How can an online wallet be more secure than paper wallets or cold storages? Recently, after I was reading that some bitcoin early adopter lost 750 BTC due to theft from his macbook, I was looking for the most secure storage solution for my coins.

I already know about paper wallets and cold storage solutions but I somehow came across reading about multisignature online wallets being more secure than the traditional systems.

I came across BitGo.com and they claim to be more secure than paper/cold storage but as easy to use like an online/mobile wallet:



Is this really possible? I was doing some research myself and learned they are using multisignature wallets with three private keys:


One encrypted private key holds BitGo with a passphrase only known by them.
Another encrypted private key holds BitGo with a passphrase chosen by me.
One encrypted backup key which only I hold with my own passphrase.


Now there are several use cases, I tried to deposit and withdraw some small amounts, and it's really easy. It seems they use their key on server side an my key on client side to sign the transaction. All I have to do is entering my passphrase to unlock the key.

In addition, if BitGo ever ceases to exist I can still use my own two keys to access the coins without using the service offered by BitGo.

But, to be honest, this sounds to good to be true. Now I'm wondering:


Is there a way BitGo (or an attacker who compromises BitGo) can access my funds because they hold two keys? Or is this really trustless because all depends on my passphrase?
Isn't entering my key's passphrase at their website a weak point which could be abused by attackers (or even the service)? Or is my password really only processed client-side?
Is such a solution really more secure than cold storages?
I tested it by creating a secure wallet on BitGo.

They gave a multisig address for deposits. 2/3 of keys are needed to withdraw Bitcoins. BitGo holds one key, you get private key and backup key.
You don't need to printed private key to withdraw Bitcoins. the passphrase is enough (apparently the key is derived form the passphrase).

BitGo cannot do Bitcoin transactions without user consent, because they (claim to) lack the other halves of the key. This protects againt some attacks. E.g. the site doesn't have a hot wallet which could be emptied if there is a breach on the server.  BitGo forces SMS two-factor authentication to be activated upon sign up. This is good too, protecting against lose of credentials due to stealing or phishing.

If the BitGo infrastructure gets compromised all created wallets after the compromise are compromised too, as the attack can capture keys upon creation. So ultimately you are placing trust on BitGo. They could also blatantly lie you and hold all copies of the created keys, as they are creating the keys, not you. Even if the key creation happens in a web browser using JavaScript you are trusting the code they give you to run.

BitGo is still an online site. If you store your passphrase in a password manager or web browser and your computer gets infected you can lose your Bitcoins, even without interaction from you. BitGo is also subject to malware attacks which modify the withdraw requests in-fly. However "the mad general problem" cannot be solved if you are not doing any checks outside the online world e.g. manual phone calls and confirming by voice. You always need to trust the device you are using to do the withdraws.

BitGo has a nice process and good instructions how to create a multisig wallet and they are also holding a third key themselves, which you can access through password and SMS confirmation. You could create a similar set up yourself, even in safer manner, but BitGo may save you from some hassle. BitGo is also safer than any Bitcoin wallet service where you hold no private keys at all.

The conclusion: lots of marketing promises, ultimately an online site, but may be safer than your average Bitcoin wallet service. You need to trust BitGo. Not safer than your own cold wallet / multisig solution if you know what you are doing.