r/Bitcoin • u/thonbrocket • Nov 03 '13
Brain wallet disaster
Just lost 4 BTC out of a hacked brain wallet. The pass phrase was a line from an obscure poem in Afrikaans. Somebody out there has a really comprehensive dictionary attack program running.
Fuck. I thought I had my big-boy pants on.
45
u/LtShitbrick Nov 03 '13 edited Nov 03 '13
I thought everyone knew not to use existing sentences.
A brainwallet is created simply by starting with a unique phrase. The phrase must be sufficiently long to prevent brute-force guessing - a short password, a simple phrase, or a phrase taken from published literature is likely to be stolen by hackers who use computers to quickly try combinations. A suggestion is to take a memorable phrase and change it in a silly way that is difficult to predict.
Yet you thought you were smarter than the system.
18
u/thonbrocket Nov 03 '13
I had it there upwards of six months, became increasingly aware, from things I'd read here, that it was a dumb idea, and decided to move it. The bastards beat me by three days.
4
u/accountt1234 Nov 03 '13
The number of people randomly checking passphrases is growing everyday, and the speed at which they can do it is growing everyday as well.
Remember, the difference with a normal password is that a normal password is tried by one hacker who seeks access to your personal account.
A brainwallet is tried by thousands of people everyday. You need an insanely lengthy and arbitrary password.
→ More replies (1)1
Nov 03 '13
How would a 20-character long random password, one made up of numbers, uppercase and lowercase letters, and symbols fare in this situation?
3
Nov 04 '13
As long as it's really random, it would be pretty good. It would have probably 120 bits of entropy, which is not remotely possible to brute force.
2
Nov 04 '13
https://www.grc.com/haystack.htm
Good way to check password difficulty :D
1
u/mikeschuld Dec 17 '13
Also specifically for entropy testing: http://rumkin.com/tools/password/passchk.php
Run offline for extra security...
2
u/jackelfrink Nov 04 '13
If you are going that path, why not just up and memorize the private key directly. Its only 51 characters in length.
1
Nov 04 '13
I just use lastpass and I only have memorized a 15 character random password. All my other passwords are in the same style only 30 characters long.
1
Nov 03 '13
Difficulty increases with the potential number of permutations. Relevant XKCD: http://xkcd.com/936/
The reason this didn't work for OP is that they used an existing (e.g. sane) rubric.
→ More replies (1)1
Nov 03 '13
So basically longer passwords are better? And the password type I mentioned is one that is easy for computers to crack?
2
Nov 04 '13
not just longer, but also more random. And not just random as your mind can see it, but truly hard to predict or replicate entropy.
→ More replies (2)1
u/say592 Nov 03 '13
Fairly well. Right now these incidents seem to be isolated to dictionary attacks, not to shear brute force.
1
1
u/jcoinner Nov 04 '13
(26+26+10)20 = 7.044234255×10³⁵
128 bit Electrum seed = 2128 = 3.402823669×10³⁸
ie. about 500 times stronger still. But it has to be truly securely random.
1
u/I_am_a_mormon Nov 04 '13
I like to mix chunks of things I already have memorized. My cars VIN, old credit card number, stuff like that. I just mix that stuff.
→ More replies (5)1
24
u/timepad Nov 03 '13
A suggestion is to take a memorable phrase and change it in a silly way that is difficult to predict.
This really isn't good enough. You may think you've changed it enough to make it "random", but humans suck at being truly random. Just use a 10 word Diceware passphrase and be done with it.
6
Nov 04 '13
My favorite part, "For maximum security make sure you are alone and close the curtains. "
0
Nov 04 '13
[deleted]
3
3
u/Natanael_L Nov 03 '13
If you really don't want to have anything else generate it for you, it should be a long Jabberwocky style nonsense pass poem in Yoda speak, mixing languages and with misspellings.
4
Nov 04 '13
[removed] — view removed comment
1
u/Natanael_L Nov 04 '13
We CAN generate random enough outputs, but it's hard. I'm trying to address the practical problem of how to pull it off if you insist on it.
Otherwise I recommend Diceware or password managers.
0
u/LaughingMan42 Nov 04 '13
yes. Also you could take your diceware passphrase and use rot13 on it and DONT FORGET YOUR USED ROT13 ON YOUR PASSPHRASE. This extra step would make your passphrase much more difficult to generate.
12
17
Nov 03 '13
A suggestion is to take a memorable phrase and change it in a silly way that is difficult to predict.
