Mixin Safe: A Convenient and Decentralized Multisig + MPC + Timelock solution

[examplens]

I know there are too many different names involved in using Mixin Safe, but MixPay is a third party app on Mixin Messenger. They issues EPC for you so that you can verify your Mixin Messenger PIN while doing something. So you need to transfer EPC to them to get back the refund. In that procedure you proved that you knew the PIN, otherwise if they just sent back your TRX and you didn't know the PIN at all, then the money is lost.

I haven't tried it, but is there a limited number of PIN attempts and for example what happens after 5 incorrect attempts in a row?
If there is no other recovery method, the app should not lock. Enabling an unlimited number of attempts is again not a good solution from a security point of view.

[1714770771]

1714770771

[1714770771]

1714770771

[1714770771]

1714770771

[BlackHatCoiner]

Enabling an unlimited number of attempts is again not a good solution from a security point of view.

Yes, it is. Security that relies on the limit of attempts isn't true security. You have unlimited attempts to break a Bitcoin private key. You have unlimited attempts to break into someone's password-protected wallet. Both are very secure. On the other hand, the PIN in Mixin is not secure, as I have already said in my review, because there are less than a million different combinations.

[cedricfung]

Enabling an unlimited number of attempts is again not a good solution from a security point of view.

Yes, it is. Security that relies on the limit of attempts isn't true security. You have unlimited attempts to break a Bitcoin private key. You have unlimited attempts to break into someone's password-protected wallet. Both are very secure. On the other hand, the PIN in Mixin is not secure, as I have already said in my review, because there are less than a million different combinations.

Here we don't argue about the choice. Just focus on the project itself. No perfect security.

[noormcs5]

I know there are too many different names involved in using Mixin Safe, but MixPay is a third party app on Mixin Messenger.

I realize this when i was using the mixin safe for the first time as we are not used to it before but now i don't feel anything difficult at all and its all on my finger tips. Think for a moment a person's first time configuring a meta mask wallet and adding a Binance chain to the meta mask. He will be confused the first time configuring if he had never used the meta mask before.

The same thing with the mixin app, use it for few times and then one may feel it is easy to use it.

[Stalker22]

I know there are too many different names involved in using Mixin Safe, but MixPay is a third party app on Mixin Messenger.

I realize this when i was using the mixin safe for the first time as we are not used to it before but now i don't feel anything difficult at all and its all on my finger tips. Think for a moment a person's first time configuring a meta mask wallet and adding a Binance chain to the meta mask. He will be confused the first time configuring if he had never used the meta mask before.

The same thing with the mixin app, use it for few times and then one may feel it is easy to use it.

Just like many others, I also recently reviewed the MixinSafe product (if you are interested, you can check out my review here). So, I figured it is a good idea to give this discussion a little bump.

So, from my point of view, going through the whole thing has been a bit tricky. Honestly, without a step-by-step guide or a video to show the ropes, I can totally see newbies running into a few issues. I get that the software is still in the testing phase, but I think they could make the whole process much smoother.

For example, when someone's making their first safe, they could set up a step-by-step wizard. It would walk them through everything and give a detailed explanation for each step.

[cedricfung]

I realize this when i was using the mixin safe for the first time as we are not used to it before but now i don't feel anything difficult at all and its all on my finger tips. Think for a moment a person's first time configuring a meta mask wallet and adding a Binance chain to the meta mask. He will be confused the first time configuring if he had never used the meta mask before.

The same thing with the mixin app, use it for few times and then one may feel it is easy to use it.

Just like many others, I also recently reviewed the MixinSafe product (if you are interested, you can check out my review here). So, I figured it is a good idea to give this discussion a little bump.

So, from my point of view, going through the whole thing has been a bit tricky. Honestly, without a step-by-step guide or a video to show the ropes, I can totally see newbies running into a few issues. I get that the software is still in the testing phase, but I think they could make the whole process much smoother.

For example, when someone's making their first safe, they could set up a step-by-step wizard. It would walk them through everything and give a detailed explanation for each step.

I agree , thank you both. There is a lot to improve, and I believe the idea of multisig+timelock is the way to real safe decentralized Bitcoin custody for general public.

