Does BIP44 key derivation path protects private keys derived within same account?

Question

I understand that with

• Un-hardened parent extended public key
• child private key

This will leads to compromise of parent private key and so all the private keys of siblings

BIP44 suggests the path m / purpose' / coin_type' / account' / change / address_index

Let's say I use the path m/44'/0'/0'/0 to derive public keys for account 0

Since The change and address_index is not hardened. And in my application I will have the extended public key at level m/44'/0'/0'/0 revealed (to derive addresses), does it means that if any of the private keys derived at the address_index level is compromised, all the private keys within the same account may also be compromised?

So with this path only avoid further compromise up to

• Other accounts and
• Further up to the master key?

Am I correct?

Answer 1

Bip44 doesn't protect anything, if the user has master root key, they could get access to all the other accounts private keys.

Your path is wrong, it should be like that:

m / purpose' / coin_type' / account' / change / address_index

What you should do is generating child master private key for the following path:

m/44'/0'/1'/

Now the user has access only to account number "1" and should generate addresses using that child master private key and the following path:

m/changeAddress/addressIndex