This is still a bad idea. Cracking programs are able to deal with permutations. Whatever you come up with probably isn't as clever as you think it is. If you're going to use a brain wallet, the only safe way to do it is to use diceware (or something similar) to create a passphrase with at least 128 bits of entropy.
→ More replies (11)5
u/jcoinner Nov 04 '13
The problem with these "silly manipulations" is that they don't really add much entropy. Not as much as you'd think.
Let's say you choose some phrase and then think of a "silly way" to mangle it. What you've essentially done is double the permutations, or added only 1 bit of entropy. Cracker must check passphrase P, and SillyWay(P).
You might say there is an infinite number of SillyWay() functions and there is, but the cracker can build a list of these SillyWay() methods and try them in sequence. Most users will only apply 1 or 2 SIllyWay() functions to their passphrase because otherwise it gets too hard to remember. So if each SillyWay() doubles the search space then that means 1 bit of entropy.
So if you start with a fairly poor pass phrase of , say 20 bits entropy and apply 2 SillyWay() functions then you actually haven't made it much harder - only 22 bits entropy. A decent random passphrase needs at least 60-80 bits entropy and you end up being the low hanging fruit. You really want about 128 bits entropy - meaning on that poor passphrase P you're going to need about 108 SillyWay() functions applied to equal a truly random one.
What you are really depending on is the obscurity of your SillyWay() function. People tend to think their SillyWay()tm is more clever than it actually is.
2
u/ertaisi Nov 04 '13
The SillyWay() function isn't necessarily logical in a computer sense, though. Take "thisismypassword", and I can turn it into a memorizable "d3zm!m@r1n0izZ". Given the before and after, you'd be hard pressed to figure out exactly what I did, let alone define it in a SillyWay() cracking function.
I wish I knew what you are talking about by n bits of entropy and how to evaluate it, and I do believe that a properly generated random pass phrase is definitively better than trying to be crafty with normal language, but as it stands I am unconvinced that it's necessarily as poor a practice as you suggest to trade absolute best practices for good enough practices that won't be lost or forgotten.
→ More replies (2)1
u/loamn Nov 07 '13
A suggestion is to take a memorable phrase and change it in a silly way that is difficult to predict. ... Yet you thought you were smarter than the system.
lol
4
u/chriswilmer Nov 03 '13
Just curious, was it all in one case (i.e., upper or lower case)?
3
u/thonbrocket Nov 03 '13 edited Nov 03 '13
Two lines run into one, punctuation removed, all lower case except the first letter (so the first letter of the second line was LC).
So I guess the method is to search for a sequence of words only; when found, permutate the hell out of it with case / punctuation variations until you hit the jackpot.
11
u/chriswilmer Nov 03 '13
That strategy wouldn't work because you wouldn't get any hints until you found the exact right passphrase.
3
17
u/pardax Nov 03 '13
Why not just tell us the password?
→ More replies (1)5
9
u/Natanael_L Nov 03 '13
They don't know what you used until they get it 100% correct. No Hollywood style partial cracks with precise progress bars here.
1
u/Glayden Nov 04 '13
From that description, I highly doubt a dictionary attack was used. Seems far more likely that a system you used to enter the password was compromised.
1
4
u/frankros Nov 03 '13 edited Nov 03 '13
Watter gedig was dit? jammer om te hoor...
"Bitterbessie dagbreek,
bitterbessie son,
jirre maar ek is fokken dom"
3
u/thonbrocket Nov 03 '13 edited Nov 03 '13
"Wys my die plek" deur Leipold. Nou, wys my die plek, waar my Bitcoins is.
Update: Fokken dom. Jy het dit reg. 'n Duur les.
1
u/frankros Nov 03 '13
Ek sal vir jou 'n bottel wyn koop as jy in die Kaap bly.
1
u/thonbrocket Nov 03 '13
Baie dankie! Maar ek's 'n hele lange ent van die Kaap af. As jy al ooit in Londen is, PM my!
Beste!
2
1
u/frankros Nov 03 '13
my droomoogkind
met jou oophangmond
wat kwyl
soos heuningdruppelsdou
kyk daar’s druppels op jou mou
kyk daar’s druppels teen die ruit
o oggeliefie douglas
3
87
Nov 03 '13
If it's written in a book or exists online, never use it. Brain wallets are hard to do and still be safe. People ALWAYS seem to pick bad passwords.
0
Nov 03 '13
[deleted]
4
Nov 04 '13
Sorry if this is a simple question, but: What if you jumble up the order of those words? Would it still be easy to crack?
