Overstock’s New Blockchain President Vows to Accelerate ‘Fight Against Wall Street”
Overstock #blockchain #president Jonathan Johnson discusses his strategy for the e-commerce giant in his first interview since assuming the new role.
CoinDesk
Tagged: Blockchain Toggle Comment Threads | Keyboard Shortcuts
-
user
-
user
Hyperledger Tests Open Strategy With First Blockchain Explorer
CoinDesk profiles ongoing developments at business #blockchain consortium #Hyperledger and its collaborative effort to launch an #open-source tool.
CoinDesk -
user
Plane Maker Airbus Joins Hyperledger Blockchain Project
French airplane manufacturer #Airbus has joined the #Hyperledger #Project, the Linux Foundation-led #blockchain initiative begun earlier this year.
CoinDesk -
user
FinTech DACH News Rückblick der Woche 32
Fintech.Li präsentiert hier wöchentlich die wichtigsten #News rund um #Fintech in der Schweiz, Liechtenstein, Deutschland und Österreich.
Fintech #DACH Top News
Überblick und Vergleich von Schweizer Nachdiplom Studiengängen in Digital Finance
Diese Aufstellung hilft Euch bestimmt bei Eurer Entscheidung, solltet Ihr eine solche Ausbildung in naher Zukunft in Erwägung ziehen. Mehr erfahren
Swisscom setzt bei Fintech auf Kollaborationen
Was Jungunternehmen mitbringen müssen und welche Arten der Kooperationen möglich sind, erklärt der Leiter des Clusters Johannes Hoehener. Mehr erfahren
FinTech: Die wichtigsten deutschen Finanz-Start-ups
deutsche-startups.de präsentiert deswegen die wichtigsten deutschen FinTech-Start-ups – unter anderem basierend auf dem eingesammelten Risikokapital, die Beteiligten Investoren und der generellen Marktbedeutung des Start-ups. Mehr erfahren
FinTecSystems – Millionen für digitale Bankauskunft
FinTecSystems hilft Banken bei der Vergabe von Krediten und hat einen Millionenbetrag eingesammelt. Das Geld kommt unter anderem von einem französischen VC. Mehr erfahren
Avaloq kooperiert mit Zürcher Fintech-Firma
Die Bankensoftware-Schmiede Avaloq erweitert ihr Angebot mit drei Dienstleistungen. Dazu zapft sie die Expertise eines Datenspezialisten an.. Mehr erfahrenErst Lizenz und dann Bauernfängerei: N26 wird zur vollwertigen Bank
Das Banking-Startup N26 verspricht ein faires und transparentes Anlageprodukt. In Wahrheit aber lohnen sich die Konditionen vor allem für Kleinsparer nicht. Verbraucherzentralen warnen. Mehr erfahren
Insurtech: Startup erhält Anschluss zur SBB
Bei einer Schweizer Jungfirma im Versicherungsbereich steigt ein gewichtiger Kunde ein – die Bundesbahnen. Mehr erfahren
Der dreifache Wahnsinn von „Girocard kontaktlos“, „girogo“ und „Geldkarte“Wieso die Geldkarte und Girogo an Wahnsinn grenzen, das neue Bezahl-Verfahren „Girocard kontaktlos“ sich beim Konsumenten durchsetzt – und die Sparkassen dabei leer ausgehen werden – erklärt t3n Redakteur Jochen G. Fuchs in seiner „E-Fuchs-Kolumne“. Mehr erfahren
PayPal in Deutschland: Dr. Frank Keller wird neuer Geschäftsführer – Arnulf Keese wird Partner eines VC
Corporates und international agierende Finanzinstitute können die Innovationskraft von Start-ups und Fintechs nicht länger ungenutzt vorbeiziehen lassen. Start-up-Expertin Marie-Hélenè Ametsreiter und Erste Group-Vorstand Peter Bosek kennen die Bedürfnisse beider Seiten genau. Mehr erfahren
N26 Valentin Stalf im Interview: Die neue Strategie der Digitalbank – Geschäftskonten ab 2017
Im News-Dauerfeuer stellt sich Valentin Stalf, CEO der neugebackenen Bank, unseren Fragen rund um Altlasten und neue Pläne der N26. Mehr erfahren
Sofortkredit per API: AutoScout24 nutzt neuen Baustein der SolarisBank
