Copay, our open-source multi-signature wallet, is still in development, improving week after week. We do our best to pay attention to community feedback and respond by building Copay into the most intuitive bitcoin platform possible – all without ever compromising on security.
A month ago we fixed a security vulnerability found by our friends from CoInspect. This improvement was possible mainly because of the open-source nature of Copay, which led to community analysis of the source code. We want as many eyes as possible on Copay, as we really want to make it the most secure bitcoin platform!
Asynchronous Multisig
Another issue many users and developers pointed out about Copay was the inconvenience of needing all shared owners (copayers) to be online at the same time to create a transaction from a multisignature wallet.
Say Alice, Bob and Claire created a Copay multisignature 2-of-3 wallet to store their shared savings for a trip. With previous version of Copay, to spend those funds, they all had to be online to create a bitcoin multisignature transaction and sign it off. Now, they can each open their wallets at any time, and they will be able to see, evaluate, and sign or reject the transaction asynchronously.
This change was possible by using Insight, our open-source blockchain API, as a communication layer for copayers. The main focus behind this change was improving availability and usability of copay. While this does add a bit of centralization to the operation of Copay, we think the compromise is worth it. Anyone can run their own Insight server, and each copayer still holds their private keys locally without ever sharing them to the network. The Bitcoin network is the only way the multiple signatures are validated, and there is no centralized process there. This is just another step towards having a really easy to use multisignature platform.
Security Model
It is also worth noting that messages between copayers are encrypted and signed before going through the Insight message broker. The public keys used for this are derived from the same master keys used for controlling your bitcoin (via BIP32 HD Wallets). Because of this mechanisms, all communications are secure, and the message broker can't read nor modify anything. The messages are just temporarily stored on Insight as a convenience.
Give the new Copay a try and see how you can issue and sign multisignature bitcoin transactions with your friends! If you have any other features you'd like to see, or suggestions on what to do next, feel free to open a new GitHub issue. We're always looking for your feedback!