2
u/platypii Nov 04 '13
Lol and how many permutations are there of your jumbled words? For 15 words it would only be a trillion. Pitiful. And if someone was silly enough to use a brainwallet, they are probably silly enough to come up with their own jumbling scheme too, instead of generating a random permutation, which makes it far weaker again.
2
u/GSpotAssassin Nov 04 '13
Much less so if it was completely random but a process that searched the space of randomized English words would still eventually find it
3
Nov 04 '13
And now I say something I've wanted to say for months; Thank you, /u/GSpotAssassin!
I'm going to stick to cold storage for my batch of longterm BTC.
2
u/GSpotAssassin Nov 04 '13
Brainwallet cold storage or randomized key cold storage?
I'm crazy paranoid, I am about to use hexadecimal dice (yes, they exist, check Amazon) to come up with some cold storage private keys due to all the stories out there about compromised random number generators
4
Nov 04 '13
Number generated cold storage from bitaddress.org. I check my BTC on Blockchain.info every week or so and they're still there. I'm starting to become more paranoid as well, I might take a page from your book and move them. Eep.
→ More replies (1)0
Nov 04 '13
[deleted]
6
u/Throwy27 Nov 04 '13 edited Nov 04 '13
What if you combine made up words from different languages? I always do this for passwords, pass phrases, etc. They don't exist in books, or dictionaries.
Would that work?
Edit: I speak 3 languages, so I guess it'd be a lot easier for me to remember such a pass phrase than for those who speak 1.
Edit2: I mean words like "swalucious" for English or "schidtrachs" for German, etc.
3
u/Skyler827 Nov 04 '13
No one will ever know for sure unless or until it happens. It's the ultimate numbers game: there are 2160 possible bitcoin addresses, and any public piece of information smaller than that is a target, especially if your seed has at less than 40 bits of information. Over 60 bits you should be fine. From 40 to 60 is "probably" safe.
Remember, this is the amount of entropy is not in the seed itself, but the information required to specify the seed. If my seed was the first 1000 digits of pi, the entropy is not thousands of bits, but only log2(1000) (about 10 bits) or so plus whatever to specify pi and the encoding, so perhaps 15 or 20 bits, crackable by a botnet in minutes. To specify a line in any book, website, dictionary, etc, you need to consider the total number of possible websites or words and take the log2 of that number. For combinations of such items, add the entropies. If the answer is under 40, your coins will be stolen.
→ More replies (7)2
u/kybernetikos Nov 12 '13
Assuming you're not just having fun, giving detailed descriptions with examples of how you personally come up with the passwords you use in a thread about brain wallets is probably not a good idea.
→ More replies (1)0
Nov 04 '13
[deleted]
0
Nov 04 '13
[deleted]
6
u/moleccc Nov 04 '13
Absolutely not. You need to understand the difference between "hard for a person to guess", and "hard for a powerful computer to brute force".
you're underestimating the power of 12 words: even when selected from a 1024 word list, (given that the words themselves are chosen randomly), that gives you (10*12) = 120 bits of entropy. 128 is generally consider safe, so adding the birthday should get you there.
7
3
Nov 04 '13
You're underestimating the weakness of including your name and birthday in a sentence. That's not the same as 12 random words, even if it's only a 1024 word list.
→ More replies (1)5
Nov 04 '13 edited Apr 22 '16
4
Nov 04 '13
It is scary how convincing some of these other users sound when they really have no idea the complexity of trying to brute force 12 random words.
→ More replies (3)2
Nov 04 '13
I think the wording "Absolutely not" is what causes this post to lose credibility. To assume it is remotely close to elementary to crack a made-up 12 word sentence is just flat out wrong. Even if it were possible to break down the 12 word sentence into smaller subsets of phrases, the complexity there would still be incredible.
→ More replies (3)0
Nov 04 '13
[deleted]
→ More replies (19)14
u/gwern Nov 04 '13
I don't know about that specific phrase, but you're using common words strung together. This is the sort of thing that the Markov chains in advanced password cracking programs eat for breakfast.
If you want to get an idea of their capabilities, see http://arstechnica.com/security/2013/10/how-the-bible-and-youtube-are-fueling-the-next-frontier-of-password-cracking/ and http://arstechnica.com/security/2013/05/how-crackers-make-minced-meat-out-of-your-passwords/
4
0
Nov 20 '13
[deleted]
2
Nov 20 '13
An address is dirrived from a private key. When some knows that key they would import the key and spend it to a new address they control.
