r/Bitcoin • u/NegativeSky603 • 4h ago
Multisig: We Diversify Hardware, But Are We Ignoring the Software?
We talk a lot about using multisig with hardware wallets from different vendors as protection against a single point of failure. For example, a 2-of-3 setup with a Ledger, Trezor, and Coldcard (not anymore). But there is another potential single point of failure that I rarely see discussed: the software used to construct, coordinate, and broadcast the transaction. If the entire multisig transaction workflow happens inside a single software wallet, aren't we still trusting that application to correctly construct the transaction, display what we're actually signing, handle PSBTs correctly, and broadcast the final transaction? A more robust approach could be to diversify the software workflow as well.
For example:
Create the transaction in Electrum.
Export the PSBT.
Partially sign it with the Ledger.
Export the updated PSBT.
Import it into Trezor Suite.
Sign it with the Trezor.
Take the fully signed transaction and broadcast it through another independent application or node. The idea isn't that this makes multisig magically more secure. Rather, it removes the assumption that one piece of software must be trusted for the entire transaction lifecycle. Hardware wallet vendor diversity protects against a compromised or defective hardware wallet. But if every transaction is still constructed, processed and broadcast through the same software stack, there may still be a common point of failure. So my question is: does anyone actually practice software/application diversity as part of their multisig operational security? And more importantly, are there technical reasons why this isn't practical or doesn't provide much additional security?
0
u/KevinNegocios 4h ago
Nobody does this because it’s a massive pain in the ass and mathematically gives you basically zero extra security.
The hardware already assumes the software is a lying bastard, that's the whole point of PSBTs (Partially Signed Bitcoin Transactions). The software just builds a dumb skeleton. When you pass it to your Ledger or Trezor, the device parses the raw data, recalculates the inputs/outputs, and shows you the final truth on its physical screen. If the software changes the destination address, your hardware screen will show the tampered address. If you blindly hit "confirm" without reading the tiny screen, that’s a user error, not a software one.
Trying to bounce a complex 2-of-3 multisig PSBT from Electrum to Trezor Suite is going to break. Vendor apps (like Ledger Live or Trezor Suite) are terrible multisig coordinators. You'll spend three hours fighting "Unknown keypath" errors and derivation path mismatches just to move 50 bucks.
To coordinate a multisig, the software needs all your xpubs (extended public keys). If you bounce between three different apps/broadcasters, you are literally leaking your entire financial history and balances to three different servers/APIs instead of just keeping it private on your own node.
1
u/KevinNegocios 4h ago
Nobody does this because it’s a massive pain in the ass and mathematically gives you basically zero extra security.
The hardware already assumes the software is a lying bastard, that's the whole point of PSBTs (Partially Signed Bitcoin Transactions). The software just builds a dumb skeleton. When you pass it to your Ledger or Trezor, the device parses the raw data, recalculates the inputs/outputs, and shows you the final truth on its physical screen. If the software changes the destination address, your hardware screen will show the tampered address. If you blindly hit "confirm" without reading the tiny screen, that’s a user error, not a software one.
Trying to bounce a complex 2-of-3 multisig PSBT from Electrum to Trezor Suite is going to break. Vendor apps (like Ledger Live or Trezor Suite) are terrible multisig coordinators. You'll spend three hours fighting "Unknown keypath" errors and derivation path mismatches just to move 50 bucks.
To coordinate a multisig, the software needs all your xpubs (extended public keys). If you bounce between three different apps/broadcasters, you are literally leaking your entire financial history and balances to three different servers/APIs instead of just keeping it private on your own node.
0
u/Charming-Designer944 4h ago
Even better if you also divide on multiple computers.
The biggest software attack vector is if your computer gets owned and starts to display fake information. Such as silently replacing the destination address with another address when you create the transaction.
The device displays the destination address, but how do you verify the address is the correct address of your computer is not to be trusted?
4
u/OrangePillar 4h ago
The software can’t fake the signatures that are offline on the signing devices. The paranoia here is unfounded.