[examplens]

So, from my point of view, going through the whole thing has been a bit tricky. Honestly, without a step-by-step guide or a video to show the ropes, I can totally see newbies running into a few issues. I get that the software is still in the testing phase, but I think they could make the whole process much smoother.

For example, when someone's making their first safe, they could set up a step-by-step wizard. It would walk them through everything and give a detailed explanation for each step.

As far as I have noticed, the biggest number of complaints is precisely the lack of instructions and somewhat weaker navigation. That was my conclusion, among other things. However, I have to agree with noormcs5, after some use of the application, it seems that everything is clear and simple.
The addition of info hints would make it much easier for newbies to use the platform.

There is a lot to improve, and I believe the idea of multisig+timelock is the way to real safe decentralized Bitcoin custody for general public.

It looks like you will have to have another review campaign to test changes and integrated improvements  

[virasog]

It looks like you will have to have another review campaign to test changes and integrated improvements  

They may or may not have another review campaign. But right now they have got a lot of reviews, around 100 I think, and it is now time for them to read and analyze each one of them, see what are opinions of the people, what things they have done well in their product and what features needs to be improved.

If they focus on the details and upload new improved changes to their Mixin Safe ecosystem, it will further become a good product.

[serveria.com]

I realize this when i was using the mixin safe for the first time as we are not used to it before but now i don't feel anything difficult at all and its all on my finger tips. Think for a moment a person's first time configuring a meta mask wallet and adding a Binance chain to the meta mask. He will be confused the first time configuring if he had never used the meta mask before.

The same thing with the mixin app, use it for few times and then one may feel it is easy to use it.

Just like many others, I also recently reviewed the MixinSafe product (if you are interested, you can check out my review here). So, I figured it is a good idea to give this discussion a little bump.

So, from my point of view, going through the whole thing has been a bit tricky. Honestly, without a step-by-step guide or a video to show the ropes, I can totally see newbies running into a few issues. I get that the software is still in the testing phase, but I think they could make the whole process much smoother.

For example, when someone's making their first safe, they could set up a step-by-step wizard. It would walk them through everything and give a detailed explanation for each step.

I agree , thank you both. There is a lot to improve, and I believe the idea of multisig+timelock is the way to real safe decentralized Bitcoin custody for general public.

Yes, but not just that. I guess educating people, explaining what your product does is a key to success. According to some feedback, some people don't really understand what this product is and what are the use cases. In case of MixinSafe, I guess many think that it's a mixer, probably because of the name, they think it's "mixing safe" where safe is an adjective. But in fact it's a safe wallet with mixing capabilities "Mixin" which is a brand name and "safe" as a safe deposit box in a bank (a noun). In any case, wouldn't it be better to come up with a more clear name and description of the service? Like Mixin Wallet for example?

[JohnBitCo]

Yes, but not just that. I guess educating people, explaining what your product does is a key to success. According to some feedback, some people don't really understand what this product is and what are the use cases. In case of MixinSafe, I guess many think that it's a mixer, probably because of the name, they think it's "mixing safe" where safe is an adjective. But in fact it's a safe wallet with mixing capabilities "Mixin" which is a brand name and "safe" as a safe deposit box in a bank (a noun). In any case, wouldn't it be better to come up with a more clear name and description of the service? Like Mixin Wallet for example?

At one side you said it is not a mixer and while on the other hand, you said, it's a wallet with mixing capabilities 

Do you mean to say that we can mix our coins through this wallet and may not need a external mixer ?

[Stalker22]

At one side you said it is not a mixer and while on the other hand, you said, it's a wallet with mixing capabilities 

Do you mean to say that we can mix our coins through this wallet and may not need a external mixer ?

No, Mixin does not have coin mixing capabilities in their wallet or Mixin Safe service. This is not the primary purpose of the service. I do not know if serveria.com tested the service or not, but he probably reached the wrong conclusion based on the service's name.

In any case, wouldn't it be better to come up with a more clear name and description of the service? Like Mixin Wallet for example?

There is already a Mixin Wallet integrated into the Mixin Messenger App. Mixin Safe is a standalone service.

