Yeah, no, there's still a need for hot wallets which can be spent automatically by a server and these were basically the only ones stolen. You actually have to keep the keys separate for it to make a difference.
Also their api is borderline retarded. The server passes back a hash to sign and the client is just supposed to blindly sign it. Sure I suppose it could check it but then why wouldn't you just build it locally.
Regarding the blind signature: yes, you can check it and in most cases it's just checking a series of bytes at a given position in an array. One line of code. Building a multisig transaction locally? Good-luck doing that.
Also I've heard many times arguments along the lines of "my security is better than yours, I don't trust you". It's reminiscent of those arguments about cloud providers like AWS, "my outages are better than yours". The point is we are focusing solely on block chain infrastructure: the security, performance,and reliability. It's our expertise. Is it yours?
I guess this is where sufficiently advanced incompetence becomes indistinguishable from malice.
In either case, I strongly advise everyone to refrain from ever using any bitcoin service that you may be involved with.
Code? Better yet include it on your examples.
The security of our APIs lies in the fact we don't store private keys - the user signs their own transaction.
The point is that you don't need a hot wallet if you support multisig - the coins never go to the service provider, they stay in the users wallet.
Writing software that uses this API would be negligence.
And now they have two servers they can break into?
[1]: http://www.forbes.com/sites/timworstall/2013/12/03/fascinati...
A tautology indeed. Only upon reading the article itself did I realize I misread the title: I had both skipped over the word "security", and misinterpreted the B as the Bitcoin symbol, rather than an abbreviation for a billion.
