<p>I think your worry is that the hacker will change the public key in the database to be the public key for one of their addresses, and get access to the private key that you own, which means they will have the ability to make 2/3 signatures, which is all that they need. </p>

<p>This will only be a risk if you can't detect it and alert those who are funding the addresses to stop. As Matthieu said, the signatures on the old multisig address won't be valid anymore. If your service is queried for an address to send coins to, however, and it returns the new maliciously created address, then your users might be funding an address which can be spent by the hacker. </p>

<p>So, I think your best bet would be to make sure that you can put your service into safe-mode if someone has hacked in.</p>

CC BY-SA 3.0
2014-10-21T06:45:17.850Z
Yes, that is exactly what I did.
Antoni
CC BY-SA 3.0
2014-10-20T23:04:26.823Z
2014-10-20T23:04:26.823Z
morsecoder
<p>As long as what you ask from the users are only their public key and signature, you are safe. You only have the third private key per your description, users A and B have the 2 others.</p>

<p>You may want to have a look at BlockCypher's multisig API that implements a scheme very similar to what you describe (only the mechanism for notification is left for you to choose):</p>

<p><a href="http://dev.blockcypher.com/#multisig" rel="nofollow">http://dev.blockcypher.com/#multisig</a></p>

CC BY-SA 3.0
2014-07-23T07:02:53.813Z
My concern is that a hacker can change User B and my own public address with his own. User A will not know these have been changed and fund that MultiSig address. I'll have to add a lot of security to my linux server to avoid being hacked.
Antoni
CC BY-SA 3.0
2014-07-23T22:38:35.197Z
If a hacker changes an address, the transaction is changed as well and the signature that User A provided will not be valid anymore.
Matthieu
CC BY-SA 3.0
2014-07-22T18:36:12.280Z
2014-07-22T18:36:12.280Z
Matthieu
<p>I want to create a MultiSig address where user A sends the public key of its bitcoin address (gets saved in the database). User B gets notified that he must send his public key to create the 2-3 MultiSig address. The third address is provided by me as a mediator. My concern is that if the server is hacked, the hacker can change my source code (PHP) so that 2 of 3 public keys are in his possession. Any ideas on how I can secure this 2-3 MultiSig address creation scenario?</p>

CC BY-SA 3.0
2014-10-21T00:02:34.303Z
It's worth noting that this problem is not specific to multisig - If you have e.g. a donation address, somebody who breaks in could change that address to something they controlled.
Nick ODell
<multi-signature>
Creating MultiSig from server
Antoni
# Creating MultiSig from server

(Asked by: username_0 on 2014-07-22)

I want to create a MultiSig address where user A sends the public key of its bitcoin address (gets saved in the database). User B gets notified that he must send his public key to create the 2-3 MultiSig address. The third address is provided by me as a mediator. My concern is that if the server is hacked, the hacker can change my source code (PHP) so that 2 of 3 public keys are in his possession. Any ideas on how I can secure this 2-3 MultiSig address creation scenario?

**Tags:** multi-signature

> **Comments:**
> **username_1**: It's worth noting that this problem is not specific to multisig - If you have e.g. a donation address, somebody who breaks in could change that address to something they controlled.  

---

## 2 answers

### Answer by username_2 on 2014-10-20. Score: 1 | Accepted answer

I think your worry is that the hacker will change the public key in the database to be the public key for one of their addresses, and get access to the private key that you own, which means they will have the ability to make 2/3 signatures, which is all that they need.

This will only be a risk if you can't detect it and alert those who are funding the addresses to stop. As username_3 said, the signatures on the old multisig address won't be valid anymore. If your service is queried for an address to send coins to, however, and it returns the new maliciously created address, then your users might be funding an address which can be spent by the hacker.

So, I think your best bet would be to make sure that you can put your service into safe-mode if someone has hacked in.

> **Comments:**
> **username_0**: Yes, that is exactly what I did.  

---

### Answer by username_3 on 2014-07-22. Score: 0

As long as what you ask from the users are only their public key and signature, you are safe. You only have the third private key per your description, users A and B have the 2 others.

You may want to have a look at BlockCypher's multisig API that implements a scheme very similar to what you describe (only the mechanism for notification is left for you to choose):

<http://dev.blockcypher.com/#multisig>

> **Comments:**
> **username_0**: My concern is that a hacker can change User B and my own public address with his own. User A will not know these have been changed and fund that MultiSig address. I'll have to add a lot of security to my linux server to avoid being hacked.  
> **username_3**: If a hacker changes an address, the transaction is changed as well and the signature that User A provided will not be valid anymore.  

---

