3

BitGo advertises, that each online wallet you create is a multi-sig. That is cool, since I see it as more unlikely to someone guess 2 of the private keys.

What I don't understand is how this multi-sig works, when I just go online by signing in with my email and starting a transaction. Where is the multi-sig part? It is just BitGo signing the transaction, but when am I using my PrivKey?

I hope the question makes sense. Thanks in advance

Improve this question

1 Answer 1

Reset to default
3

The multisig is all handled in the backend without you having to handle private keys directly.

BitGo stores your private keys too, presumably in an encrypted form which is protected by your password so they can't access the private keys. When you login, your wallet is loaded in your browser locally and it contains one set of your private keys. When you make a transaction, it is made in your browser and signed in your browser using the private keys that were loaded. This transaction is then sent off to BitGo who also signs the transaction, presumably after you use 2FA to authenticate the send. Then it is broadcast to the network.

The third set of private keys are ones that only you have. You should have downloaded those (along with the set that BitGo has in your encrypted wallet) when you created your wallet. That set of keys also lets you create transactions without BitGo being involved.

Improve this answer
4
  • Great, thanks! I think this nearly answers my question. Would you say this is a typical construction for hot-wallets? - That the private key is encrypted with my password and then locally loaded into my browser? Also, this "locally loaded into my browser". Does this mean that if my computer is infected, someone can steal the private key? Or what kind of dangers are involved in this? Thanks in advance!
    – igotBAWS
    Commented Jan 30, 2018 at 2:22
  • It is typical for web wallets to locally load the wallet in your browser and they just store it encrypted on the server. However this is not a guarantee and you should still be wary of web wallets. Note that exchange wallets are not the same as web wallets. Because the private keys are loaded into your browser's memory, anything that can read that memory could steal your private keys. This may include other web pages with malicious Javascript as well as any malware on your machine.
    – Ava Chow ♦
    Commented Jan 30, 2018 at 2:34
  • 1
    I understand. So is it true if I say that the value proposition of BitGo is, that even if something spoofs my private key (from my browser), they will only be able to steal my coins if they also spoof my login? But I guess, if they manage to read my private key, they will be also able to read my email + password? If this is truly the case, what is the value proposition of BitGo's multi-sig beyond the fact that there is less of a chance of someone "guessing" both of my private keys?
    – igotBAWS
    Commented Jan 30, 2018 at 2:43
  • The multisig is supposed to provide a form of 2FA where you will need something else (e.g. Google authenticator code) in order to actually spend the coins (i.e. for BitGo to sign the transaction).
    – Ava Chow ♦
    Commented Jan 30, 2018 at 3:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.