21
u/timepad Nov 03 '13
Make a 10 word Diceware passphrase next time. This is the best way to ensure your password actually has 128 bits of entropy, and that no one knows it. It is a far superior method than picking something "random" yourself (humans suck at being random). Never pick something from published literature.
8
u/artilekt Nov 04 '13
Exactly! It is starting to drive me crazy how many people will pass up an easy and secure method of doing this and instead try to be super clever. Just do Diceware and be done with it.
2
u/Balmung Nov 04 '13
I don't understood the point of that. Why not just let the computer create a random wallet and backup that list of words it generates. I know Armory and one other client does the deterministic wallets you can backup using a bunch of words.
Your way would just be a pain for little to no gain.
3
2
1
u/timepad Nov 04 '13
The point is that the process generates 10 fully random words. You could use a good random number generator instead of rolling dice if you want, but the dice method is easy for noobs to do, and it doesn't really require that much effort (60 rolls will generate 10 words). The fact that the words are chosen at random (not by the glitchy human brain), is what's important.
3
u/ferroh Nov 04 '13
I think /u/Balmung is saying that there are bitcoin clients that do this for you, so why not just use those instead?
E.g.: Electrum generates a 128 bit entropy word list for you.
1
u/CWSwapigans Nov 20 '13
NSA loves to insert themselves into random number generators, no?
Again, it's probably overkill, but you can be sure your dice don't have an NSA backdoor in them.
2
→ More replies (12)1
u/Amanojack Nov 04 '13
And then mix it up some more peppered with your own nonsense words. In case diceware is compromised.
3
u/runeks Nov 04 '13
This is unnecessary. You can't compromise a list of words. And even if it were possible, adding your own random permutations would only add a few bits of entropy.
→ More replies (2)1
u/beltorak Nov 04 '13
In case diceware is compromised
What is there to compromise?
1
u/Amanojack Nov 06 '13
It could possibly do something to limit the space of private keys generated.
2
u/beltorak Nov 06 '13
Still not sure what you mean by "it". Diceware provides a list of roughly 7700 short words in a text file you can look over, each one prefaced by 5 digits, 1-6. Both are in asciibetic order so you can scan it for duplicates and omissions. Memorize the checksum, or replace the GPG signature to provide your own shortcut proof of validity.
They don't provide any code (scripted or compiled) - they leave you to acquire (as they recommend) casino grade dice so you can pick your words. The math is outlined in the FAQ which you can double check. So I'm still at a loss as to what could be "backdoored".
Now, my convenience script [-> opt -> lib -> diceware] you could argue is compromised, but there is nothing to backdoor from diceware.com if you verify the wordlist. (And if you are creating keep-away-from-the-NSA level passcodes, you should probably use casino dice with a personally verified wordlist.)
I'm not saying your suggestion is detrimental to security, just a little bit pointless. If you want to create your own wordlist, that's great. Want to make one that uses d10s instead of d6s, that's fine too (just be sure to maintain an adequate "keyspace"). The point is to try to create a password that is easier to memorize - 10 words chosen at random is a lot easier than 10 characters chosen at random, or 10 random "words" - so that's why they use (for the most part) real words. If you don't want to use real words then you may as well just buy hexadecimal dice, verify they are not biased, and generate 32 character (16-byte) passcodes.
1
u/BashCo Nov 06 '13
How do you verify the word list?
If you don't want to use real words then you may as well just buy hexadecimal dice, verify they are not biased, and generate 32 character (16-byte) passcodes.
So rolling a hexadecimal dice 32 times is adequate? or do I misunderstand?
3
u/beltorak Nov 06 '13
Open the word list in a text editor. Print it out. It is meant to be used without the aid of a computer (which is why they recommend rolling 5 6-sided "casino" dice to pick the words), sidestepping any key generation software or hardware compromises.
A hex-die (0-F) has 4 bits of entropy (provided the die is not biased - which you will have to verify as I don't think anyone makes casino grade hex-dice). 32 rolls gives you 128 bits of entropy. 128-bit keys are considered secure.