Habe die SolarisBank nun das Portal AutoScout24 angeschlossen, um darüber per API Sofortkredite anzubieten. So könnten Autokäufer binnen weniger Minuten eine Finanzierung für den Gebrauchtwagenkauf erhalten. Mehr erfahren
Social Media-Analyse zur FinTech-Branche
Der Aufstieg der Sozialen Medien in der zunehmenden Digitalisierung und die Finanzkrise führten zu einem Aufschwung der FinTech-Branche. Wir warfen mit Brandwatch Analytics einen Blick auf die Online-Gespräche zu diesem Thema.. Mehr erfahren
Betastart für Herbst geplant: Penta will den “Legacy-#Banks” die KMUs abnehmen
Stealth-Mode nennt sich das. Jetzt aber bricht Co-Founder Luka Ivicev beim IT Finanzmagazin das Schweigen – und erläutert im Interview die Strategie des im Februar in Berlin gegründeten FinTechs. Mehr erfahren#BITCOIN / #BLOCKCHAIN News
How the Tech Behind Bitcoin Could Revolutionize Wall Street
Many believe the underlying #technology that powers bitcoin transactions, a system known as blockchain, has the potential to upend how Wall Street does business. Mehr erfahren
Blockchain – ohne den sozialen Konsens geht’s nicht
Dabei zeigen u.a. die zermürbende Blocksize-Debatte und aktuell die Ethereum-Fork, dass es beim Thema „Blockchain“ eben nicht nur um Technik geht, sondern auch um die Menschen, die sie verantworten und für die sie gemacht ist. Mehr erfahren
Banking wird in zehn Jahren komplett anders aussehen
“Die Blockchain wird das Internet verändern und dafür sorgen, dass sich Geschäftsmodelle und -prozesse grundlegend verändern werden. Sie hat tatsächlich etwas Revolutionäres, denn sie kann Zahlungsverkehr, Kredite oder den Wertpapierhandel schneller und günstiger machen und vor allem auch Finanzinstitute abschaffen.” Mehr erfahren
ÜBERSICHTEN / INFOGRAFIKEN / STUDIEN
Top 30 FinTech Startups in Germany
FntechNews has put together list of FinTech Startups in Germany. This channels are top profiles in the fintech hub that frequently update for the FinTech community. Mehr erfahren
Bain-Studie: Mobile-Banking verdrängt Online-Banking
Mobile-Banking entwickelt sich weltweit zum entscheidenden Kanal für Bankgeschäfte und trägt wesentlich zu einer hohen Kundenloyalität bei. Mehr erfahren
zeb-Studie: Versicherer überlassen Innovationen den InsurTechs – und warten ab
Die deutschen Versicherungsunternehmen fokussieren sich zu stark auf interne Themen wie Infrastrukturen und Prozesse und zeigen sich zögerlich, wenn es darum geht, Innovationen zu entwickeln. Sie drohen dadurch zunehmend den Anschluss an neue InsurTech-Trends zu verpassen. Mehr erfahrenFintech EVENT Hinweis
Zum Abschluss noch Informationen in eigener Sache von Fintech.LI.
Ticketpreise: von CHF 149,99 für Startups und CHF 249,99 für alle weiteren Kategorien.
Fintechnews Leser erhalten einen exclusiven Discount von 20% mit dem Code &8220;fintechnews20&8221;.
The post FinTech DACH News Rückblick der Woche 32 appeared first on Fintech Schweiz Digital Finance News – FintechNewsCH.
-
user
Blockchain World Expo Postponed Until 2017
A scheduling conflict has resulted in the postponement of the #Blockchain #World #Expo.
CoinDesk -
user
Blockstream Adds to All-Star Blockchain Developer Team
#Bitcoin startup #Blockstream has announced a slew of new hires that serve to further boost the firm’s already impressive development #team.
CoinDesk -
user
Top 5 London Fintech Events To Attend This Fall
Nearly two months after the Brexit vote, #London now has a new prime minister, a new government and a new outlook. The capital, the British economy, the rise of UK’s #fintech industry, and by extension all other aspects of financial services in Europe have been undergoing and adapting to these new tremendous changes.
