How can one use multi signature transactions/addresses to improve the security of their services?

Question

Multi signature transactions and addresses are heralded to be a good way to improve security of various Bitcoin services. However, how should one go about using them in order to achieve that goal? For example, how would an owner of an exchange, a shop, or a private user would be able to gain the most out of using multi signature transactions and/or addresses?

Answer 1

Well, the theory is that you have a buyer, a seller, and an escrow holder. This is for transactions like Bitmit or OTC or Silk Road where the buyer and the seller do not trust one another enough to reliably complete the transaction. If you run the website and offer the goods, then you'd either need to just build a good enough rep that you don't need to offer escrow, or find a third party escrow provider to keep you honest. Once M-of-N gains traction in the client software, I could foresee business sprouting up just to handle Escrow.

So buyer pays Escrow his fee first, then buyer, seller, and escrow build a 2-of-3 multisig address and buyer dumps his funds in. Goods are transacted, and if buyer and seller are both happy then they sign a transaction together releasing the multisig funds to seller. Escrow agent doesn't need to lift a finger when there's no dispute. When there is a dispute, buyer and seller each craft and sign the transaction they think should happen (normally "I get all the dough", but more complicated spends are possible too) and submit those to Escrow agent along with their evidence as to how the transaction happened. Escrow judges between them and signs the transaction he thinks should succeed. 2/3 signatures makes the transaction valid.

As to "how will the client software actually work" and "what will the GUI look like", that's a fine question! It appears as though crafting the GUI is the final major obstacle towards this becoming a more widespread transaction type. :3

I've been posting on /r/bitcoin and chatting with Ferroh and others, trying to work out just how to do it the hard way at the command line. :P