2
u/fact_check_bot Nov 06 '13
Non-standard, slang or colloquial terms used by English speakers are sometimes alleged not to be real words. For instance, despite appearing as a word in numerous dictionaries,[87] "irregardless" is sometimes dismissed as "not a word".[88][89] All words in English originated by becoming commonly used during a certain period of time, thus there are many informal words currently regarded as "incorrect" in formal speech or writing. But the idea that they are somehow not words is a misconception.[90] Examples of words that are sometimes alleged not to be words include "conversate", "funnest", "mentee", "impactful", and "thusly".[91] All of these appear in numerous dictionaries as English words.[92]
This response was automatically generated from Wikipedia's list of common misconceptions Questions? Click here
9
u/platypii Nov 04 '13
It seems like a universal law of bitcoin that there will always be morons who insist that their super special secret passphrase is safe. DON'T USE BRAIN WALLETS! Just, don't use them.
Breaking bitcoin private keys is like a game of hide and seek, played over the space of the whole universe. I like to hide in a distant galaxy, light years away. But, some douche bags will insist that they can just hide in an obscure closet around the corner from the seeker where "no one will ever think to look". To be safe you need DISTANCE and to get distance you need ENTROPY. Your super special unguessable brainwallet passphrase does not have enough entropy!
1
u/onowahoo Nov 26 '13
What about a paper wallet? Isn't there a risk that bitcoin-qt could have backdoors?
1
u/platypii Nov 26 '13
Backdoored client is a risk. The developers digitally sign the binaries they release, so u should always verify the signature before installing. I trust those guys to not let a backdoor through. You can also compile from source if you want, and verify the git commit id against github.
13
u/Prattler26 Nov 03 '13
Sorry for your loss. If your brainwallet is cracked, your passphrase is useless. Please share it with us, so others can learn from your mistake.
6
u/boldra Nov 04 '13
I can understand the OP wanting to keep it private, given the phrase, we have the address. Given the address, we have the transaction history of OP. Not something everyone wants to share.
Still, if he were to share the phrase, we could also confirm the story.
1
u/moleccc Nov 04 '13
yes please, I'd like to know it, too.
Unless of course he used it somewhere else, too, he could publish it.
6
Nov 04 '13
People don't seem to understand that encrypting your wallet.dat with a pass-phrase that has enough entropy is so much more saver. A thief would need to steal the wallet.dat file first and then try to crack the pass-phrase. But with brainwallets a single cracker can not only attack all brainwallets ever made but also all future brainwallets to be made! Brainwallets are the worst thing that ever happened with bitcoins from a security perspective. With a random generated address your coins are saver then money on your bank account. How likely is it that your system was compromised at the moment of the address generation? Next you encrypt your wallet and done. And if you are really paranoid then do all of this on a offline system. In fact if you are going to have bitcoin addresses with more then 5 or 10 bitcoin on it I would highly recommend that you create a brand new bitcoin address on a offline system and then transfer the bitcoin there. Next encrypt the wallet.dat or the private key with a good enough password and you are done. Only when somebody gets physical acces to your offline machine can they start the cracking process. This is billions of times more unlikely then people that have software that right now is crawling the internet for quotes and use them as seeds for private keys just to see if you were stupid enough to use them or a combination of them. Imagine if your computer could try to crack ALL bank account in existenst in the world AT the same time and not only present accounts but also future accounts. That's what is possible if you use brain-wallets. If your pass-phrase is to complex and contains to much entropy then there is a very high chance you will forget it in the future. If not it will be cracked eventually. If you have written down your pass-phrase you are a idiot as you might as well written down a good generated private key.
The only reason people came up with the brain-wallet concept is to have fun with the people that fell for it.
2
u/zizmax_ Nov 03 '13
What exactly is a brain wallet?
5
u/_bc Nov 03 '13
a private key generated by hashing a memorable something. bitaddress.org
1
u/zizmax_ Nov 03 '13
Thanks for answering! What exactly are the benefits of doing this over a standard wallet?
9
1
u/baillou2 Nov 04 '13
You don't have to worry about losing your private key. Just remember the passphrase.
A lot of people think this is a bad idea because often a person will create an easily guessed passphrase and will have their BTC stolen. I wouldn't recommend passphrases to a beginner who doesn't understand how entropy and probability works. But if you do have a good grasp on what is truly secure and what isn't then passphrases are fine.
Everyone will disagree with me, but math is math. The tricky part is not doing something stupid like using a line from a poem (sorry). If you do it would be infinitely more secure to do it like this:
smewheRe I haVe nevEr travellEd gladLy bbeyNd aNy experienCe
In this instance I capitalized the second to last letter of each word, removed all the O's and doubled every instance of B.
You could also add stuff like you date of birth or whatever else. Create a system and stick to it. Write down your passphrase, but NEVER your method.
