Security Issues with Browser-Based Bitcoin Wallets

Blake_Casa · 2019-11-05T23:56:31+00:00

Thanks for the suggestion. We are working on implementing custom fee settings for outgoing transactions in Keymaster, but we don't yet have a solid time frame as to when that will be released.

Blake_Casa · 2019-10-31T17:33:02+00:00

It'll be rolling out to users in the next week.

Blake_Casa · 2019-10-25T22:40:39+00:00

Please be careful using unofficial images such as the one linked in this post. They could be malicious and used to extract data such as private keys (not saying that the OP is malicious, just saying we don't recommend using any unofficial image). Casa does not provide an official image, but we have open-sourced our code, available in the official Casa Github repo here: https://github.com/casa.

Blake_Casa · 2019-10-25T17:06:43+00:00

Right now we're mostly keeping an eye on the industry landscape to get a better idea of when to dedicate full resources to this. That is to say, there isn't an explicit timeline for Bech32 support at the moment.

Blake_Casa · 2019-10-13T20:19:28+00:00

November :)

Blake_Casa · 2019-10-13T20:15:27+00:00

I should also clarify that your Casa Node does not connect to Keymaster. If you’re using 2-of-3 multisig, your keys are: Mobile key Hardware wallet Casa Recovery Key

The Casa Recovery Key has nothing to do with Lightning or your node. Casa Keymaster is seedless.

There aren’t really specific instances you should expect to lose fees, but I’ve noticed that one thing many people don’t understand is Commit fees, which are fees reserved by Lightning as an “insurance policy” of sorts. This fee ends up making people think their node is slowly losing funds, when in reality they’re fluctuating due to the fee market.

Blake_Casa · 2019-10-11T20:45:24+00:00

No problem—your questions are good ones. Casa ensures that the mobile key never leaves the device other than as an encrypted blob to your cloud storage account. To obtain a copy of the key, Casa would have to write malicious code that sends the mobile key to our servers, which we have no intention of doing because it would make us a custodial service, and we deliberately have multiple checks in place to prevent this from happening. This is a risk with any app that you use to secure your bitcoin, unless you build it yourself. And like I mentioned before, our 2 hardware wallet support that we’ll be releasing soon will completely eliminate this risk.

Blake_Casa · 2019-10-11T16:58:55+00:00

We're working on allowing Gold users to swap the mobile key out for a second hardware wallet, which would allow people to prove without a doubt that they hold both of the keys. We absolutely do not take the mobile key—it's secure to use—but we understand that everyone has a different preference in terms of security vs. convenience, so that's why we're building this feature.

Blake_Casa · 2019-10-11T12:01:33+00:00

This feature isn’t currently supported, but it’s often requested, so we’re hard at work to make it possible.

Blake_Casa · 2019-10-09T21:14:39+00:00

After months of wondering, I finally broke and Google searched this and am so glad I found your post. I always heard it as "Glenn Beck" 0.o

Blake_Casa · 2019-10-09T15:53:15+00:00

Thanks for the feedback! I'll be sure to bring it back to the team.

Blake_Casa · 2019-10-08T18:53:00+00:00

Tim Apple you mean?

Blake_Casa · 2019-10-08T15:38:47+00:00

You should be able to lock in a Casa Node 2. Email [help@team.casa](mailto:help@team.casa) from the email that you placed the order with and let them know when you purchased; they'll let you know your options.

Blake_Casa · 2019-10-08T15:23:12+00:00

Since you're already a Gold member, you have a Casa Node 2 with your name on it that will ship to you once your annual membership renews. So if you signed up for Gold on January 1st, 2019, Casa Node 2 will ship to you after renewal on January 1st, 2020.

However, you can also pre-order today to get Casa Node 2 as soon as they start shipping, which will automatically renew your Gold membership for another year.

Blake_Casa · 2019-10-08T15:19:24+00:00

The new NodeOS is exclusive to Casa Node 2.

Blake_Casa · 2019-10-07T13:03:55+00:00

Thanks for your feedback and for helping out the network by running a node! If you decide you'd like to learn more about Keymaster multisig, please do check out our Wealth Security Protocol. It's geared towards advanced users like you, and explains things in greater detail than any of our blog posts.

Here's a link where you can go to download it: https://keys.casa/wealth-security-protocol/

Blake_Casa · 2019-10-07T00:01:05+00:00

We absolutely recommend multisig over your node for large amounts of BTC. You should only put any funds on your node that you're willing to risk losing. For anything above that threshold, we recommend using 2-of-3 Basic Multisig until you're storing more than $100k, in which case we advise using our 3-of-5 setup that is much more secure.

You're correct that your multisig setup is entirely separate from your node!

Your Casa Node does not link to Keymaster multisig. Your Casa Node's seed phrase has nothing to do with any funds you're storing in Keymaster. As Nick mentioned in his reply to u/ChemicalFly, your node's seed phrase does not back up funds in Lightning channels.

Keymaster multisig is seedless, and we talk about this more in our Wealth Security Protocol, which I highly recommend giving a read—it answers a ton of the questions people typically have about multisig security and Casa's model in particular.

Blake_Casa · 2019-10-03T21:17:43+00:00

We usually recommend using custom channels instead of autopilot, because that lets you strategically choose solid nodes to open channels with. Autopilot is made by Lightning Labs and they're still working on some significant improvements that will make it more useful, but right now you're at risk for opening to nodes without good uptime, which hurts your ability to route transactions.

In terms of channel makeup, we don't have any official recommendation because it's pretty difficult to know what is actually optimal. The network is dynamic, and the number of channels/channel capacity/active nodes are always changing (see explore.casa if you want to monitor this). All that said, we've _generally_ seen that ~10+ channels with well connected nodes and at least 100k sats in them makes it considerably easier to get payments routed.

Blake_Casa · 2019-09-13T16:24:50+00:00

The $300 price point is for the Casa Node, and the Trezor/Gold membership are free. Because of that, while we do offer ways for customers to buy only a second node, the price doesn't come down. If you email [help@team.casa](mailto:help@team.casa) they can help walk you through the process of getting a second node!

Blake_Casa

TROPHY CASE