[Rruchi man]

At one side you said it is not a mixer and while on the other hand, you said, it's a wallet with mixing capabilities  

Do you mean to say that we can mix our coins through this wallet and may not need a external mixer ?

The name of the safe reflects the name of the parent company "Mixin Ltd" from Hong Kong.

They do not provide bitcoin mixing service for people who want to mask the origin and destination of their coins, do not get it confused.

Mixin safe

is designed to offer enhanced security for digital investments, and Mixin Ltd doesn't hold any assets belonging to its customers.

source

[acroman08]

So, from my point of view, going through the whole thing has been a bit tricky. Honestly, without a step-by-step guide or a video to show the ropes, I can totally see newbies running into a few issues. I get that the software is still in the testing phase, but I think they could make the whole process much smoother.

For example, when someone's making their first safe, they could set up a step-by-step wizard. It would walk them through everything and give a detailed explanation for each step.

As far as I have noticed, the biggest number of complaints is precisely the lack of instructions and somewhat weaker navigation. That was my conclusion, among other things. However, I have to agree with noormcs5, after some use of the application, it seems that everything is clear and simple.
The addition of info hints would make it much easier for newbies to use the platform.

Perhaps a video tutorial that can be easily viewed on their website would be a good idea to better guide newbies into using and navigating through the app/service. also, I just want to add that on their website they have something called "schedule a demo" From what I understand if you schedule a demo, one of their "professional Bitcoin wealth managers" will show you how to use "a completely decentralized custody suite to manage your Bitcoin.".

[Stalker22]

~
Perhaps a video tutorial that can be easily viewed on their website would be a good idea to better guide newbies into using and navigating through the app/service. also, I just want to add that on their website they have something called "schedule a demo" From what I understand if you schedule a demo, one of their "professional Bitcoin wealth managers" will show you how to use "a completely decentralized custody suite to manage your Bitcoin.".

I totally agree with the idea of dropping some info hints or a video tutorial on their website – that could really help out the newcomers. Plus, considering this service is still in beta, they will probably make some UI improvements to make it smoother and more user-friendly. Betas tend to start a bit rough around the edges, but with user feedback, they usually get polished over time. So, chances are this platform will get even more user-friendly and attractive to a wider crowd as it evolves.

[virasog]

~
Perhaps a video tutorial that can be easily viewed on their website would be a good idea to better guide newbies into using and navigating through the app/service. also, I just want to add that on their website they have something called "schedule a demo" From what I understand if you schedule a demo, one of their "professional Bitcoin wealth managers" will show you how to use "a completely decentralized custody suite to manage your Bitcoin.".

I totally agree with the idea of dropping some info hints or a video tutorial on their website – that could really help out the newcomers. Plus, considering this service is still in beta, they will probably make some UI improvements to make it smoother and more user-friendly. Betas tend to start a bit rough around the edges, but with user feedback, they usually get polished over time. So, chances are this platform will get even more user-friendly and attractive to a wider crowd as it evolves.

Well, apart from any video tutorial, they can also link this thread Mixin Safe - Decentralized Bitcoin Custody Solutions | Review Campaign on their official site. There are almost 100 reviews on that thread and each one explains in detail how this Mixin Safe works and feedback from all those users.

For anyone who is new to Mixin safe, that is a very informative thread to read before actually using the Mixin safe.

[lionheart78]

~
Perhaps a video tutorial that can be easily viewed on their website would be a good idea to better guide newbies into using and navigating through the app/service. also, I just want to add that on their website they have something called "schedule a demo" From what I understand if you schedule a demo, one of their "professional Bitcoin wealth managers" will show you how to use "a completely decentralized custody suite to manage your Bitcoin.".

I totally agree with the idea of dropping some info hints or a video tutorial on their website – that could really help out the newcomers. Plus, considering this service is still in beta, they will probably make some UI improvements to make it smoother and more user-friendly. Betas tend to start a bit rough around the edges, but with user feedback, they usually get polished over time. So, chances are this platform will get even more user-friendly and attractive to a wider crowd as it evolves.