Many people are wondering if London will lose its title “the fintech capital of Europe”. For now, London’s fintech scene seems to remain strong and promising. Many fintech #events are set to take place in London for the rest of 2016. With these fintech events in London, the capital still keeps its position as a strong fintech hub in the region.
Take a look at the outstanding fintech events in London #this #fall below:
ROBO ADVISOR CONGRESS
Special Offer: 10% Off with code &8220;FTN10&8220;. Register NOW
This One Day deep dive congress in London will bring together traditional Financial Services firms and the hottest emerging FinTechs from across the globe to plot the future of #Robo Advice and wealth management. Featuring discussions on target demographics, technological advances and platform differentiation, along with the opportunity to learn from translational case studies; the congress will highlight the opportunities Robo Advisors can present while addressing the challenges surrounding its optimisation and practical implementation. For more information, visit http://www.roboadvisorcongress.com
Blockchain for Finance Conference LondonBlockchain
The focus on global expansion and foreign investment makes Global Expansion Summit the ideal event platform for much needed discussion on the impact of Brexit on inward investment into the UK and FDI around the world. The event is extremely well timed and the audience and conference content particularly pertinent.
In recognition of this, we are re-branding the show to Brexit & Global Expansion Summit. Our focus on ICT, BPO & Financial Services as well as the underlying theme of global expansion and digital transformation are still the essence of our event. However, we will be adding some Brexit focused content to the conference.
LendIt Europe 2016 with the P2PFA
Special Offer: 15% Off with code &8220;FNS16VIP&8220;. Register NOW
Where platforms and investors come to learn, network and do business. The 3rd annual LendIt Europe conference and expo will take place at the InterContinental London – O2. This year’s event will bring together more than 1,000 industry leaders and include the region&8217;s largest online lending expo with more than 2,500 square metres of exhibition space.
European RegTech Congress
Special Offer: 10% Off with code &8220;FTN10&8220;. Register NOW
The European RegTech Congress will provide a platform for the discussions really needed to move the space forward. With a dedicated track to exploring the realities of Regtech adoption, how to harmonise wide ranging platforms and the standards the #technology needs to meet. Our practical ‘RegTech in Action’ track featuring dedicated seminars on topics such as the impact the move to Mifid II will have and how RegTech can manage Post-Brexit uncertainty. For more information, visit http://www.regtechevent.com
Brexit & Global Expansion Summit
Special Offer: 15% Off with code &8220;FNS16VIP&8220;. Register NOW
The focus on global expansion and foreign investment makes Global Expansion Summit the ideal event platform for much needed discussion on the impact of Brexit on inward investment into the UK and FDI around the world. The event is extremely well timed and the audience and conference content particularly pertinent.
In recognition of this, we are re-branding the show to Brexit & Global Expansion Summit. Our focus on ICT, BPO & Financial Services as well as the underlying theme of global expansion and digital transformation are still the essence of our event. However, we will be adding some Brexit focused content to the conference.
The post Top 5 London Fintech Events To Attend This Fall appeared first on Fintech Schweiz Digital Finance News – FintechNewsCH.
-
user
The Inevitable Disruption: Issuing Stock on the Blockchain
Innovation has a history of paving the way for regulation in the long term. In the shorter term there is a common theme of regulators pushing back in opposition of innovation. This is not due to them wanting to prevent innovation (for the most part) but as a way to slow down trends so they have the proper time to be tested and prove they function as planned.
A prime example of this occurring presently is the issuance of securities on the #Blockchain. In the majority of circumstances this would be in violation of several security laws. However, it is one of the most disruptive use cases of Blockchain #technology that has a high probability of being achieved within the next decade and is applicable to both private and public company stock. While some innovators are afraid to enter this realm due to lack of clear regulation, many are not slowing their aggressive pace. The Nasdaq has already began experimenting with this concept through a $20+ million combined investment in Linq along with countless start-ups working towards a similar common goal.
If the current world markets are slowly transformed into running on Blockchain networks it changes the landscape to be less focused on monetizing through the intermediaries. It is estimated that current back-office inefficiencies cost financial service companies a minimum of $20 billion per year so there is definitely a financial incentive for the implementation of a more efficient technology core such as Blockchain. It would enable true peer to peer trading in a fast and secured environment thus eliminating the need for brokers, except in rare situations. It also enables the instant verification of ownership and transfer making settlements t+0 and post-trade data available much quicker. Once a company migrates or issues shares on a Blockchain network it also makes the implementation of smart contract technology a possibility which has the potential to increase efficiencies through the automated posting of margin (capital) requirements in real-time and automatic distribution of dividends and other mandatory market events. Not to mention shareholder voting can easily be completed on a Blockchain network and trigger the automatic execution of a smart contract. While all of this seems great and many want to see it happen tomorrow, something this disruptive is not going to happen overnight, it will slowly be phased in over years.
