How can an online wallet be more secure than paper wallets or cold storages?

Question

Recently, after I was reading that some bitcoin early adopter lost 750 BTC due to theft from his macbook, I was looking for the most secure storage solution for my coins.

I already know about paper wallets and cold storage solutions but I somehow came across reading about multisignature online wallets being more secure than the traditional systems.

I came across BitGo.com and they claim to be more secure than paper/cold storage but as easy to use like an online/mobile wallet:

Is this really possible? I was doing some research myself and learned they are using multisignature wallets with three private keys:

1. One encrypted private key holds BitGo with a passphrase only known by them.
2. Another encrypted private key holds BitGo with a passphrase chosen by me.
3. One encrypted backup key which only I hold with my own passphrase.

Now there are several use cases, I tried to deposit and withdraw some small amounts, and it's really easy. It seems they use their key on server side an my key on client side to sign the transaction. All I have to do is entering my passphrase to unlock the key.

In addition, if BitGo ever ceases to exist I can still use my own two keys to access the coins without using the service offered by BitGo.

But, to be honest, this sounds to good to be true. Now I'm wondering:

1. Is there a way BitGo (or an attacker who compromises BitGo) can access my funds because they hold two keys? Or is this really trustless because all depends on my passphrase?
2. Isn't entering my key's passphrase at their website a weak point which could be abused by attackers (or even the service)? Or is my password really only processed client-side?
3. Is such a solution really more secure than cold storages?

Answer 1

I tested it by creating a secure wallet on BitGo.

They gave a multisig address for deposits. 2/3 of keys are needed to withdraw Bitcoins. BitGo holds one key, you get private key and backup key. You don't need to printed private key to withdraw Bitcoins. the passphrase is enough (apparently the key is derived form the passphrase).

BitGo cannot do Bitcoin transactions without user consent, because they (claim to) lack the other halves of the key. This protects againt some attacks. E.g. the site doesn't have a hot wallet which could be emptied if there is a breach on the server. BitGo forces SMS two-factor authentication to be activated upon sign up. This is good too, protecting against lose of credentials due to stealing or phishing.

If the BitGo infrastructure gets compromised all created wallets after the compromise are compromised too, as the attack can capture keys upon creation. So ultimately you are placing trust on BitGo. They could also blatantly lie you and hold all copies of the created keys, as they are creating the keys, not you. Even if the key creation happens in a web browser using JavaScript you are trusting the code they give you to run.

BitGo is still an online site. If you store your passphrase in a password manager or web browser and your computer gets infected you can lose your Bitcoins, even without interaction from you. BitGo is also subject to malware attacks which modify the withdraw requests in-fly. However "the mad general problem" cannot be solved if you are not doing any checks outside the online world e.g. manual phone calls and confirming by voice. You always need to trust the device you are using to do the withdraws.

BitGo has a nice process and good instructions how to create a multisig wallet and they are also holding a third key themselves, which you can access through password and SMS confirmation. You could create a similar set up yourself, even in safer manner, but BitGo may save you from some hassle. BitGo is also safer than any Bitcoin wallet service where you hold no private keys at all.

The conclusion: lots of marketing promises, ultimately an online site, but may be safer than your average Bitcoin wallet service. You need to trust BitGo. Not safer than your own cold wallet / multisig solution if you know what you are doing.

Answer 2

Security of BitGo is similar to that of hosted wallets. While they don't normally have access to both of your keys, they can always serve Javascript which will send your password to their server. On the other hand, if there is malware on your computer, even if it can't get your backup key, it can still make transactions on your behalf (if 2FA is required for every transaction, malware can just replace the destination address when you make a real transaction). So BitGo is definitely not as secure as an offline wallet, and you can have your bitcoins stolen via server compromise.

Answer 3

You're right that multi-signature is more secure than trusting your BTC to anyone with access to the private keys (or n of m majority). If you don't control the private keys you don't control your money.

Now, Bitgo is offering a solution, which as you describe it, is problematic in that trust of Bitgo is required. All Bitgo is doing is simplifying the complexities of multisig storage/transactions. Wallet providers like GreenAddress.it employ the n-timelock variable which makes the multisig txn in question (ie the hash) invalid until a certain number (n) of ~10min blocks elapses (Bitgo may or may not employ n-timelock); this essentially makes it possible to retrieve your BTC after n blocks have elapsed.

As for security of your BTC, there's several options which each have their merits

1. Hardware wallets (eg Trezor)
2. Armory "Lock Boxes" (generally assumed to be the best for multisig txns)
3. Paper wallets on an air-gapped machine (ie offline)
4. HD (Hierarchical Deterministic) wallets such as Armory, Electrum