I believe they already have a step-by-step tutorial that will guide their client in creating the account. It can be found here: https://safe.mixin.one/start

The site also has the add-on information on the same page through the Learn More link.  I believe with the given step-by-step guide, the new client won't have a problem following the instructions except if the client himself has a comprehension problem.  And there is where the support chat enters since customers can ask questions if they encountered any confusion or problem.

[dkbit98]

Warning everyone that Mixing Networks suspended services after database hack involving $200 million, so temporarily they suspended deposit and withdrawal services!
SlowMist is investigating this hack, and I am thinking if only coins got stolen or personal information of customers (phone numbers, email addresses) are also exposed.
This is how ''safe'' cloud services are, and this is how ''decentralized'' this  network is. 

Official Mixin tweet:

[Announcement] In the early morning of September 23, 2023 Hong Kong time, the database of Mixin Network's cloud service provider was attacked by hackers, resulting in the loss of some assets on the mainnet. We have contacted Google and blockchain security company @SlowMist_Team
 to assist with the investigation. After initial verification, the funds involved are approximately US$200 million. Deposit and withdrawal services on Mixin Network have been temporarily suspended. After discussion and consensus among all nodes, these services will be reopened once the vulnerabilities are confirmed and fixed. During this period, transfers are not affected.

Regarding how to deal with the lost assets, the Mixin team will announce the solution afterward. Mixin founder Feng Xiaodong will explain this incident in a public Mandarin livestream at 13:00 HKT on September 25, 2023. Please help spread the word. We will summarize the content in English afterward for easy reference. We will try our best to minimize the losses and deeply apologize for this. Thank you, everyone, for your continuous support

https://twitter.com/MixinKernel/status/1706139175018529139

[Rruchi man]

Warning everyone that Mixing Networks suspended services after database hack involving $200 million, so temporarily they suspended deposit and withdrawal services!
SlowMist is investigating this hack, and I am thinking if only coins got stolen or personal information of customers (phone numbers, email addresses) are also exposed.
This is how ''safe'' cloud services are, and this is how ''decentralized'' this  network is.  

Official Mixin tweet:

[Announcement] In the early morning of September 23, 2023 Hong Kong time, the database of Mixin Network's cloud service provider was attacked by hackers, resulting in the loss of some assets on the mainnet. We have contacted Google and blockchain security company @SlowMist_Team
 to assist with the investigation. After initial verification, the funds involved are approximately US$200 million. Deposit and withdrawal services on Mixin Network have been temporarily suspended. After discussion and consensus among all nodes, these services will be reopened once the vulnerabilities are confirmed and fixed. During this period, transfers are not affected.

Regarding how to deal with the lost assets, the Mixin team will announce the solution afterward. Mixin founder Feng Xiaodong will explain this incident in a public Mandarin livestream at 13:00 HKT on September 25, 2023. Please help spread the word. We will summarize the content in English afterward for easy reference. We will try our best to minimize the losses and deeply apologize for this. Thank you, everyone, for your continuous support

https://twitter.com/MixinKernel/status/1706139175018529139

I had this notification, I like that the Mixin group were prompt to notice the attack and send out notifications to users of the app to know about why the deposit and withdrawal services have been suspended temporarily. It will reduce the tension that would have been experienced if users had noticed it without a prompt notification for the reason.

I am looking to see the announcement by the mixin team. These are kind of experiences that make a project stronger

[hugeblack]

Warning everyone that Mixing Networks suspended services after database hack involving $200 million, so temporarily they suspended deposit and withdrawal services!

What Database? Google Cloud Provider? blockchain security company?

Is the scheme they showed different from what is happening, or is the word decentralization not accurate? Isn’t there supposed to be no single point of failure?

I thought the vulnerability was in miniscript, which still appears to be in the development stage, but I was shocked after reading the reason for the hack.
Is the 200 million customers’ money? Are people serious about saving all this service?

[LoyceV]

I had this notification, I like that the Mixin group were prompt to notice the attack and send out notifications to users of the app to know about why the deposit and withdrawal services have been suspended temporarily. It will reduce the tension that would have been experienced if users had noticed it without a prompt notification for the reason.

How does "we're hacked, you can't withdraw" reduce worries?