While this implementation has process efficiency benefits for publicly issued stock, it completely changes the financial environment of start-up and private companies which as a whole typically have illiquid shares. For those unaware of how start-ups typically work from a financial point of view, they issue shares to the founders when registering the company, then issue more shares for each investment round (take convertible notes out of the picture here for simplicity), and are often restricted to only accepting funds from accredited investors (individuals worth over $1 million or exceed annual salary requirements). These shares are rarely every liquid and often restricted which means that investors cannot sell shares to someone else like they can with shares of a public company. The investors do not normally receive any real return until a cash event occurs such as an acquisition, merger, or IPO. Another aspect to take into account is that many start-ups structure their employee compensation to be a mixture of stock and salary.
The conversion of private company stock to a Blockchain network is truly game changing to the entire process. Start-ups would be able to issue shares to public investors (similar to an IPO) from the time of registration (new crowdfunding legislation is already shaping the path for this), these shares would be more easily transferrable thus creating liquidity in the market, and employees receiving compensation in a mixture of equity and salary would have the option to sell their shares prior to a standard cash event occurring. There are several critical factors that would need to be addressed prior to this implementation being feasible such as: How would stock options work? What would happen to shares in the event of an acquisition? What auditing regulations need to be put into place? Can shares be revoked, etc.?
So what is the downside to the conversion of stock to a Blockchain network? Much of this technology is still largely untested in production environments so that will take time to ensure security and functionality. Another major barrier is performance. Current trading networks handle millions upon millions of transactions a day and need to be executed in milliseconds so latency is a concern. Put aside the smaller concerns such as proper user/key management, and the final barrier is regulation that must be put into effect to even make this a possibility, but as stated previously, regulatory changes will happen with enough support of a Blockchain transformation, it is just a matter of time.
[linkedinbadge URL=”https://www.linkedin.com/in/ian-m-worrall-1b599a59″ connections=”off” mode=”icon” liname=”Ian M. Worrall“] is Chief Executive Officer at Encrypted Labs | Blockchain Technology
-
user
Is Blockchain Adoption Gaining Momentum in the Enterprise?
This article covers #blockchain, a distributed ledger #technology, its perception and the ambivalent (for now) adoption by corporate enterprises. Co-authored Converge VP investors Maia Heymann and Ash Egan.
Most Fortune 500 companies are having extensive conversations, in CIO suites or in innovation labs, on whether the blockchain technology is right for them, and their peers – discussions on how their primary business lines might be affected by the technology, current solutions, and the areas (or consortia) to invest in. Distributed ledger standardization is far from reality, and although there are promising developments in #Bitcoin adoption and corporate blockchain experimentation, it’s still not clear when (or how) enterprises will ramp-up pilots and accelerate commercial-grade adoption. Some sectors like financial services are far ahead in exploration and testing, but general skepticism and even a misunderstanding are slowing blockchain’s future as a widely-adopted disruptive technology.
After attending Consensus 2016 in NYC, and a few blockchain enthusiast dinners at MIT, it’s clear that established corporate players are exploring and investing in both forms of blockchain: permissioned and public. The Consensus conference, hosted by Coindesk was packed with #fintech executives as well as Bitcoin and blockchain vendors and voyeurs—our term for IT buyers looking and not buying. Theories and opinions regarding the direction of blockchain technology are as varied as the attendees.
A corporate IT buyer’s reticence regarding blockchain is understandable. First, it’s challenging to explain the blockchain to senior management; it is a technology that no one owns, no single party is accountable for, and it’s based everywhere and nowhere. Second, Bitcoin’s rocky road is perceived as a cautionary prelude to what could go wrong with a distributed governing body. A recent New York Times article publicized that over 70% of the transactions on the Bitcoin network were going through just four Chinese companies (data assembled by Chainalysis [1]). In short, there is apprehension around limited to zero control, or too much control in the wrong hands, for a corporate IT buyer to join an open, permission-less system.
