Recently, after I was reading that some bitcoin early adopter lost 750 BTC due to theft from his macbook, I was looking for the most secure storage solution for my coins.
I already know about paper wallets and cold storage solutions but I somehow came across reading about multisignature online wallets being more secure than the traditional systems.
I came across BitGo.com and they claim to be more secure than paper/cold storage but as easy to use like an online/mobile wallet:
Is this really possible? I was doing some research myself and learned they are using multisignature wallets with three private keys:
- One encrypted private key holds BitGo with a passphrase only known by them.
- Another encrypted private key holds BitGo with a passphrase chosen by me.
- One encrypted backup key which only I hold with my own passphrase.
Now there are several use cases, I tried to deposit and withdraw some small amounts, and it's really easy. It seems they use their key on server side an my key on client side to sign the transaction. All I have to do is entering my passphrase to unlock the key.
In addition, if BitGo ever ceases to exist I can still use my own two keys to access the coins without using the service offered by BitGo.
But, to be honest, this sounds to good to be true. Now I'm wondering:
- Is there a way BitGo (or an attacker who compromises BitGo) can access my funds because they hold two keys? Or is this really trustless because all depends on my passphrase?
- Isn't entering my key's passphrase at their website a weak point which could be abused by attackers (or even the service)? Or is my password really only processed client-side?
- Is such a solution really more secure than cold storages?