In the aftermath of the oldest bitcoin exchange (MTGOX) shutting down, what is the plan at Bitcoin Central to handle security concerns ?
Ever since the new bitcoin-central.net has been deployed last October (2013), all 100 % of bitcoins sent by customers to their account are put in « cold storage » “: Bitcoin Central does not store any bitcoin private key on customer-facing servers.
Each individual private key is split in n shares by a cryptographic secret splitting scheme that requires to gather p out of n shares to recover the key (p < n). The secret shares are printed on paper and put in sealed waterproof envelopes, stored in safe locations accross several jurisdictions. Thanks to this process, even if one or more (up to n-p) shares were compromised or destroyed, it would be possible to recover the key with the remaining shares.
2) Adequately rigorous technical and financial processes have been implemented, including a manual check of all bitcoin withdrawals before any bitcoin transaction is sent out.
This way, Bitcoin Central can prevent attempts at exploiting the malleability of bitcoin transactions.
External auditors specialized in computer security and in the Bitcoin protocol have thoroughly reviewed Bitcoin Central systems and processes.
3) Our customers have been briefed about the basics of home computer security: use of a strong password different from other passwords used on other sites, two-factor authentication via yubikey or Google Auth.
What about « proof of solvency » ?
Until the inception of Bitcoin, there was no easy way for a financial service provider to prove its solvency.
By virtue of the Bitcoin technology, we can now devise new ways to proactively share information proving our solvency without disclosing any sensitive individual account data.
We will publish as soon as possible a periodic bitcoin solvency report, most likely a quarterly solvency report, as a first step.
The level of transparency we are aiming at is unknown in the traditional banking sector. It is made possible by the unique properties of Bitcoin.
We are considering several options, some of them having been discussed already on the forums.
Obviously, the disclosure should not open up any security vulnerability.
For instance, we cannot simply publish simultaneously a cold storage address and a message signed by the corresponding private key.
Doing so would defeat our purpose because signing the message entails pulling out the private key from its « cold storage» safe status, by definition.
We are currently evaluating solutions that would enable each customer to verify Bitcoin Central solvency while disclosing only the data strictly necessary to perform such verification. Stay tuned.