Despite doubts around practicality, security and utility within blockchain’s open, permissionless system, start-ups, new consortia, and corporate players are advancing the technology through ‘closed’ experiments to test blockchain’s potential applicability. These early tests are being supported by venture capitalists globally, and Olga Kharif says $1.1B has been invested to date in startups commercializing blockchain in “Blockchain Goes Beyond Crypto-Currency”.
Corporate business use-cases have the potential to generate improved margins and provide customer/client benefits in transaction-based industries: peer-to-peer payments, identity management, cross-boarder trade, and solutions within commercial payments and finance. One large insurance firm commented: “Broadly, the use-cases of Blockchain in transaction processing are most likely to be implemented early across the industry – the range of solutions that exist today are quite rich, from faster international transfers to more efficient settlements on exchanges, this is the area that appears to be the most promising in the near term.”
Backing-Up, What Is Blockchain? Bitcoin to Blockchain
Blockchain, born out of Satoshi Nakamoto’s 2008 whitepaper “Bitcoin: A Peer-to-Peer Electronic Cash System” is a distributed database, a decentralized and shared public ledger of time-stamped transactions within a network, open for review by anyone within the network. “The Business Blockchain” by William Mougayer uses a three prong approach to defining the blockchain: technical: back-end database that maintains a distributed ledger, openly; business: exchange network for moving value between peers; legal: a transaction validation mechanism, not requiring intermediary assistance (pg 4).
Bitcoin, powered by the blockchain, is a virtual crypto-currency allowing peer-to-peer payments for network members – becoming the first manifestation and widespread adoption of the technology. The crypto-currency began as an open source project, and requires the network to confirm transactions – a key component of its decentralized nature. Currently, Bitcoin is maintained by a small group of developers called theBitcoin core. This group is responsible for pushing updates and progressing the network, while Bitcoin network members (miners) power transactions.
Each participant (or node) puts the transactions into blocks and blocks into a single chain, and stores a complete record (or ‘proof’ system), protecting the integrity and veracity of all transactions in the chain. The system is anonymous, and through its mathematical proofing system eliminates the need for an intermediary or for third-party verification. The network resolves the conflicts so all nodes have the exact same copy of the distributed ledger. The collective effort of Bitcoin’s network made up of computers and servers all over the world, provides the compute power.
While millions of Bitcoin transactions have occurred (surpassing $10B in market value), corporations and financial institutions remain skeptical due to the absence of regulation, the perception of proximity to criminal activity, a slow moving ‘governing’ body from Bitcoin core, and the concentration of power and control of miners (presently with four Chinese companies). These issues among others compound to call into question Bitcoin’s independence and decentralization. The skepticism, however, is evolving into recognition of the underlying technology’s potential, and as Goldman Sachs’ Robert Boroujerdi said, “Bitcoin was just the opening act.”
In line with Boroujerdi’s comments, William Mougayar points to the blockchain technology, as being as innovative as the Internet in ‘The Business Blockchain’: “the blockchain is part of the history of the Internet. It is at the same level as the World Wide Web in terms of importance and arguably might give us back the Internet, in the way it was supposed to be: more decentralized, more open, more secure, more private, more equitable, and more accessible”.
Why The #Enterprise Cares About Blockchain
Disruption. FOMO (fear of missing out).
Applications of blockchain technology include (but are certainly not limited to) stock issuance, provenance, smart contracts, streamlining of loan underwriting, and payment transfers. Many industries will be impacted by both private distributed ledgers and crpytocurrency — agriculture, insurance, financial services, and even entertainment—almost all industries could find use-cases for the adoption of blockchain technology.
As mentioned earlier, financial services companies are far ahead in exploration and testing blockchain technology. What became apparent via multiple conversations at Consensus 2016 is many corporates are exploring blockchain for fear of missing out (FOMO). Enterprises are opportunistically exploring and experimenting with side projects (via pilots), simultaneously suspect of relinquishing control and fearful of losing revenue associated with their intermediary or third-party verification business lines. As upstarts and even competitors adopt the technology and attest to its financial efficacy and cross-departmental value, the lure of not being left behind is strong. We’re seeing corporate buyers framing why and how the blockchain can theoretically and practically serve their companies’ needs. One large institution on the east coast said, “we are pursuing multiple ways to understand and leverage the technology – for instance [our] Ventures team looks at startups that leverage Blockchain and other cutting edge technologies. We are exploring multiple fronts in a coordinated manner.”