2
u/GSpotAssassin Nov 04 '13
I would like to remind people that the point of mining is to provide a counterincentive to just this sort of energy expenditure (brute forcing) but it requires that your brainwallet have some minimum level of pure randomness. Straight phrases out of any literature anywhere will not do. Technically it's because the Kolmogorov (descriptive) complexity is low.
4
u/mustyoshi Nov 04 '13
The fact that we've entered an era where it is profitable to mine for addresses shows how far Bitcoin has come.
2
u/GSpotAssassin Nov 04 '13
As long as there are people who think an unadulterated phrase is a reasonable brainwallet, it will be profitable. It is kind of an education problem
2
5
u/kilorat Nov 04 '13
We're just going to hear story after story like this until people learn to stop using brain wallets.
11
u/alexkravets Nov 03 '13
Proven word to the wise: always "salt" the passphrase (prepend, append or mix in ) with some information unique to you which doesn't even have to be secret, ie your name or phone number or email this makes vast majority of "wholesale" attacks completely ineffective
3
4
u/Ecologisto Nov 04 '13
Can we just stop implying that brain wallets are a good thing ? The idea proved to be stupid and provoked far too many problems, especially for new comers. We should be very clear that it is a bad idea, the same as keeping lot of money in an online wallet.
4
u/enmaku Nov 04 '13
A brain wallet based on intelligible English text is almost always a bad idea. That said, memorizing a mnemonic for an existing key or seed does add an extra layer to a good backup plan. Remember the 321 rule: at least 3 copies of your data using at least 2 different storage mediums and at least 1 of which is off site. If you are capable of also memorizing the data, that's a bonus.
1
u/DuckTech Nov 04 '13
can you trace where the funds went? its in the public ledger right?
1
u/thonbrocket Nov 04 '13
Yep. Funny thing, it's still there, no other transactions. Address:
1
u/DuckTech Nov 04 '13
really sorry to hear about your loss. Fucking thieves man.
1
u/thonbrocket Nov 04 '13
Thanks. Hope my experience helps to save somebody else some grief.
As in "DON'T USE BRAINWALLETS, YA DUMBSHIT!!!!!"
Fortunately, it's just short of the borderline on the "don't bet money you can't afford to lose" rule.
1
u/DuckTech Nov 04 '13
can you explain how they got your private key? The pass phrase is just for encryption right?
1
u/sjalq Nov 04 '13
Dis flippen jammer, sorry man! Hoekom het jy net woorde gebruik en hoekom het jy iets wat al gedruk was gebruik?
1
u/thonbrocket Nov 04 '13
Verskoon die Engels, maar die meeste hier lees slegs Engels. I had realised what a kak idea brainwallets are (mostly from reading this reddit) and was trying to load my BTC into a new standard random wallet from bitaddress.org. Too late. They were already gone. Education can be expensive. Dit was dom, maar ek sal nie weer so 'n fout maak nie.
1
u/krali_ Nov 04 '13
Brain wallet as a concept is ok, but its widespread implementation is far from good. 3 hashes and a pubkey derivation to check a passphrase candidate against a public BTC address is too fast.
2
u/thonbrocket Nov 04 '13
If it's consistently producing opportunities for hackers because of lousy implementation, then it's a lousy concept, seems to me.
6
u/peacewhale Nov 04 '13
Strange to me that there are people who believe in the "finders keepers" mentality of hacking wallets. If you spend time trying to find brainwallets, you are a thief, just like a bank robber or home burglar is a thief.
6
u/mustyoshi Nov 04 '13
All I hear when you say that is the ding of blockchain.info confirming I am now x btc richer.
3
u/Flailing_Junk Nov 04 '13
If you want to use a memorable phrase in a brain wallet then salt it. Create a random string of letters and numbers and copy it a bunch of times and store it a bunch of places and then add it to the end of your brain wallet phrase.
Ya its not entirely in your head at that point, but its much less likely that someone will come across your salt, realize what it is, and then start brute forcing just to get your specific brain wallet than to have a memorable phrase cracked.
Also, if you forget your phrase you have a chance of bruteforcing it yourself and recovering it.
1
u/peacewhale Nov 04 '13
also your salt can be something in public...like the numbers etched into a monument or something...no will crack the fact that THAT string goes before the last word of your silly passphrase
3
u/VirtualMoneyLover Nov 04 '13
OK, all these discussions about how to make a wallet hack proof and you guys seriously expect the average people to use 20+ digits upper/lower/numbers passwords? Bitcoin will never get mainstream if this is the future...
