1

I was wondering if and how multisignature wallets protect the owners from getting robbed.

So in 2 of 3 multisignature scheme, if one of the owners' machines has been compromised (i.e. bad actor possesses the private key and can initiate a transaction without the actual owner knowing about it and the 2nd owner signs the transaction who assumes that transaction request was made by the legitimate owner), does multi-signature wallet protect users from this kind of scenario?

Does it even have a way to protect in this case? Is the assumption that wallet owners will be communicating about the transaction request offline?

7
  • can you explicitly state who owns all three keys in the 2-of-3. AFAIK, owner owns 1, some 2FA party owns 2, who owns 3?
    – rny
    Nov 6, 2017 at 2:22
  • I mean it does not matter which scheme it is. Let's say it's 3-of-3, and say your mother owns the 3rd key. With a transaction signed by you, owner, 2FA party, and let's assume that she just signs the transaction thinking that you initiated it without talking to you. If the hacker who has your private key, made the transaction request, then you'd lose money right?
    – kchoi
    Nov 6, 2017 at 2:31
  • if the other 2 parties are going to blindly sign, then sure, you're going to lose your coins once a hacker steals your key.
    – rny
    Nov 6, 2017 at 2:33
  • what stops them from signing blindly today?
    – kchoi
    Nov 6, 2017 at 2:37
  • it depends on the underlying design of the application which uses the multi-sig transaction. Typically, the arrangement would be that all parties involved in the multisig must communicate and agree to sign the transaction. But clearly, there exist applications out there who do not use multisigs that way.
    – rny
    Nov 6, 2017 at 2:39

1 Answer 1

1

does multi-signature wallet protect users from this kind of scenario?

Not necessarily. Ultimately it is dependent on the design of the application which is using multisig transactions.

Does it even have a way to protect in this case?

Assuming that the other 2 key holders will blindly sign once the primary key owner has sign, no. If the primary key is compromised, the transaction will be signed by either/both other parties.

Is the assumption that wallet owners will be communicating about the transaction request offline?

In principle yes, the assumption is that the application requires signatories to decide to sign the transaction on their own accord. Sharing partially signed transaction should be done in a secure private channel between signatories.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.