The extent to which crypto-currency, public blockchain, and private blockchain applications are accepted and scaled by corporates remains unclear, but the signals are encouraging. A report from Santander anticipates cost savings up to $20B annually by 2022.
Balancing Risk with Potential
It’s no walk in the park to replace current infrastructure (mainframes), with a new system, whether that is blockchain or an alternative. The headache of adopting blockchain technology and connecting to legacy systems is not to be underestimated. Beyond understanding the potential cost savings of using blockchain’s system, buyers need to include the cost of migration in their calculus – evidence of this expense are the consulting firms who have set up entire blockchain practices. The Rubix Team at Deloitte, offers a “one stop blockchain software platform” and is an example of consultants being at-the-ready to contract with their clients to re-architect legacy technology and processes.
For all of blockchain’s benefits, corporations are aware of the risks of Bitcoin and blockchain technology: a limited governing body; powerful and growing Chinese mining presence; executing transactions at scale in a decentralized manner; inherent security risks from new technology; the rise of hackers targeting sensitive data; and growing pain risks like the recent attack on The DAO. Government regulation will provide both challenges and benefits for corporations. As is often the case with new technologies in regulated industries, the regulatory agencies have to catch-up. The United States’ regulatory bodies are learning, and their stance on permission-less distributed ledgers (like Bitcoin) it is not yet clear. For instance, the Office of Foreign Asset Controls (OFAC) and Financial Crimes Enforcement Network (FinCEN) have the right to blacklist companies interacting with cryptocurrencies (Coincenter). Jamie Smith of BitFury commented at Consensus 2016 that engaging with regulators is necessary and even advised because “the regulators can either help you or hurt you” with respect to crypto-currency and blockchain adoption.
Despite the risks, blockchain technology has the potential to radically change countless industries and give rise to new ones. Indeed, this technology is evolving from the obscure framework behind a crypto-currency to the newest technological frontier, and we are excited to continue to watch and see how corporates invest, participate, and innovate the world as we know it.
[linkedinbadge URL=”https://www.linkedin.com/in/maiaheymann” connections=”off” mode=”icon” liname=”Maia Heymann“] is Investor at Converge Venture Partners, an enterprise focused early-stage tech VC with investments in Chainalysis, Podium Data, SmartVid.io, Talla, Wade & Wendy and other emerging technology companies.
[1] Chainalysis is a Converge VP investment.
-
user
Bitcoin Security is More than Multisig
“How did multisig fail? Why did people lose their money? I thought multisig was secure.” Through the Bitfinex hack it’s become apparent that people don’t really understand #bitcoin’s multisig feature. There seems to be a lot of confusion over what multisig is and isn’t, what it inherently does or does not do. This article aims to clarify some of the most common misconceptions, explain how multisig actually works today, why policy controls aren’t a substitute for organizational #security, and what you can do to protect yourself.
Multisig is a tool. Just like any other tool, it can be used to achieve a number of different results. This tool can be used to distribute and dilute risk of key compromise or loss, for redundancy as a backup, and to create joint-accounts where each party can spend from the same pool, or to separate duties within an organization.
Multisig is not a security plan. It can be a powerful component of a well designed security plan, but it is only ever one component. To simply say “multisig” without exploring the implementation, how it’s being used, and what goals are trying to be achieved, is meaningless. It’s not a security incantation, though it would be so much easier if it was.
In order to understand what it can and cannot do, we need to understand a bit about how it works. Don’t worry if you’re not a techie, this isn’t written for them — it’s written for everyone else. 1
Creating a multisig address. In order to create a multisig address, you simply need more than one public key. Let’s look at an example. Alice, Bob, and Charlie are all organizers of a local bitcoin and open #blockchain meetup. They want to collect funds to support the meetup but don’t want any one of them, alone, to control the funds. They set up a multisignature address, using CoPay software, that allows them to select a 2-of-3 configuration, meaning two of the three of them must authorize the transaction before it will be valid. In this instance the possible signing combinations can be A&B, B&C, A&C.
