Answer 1

Part of the design is that compromise of their service is a little bit pointless. They can not sign transactions spending your money to begin with, as the transactions also need a signature from your wallet too.

There’s no scenario in which the service can spend your money without your participation to some degree. In unlikely scenario the service attempts to force you to sign a transaction, you wait for the timeout and spend your money using the backup tool you linked to.

As with any wallet, if you lose both the seed phrase and the wallet on your phone your money is lost, those are the things which identify your money. To avoid this as a problem, don’t allow that to happen.