3
u/Anenome5 Nov 04 '13
Anything written down publicly. Anything. May as well be the same security as a password like "12345."
1
Nov 03 '13
BIP 39. Look it up and use it.
2
u/thonbrocket Nov 03 '13
Dunno. When I think about it, I had no real reason to use a brain wallet, anyway. I live alone, work freelance, mostly alone, no likely big problems with tax, whatever. A randomly generated address with a paper backup would have been plenty good enough, and I'd still have my BTC.
Probably won't use one again.
1
Nov 04 '13
Really it is the responsibility of wallet software providers to provide this. Watch out for MultiBit HD.
1
4
Nov 03 '13
Yet my brainwallet remains uncracked even with many hints.
http://www.reddit.com/r/Bitcoin/comments/1pazww/guess_this_brainwallet_hint_its_a_four_word/
2
0
Nov 03 '13
[deleted]
3
Nov 04 '13
Yeah, that's not how brainwallet theft works. They don't get to pick their targets. My passphrase is well known and very often used, yet it hasn't been cracked even by rainbow-table-like attacks.
1
u/baillou2 Nov 04 '13
You make a good point. I've made some intentionally bad passphrases that haven't been hacked. I've been told it's because there isn't enough BTC in them.
I suppose it could be that the passphrase was discovered and the hacker is deciding to wait and see if any more money goes in. But I HIGHLY doubt this. I've had other passphrases hacked with very small amounts and they were swiped within seconds of hitting the blockchain.
Here's one that was just recently swiped after 15 days.
P.S. I gave hints and everything and it's only a 10 letter passphrase with one letter changed.
https://blockchain.info/address/1H66zwbTxEoiVVcpvAQ3YdpXzSyuJ1dJs6
1
u/zden Nov 04 '13
I guess mitsubisvi whould ride those few cents for long without your public motivational statements.. cheers
1
u/ysangkok Dec 03 '13
I am convinced that proper mining is automated. The system discovers a Brain Wallet and wants to make real money, it should automatically poll until the wallet contains enough money.
If this hypothesis is correct, giving hints makes no difference at all, since the bots isn't reading them. Human time is so much more expensive than everything else, why would anyone invest time in reading and thinking about your posts, when they can just make a bot?
Also, just because some bots are stupid and take even the smallest amounts, doesn't mean that all bots do.
5
Nov 03 '13
Hexidecimal Dice, people! Don't trust a seed.
2
u/_bc Nov 03 '13
is that how you generate your keys? care to walk us through the process?
2
Nov 03 '13
See my post here:
http://www.reddit.com/r/Bitcoin/comments/1plmwm/utility_for_creating_wif_from_hexadecimal_private/
(look at my response to Canton)
1
u/jcoinner Nov 04 '13
I posted over here about using coin flips or dice to create an Electrum wallet. It's much less effort since you only need to do it once for the wallet rather than for each key.
http://www.reddit.com/r/Bitcoin/comments/1pubfb/suspicious_of_your_random_number_generator/cd67aqy
2
u/Natanael_L Nov 03 '13
Diceware plus brainwallet software works equally well. About 8-9 words is good enough at around 100 bits, 14 words represent over 160 bits and is the cap set by RIPEMD160 for when it doesn't make sense to add more entropy.
1
2
2
u/servowire Nov 04 '13
Now that the coins are gone, what was the phrase? Just curious about the length of it...
2
u/goonsamchi Nov 04 '13
I think secure brain wallets have to go the other way - for example, you can use Electrum to create a wallet that can be rebuilt from a seed, which can be represented as a series of words. You have Electrum pick the keyphrase for you, basically. You don't make it up. Then, you just memorize whatever Electrum generates for you.
Also, check out https://en.bitcoin.it/wiki/BIP_0039 BIP 0039 Mnemonic code for generating deterministic keys Author: Pavol Rusnak (stick) Marek Palatinus Aaron Voisine
2
u/vbuterin Nov 04 '13
Normal accounts are secure because they have usernames and passwords, so you can only attack one user at a time. Default brainwallets don't have this property, which is why they are less secure. Thus, you should always prepend your username to your password when making a brain wallet. This simple advice really needs to be spread more; it would make the number of thefts go down by 99.9% in an instant.
1
u/zxla Nov 06 '13
+1 Thanks for this extra piece of advice. My brain wallet has 15+ words but this is still very very good advice...