What’s actually happening behind the scenes? Their software is constructing two things: a script that contains the instructions of how many signatures are required and what public keys correspond to private keys that are authorized to sign (m-of-n), and a hash which is the bitcoin address, starting with the number 3, corresponding to the script. The script is often called the “redeem script” because it contains the requirements to redeem or spend payments from the multisig address. 2
You can think of a redeem script as a set of permanent, unchangeable access controls. These limited access controls are embedded into the bitcoin address itself. Meaning when funds are sent to the corresponding address, the redeem script must be satisfied in order to move funds. The rules are set when the address is created and can never be changed. The rules are, literally, part of the address itself. This one of the most powerful parts of multisig, this is why many believe it is more secure than a traditional single-signer bitcoin address. When multisig is used as part of an overall security plan, it can provide additional protection against embezzlement, mistake, loss, fraud, single point of failure, by requiring multiple parties or multiple devices (multi-factor multi-sig) to approve a transaction.
But notice what it does not do.
- There are no spending limits; you can withdraw all funds with one, properly signed, transaction.
- There are no time limits; you can withdraw funds immediately with a properly signed transaction.
- There are no daily transaction limits: you can create thousands of transactions per minute.
- There are no notifications; you will not receive an email or text notification when funds are spent.
Policy controls are not inherently part of multisig today. At this point you may be confused because many wallets provide these types of added services. They’re advertised as additional security measures, as additional controls. What’s not so clear is that these services are implemented by the company’s software and internal policies — not by the bitcoin protocol. That’s important because it means the controls can be bypassed, the limits can be changed. While Bitcoin’s scripting language continues to evolve, and some protocol based policy controls, like lock-time, are available, they haven’t been widely implemented yet.
The take away: today’s policy controls aren’t as secure as they may seem. In fact, they’re only as secure as the system controlling policy changes. Unfortunately, that’s less secure than most people believe.
Sometimes keyholders automate signing, based on policy controls.Many multisignature wallets (but not all) now include automated transaction signing based upon policy controls as a feature of their wallets. In these implementations, the wallet company controls one of the keys used to create a multisignature address. That key, and it’s related signing functions, are controlled by software written by the company — the software is often called an oracle or signing oracle. At the time the address is created, in addition to the public keys, the wallet company collects the user defined policy controls. For example, a user might set a maximum daily limit of $1,000.00 USD withdraw. The address is created and the signing parameters of the signing oracle are set.
The signing process usually looks something like this — the user creates a transaction (say for $500.00 USD), signs it, and sends it to the wallet provider for countersigning. The oracle sees the transaction, checks for policy controls (here the $500 is less than $1000.00), countersigns and broadcasts the transaction to the bitcoin network. Speedy, convenient, efficient. Secure? Maybe. Maybe not. Maybe it seems more secure than it actually is.
Security depends on a lot of factors — not just how many keys are required to sign a transaction. It depends on processes and policies defining the policy controls: Who can change spending limits? Time limits? Notifications? When can they be changed? Is there a cooling-off period after they’re changed when no transactions will be signed? It also depends on the company’s internal security: Who has access to the oracle or signing keys? Where are the backups and who has access to those? Who writes the oracle software and is it open-source? These are just some examples of security concerns that aren’t addressed by multisig. Multisig means more than one key was used to create the address. Nothing more. It is not a euphemism for security. Alone, it’s not enough to keep our funds secure.
Security cannot be outsourced. As an industry, we need to stop confusing outsourcing signing keys with outsourcing security. Simply turning over signing keys and process controls to a third party will not protect you or your customers from theft. We need opt-in security standards, like CCSS, and annual security audits. Most importantly, we need to focus on understanding the risks and accurately explaining them to users.
Finally, always remember: “Not your keys, not your money.”
Footnotes: 1. If you’re reading this article, I assume you understand the basics of bitcoin. Bitcoin is secured by public key cryptography, seehttps://en.wikipedia.org/wiki/Public-key_cryptography. 2. Technically, this feature is called P2SH or pay-to-script-hash, not multisig. However one of the most common implementations of P2SH is to achieve multisig and the term multisig has become widely used to reference this specific P2SH implementation.
Original post: https://medium.com/@pamelawjd/bitcoin-security-is-more-than-multisig-1b55768582f3#.zh74f3cxm
Reply