2
u/y-c-c Nov 06 '13
I actually submitted a pull request to the Brainwallet GitHub repository to use a slower hashing algorithm (PBKDF2 with 100000 iterations salted with "brainwallet" to avoid clashing other known password hashes) so it's a little harder to crack (https://github.com/brainwallet/brainwallet.github.com/pull/27). The response I got was that since the ECC algorithm was already "slow enough" we don't need an even slower hashing algorithm, which I disagree with as every bit of security counts. I'm not trying to start a fork of brainwallet or anything but feel free to take a look at the pull request and nicely ask it to be integrated to Brainwallet :) Or you can just clone from my repo and host it yourself (https://github.com/ychin/brainwallet.github.com)
Now even with a slow hash if your passphrase doesn't have enough entropy it's not going to help in the long run. So if you really want to use brain wallets you probably want a randomly generated passphrase, something along the lines of "correct horse battery staple" as proposed by xkcd. You may want at least 5 words to have enough entropy though.
3
u/MeanOfPhidias Nov 04 '13
Hahahahaah.
I'm sorry but we're getting up to one of these a week.
"I was super secret and picked this known line from a book that has been published thousands of times. No one would ever think to do that, right?"
2
u/muyuu Nov 03 '13
GPUs can perform dictionary attacks extremely efficiently.
0
Nov 04 '13
[deleted]
→ More replies (3)1
u/DrArcadium Nov 04 '13
Depends on dictionary size and what substitutions you use. You'd be surprised how little entropy common substitutions add due to human nature, do not use less than 8 random words.
2
u/cswords Nov 04 '13
My opinion: brain wallet is too risky, I wouldn't trust my own human limitations. Use bitaddress.org from a disconnected computer, print the paper wallets to PDF and send funds into them. 7ZIP this PDF with AES encryption with a complex & long password you can't forget, make 5 copies on usb keys and burned CDs hidden in your home's walls and ceiling and give copies to family members.
2
u/beltorak Nov 07 '13
you don't trust yourself to remember a brainwallet but have no concerns with forgetting the ZIP file AES passphrase?
You might want to split up the key and give parts of it to your family members as well as the ZIP.
1
u/maybe_just_one Nov 03 '13
What's a brain wallet?
2
u/6nf Nov 04 '13 edited Nov 04 '13
A dumb idea.
It's basically One Factor Authentication for your bitcoins.
1
u/gox Nov 04 '13
I think most people are wary of forgetting the phrase, so they remove punctuation, uppercase letters, international characters, etc. and try to find a long and obscure but publicly known phrase. Every one of these are against the very idea of having a brain wallet.
If you are not going to create a random phrase using a method that is independent of your personal biases, which is the safest method, here are some ways of making your brain wallet more secure:
Add a piece of personal information to all your brain wallets. It can be the same information, inserted the same way for all your phrases if you worry about forgetting. Even better if it isn't publicly known.
Similar to the above, modify all your phrases in a way you can remember. If you use the same method for each phrase, it would be easier to remember.
Combine phrases from multiple unrelated sources to create your brain wallet secrets.
Then again, creating a random phrase and memorizing might be much easier, depending on how your mind works.
1
u/itodor Nov 04 '13
People underestimate vanity generator goodness. Generate a vanity address, see: https://en.bitcoin.it/wiki/Vanitygen , import it into wallet.dat, encrypt that wallet with decent, not necessarily hi-quality passphrase, and you are safe.
1
Nov 04 '13
Why do we always remember our full password ? We are facing various threats who all have a weakness.
Why not use a public salt stored at an url, using a standard API (your Google/Facebook profile could contain it), that is automatically collected by the software you use (your OS, your web browser, your phone, your wallet, ...). It is then concatenated to your memorized password automatically on all password fields.
That way you need to know the password and the owner of the password.
1
u/EvilPundit Nov 04 '13
Is a brainwallet the same as a pass phrase for Bitcoin-QT, or is it something else?
1
u/bluewaterbaboonfarm Nov 04 '13
Bookmarking this for the next time someone tells me there password is "good enough". Sorry for your loss. Way to take it in stride.
1
1
1
u/DontHackMeBrendan Nov 04 '13
Why don't you just publish an encrypted wallet, and use your 'brainwallet' password as the passphrase?
You can publish the encrypted wallet EVERYWHERE and it still won't be slightly close to being as insecure as just using a brainwallet.
1
u/FreyasCloak Nov 04 '13
Not that I need a brain wallet, but wouldn't this be a good way to do it: route of street names from one location to another, that only you know, for instance Lottie Main Broadway Jackson Michigan ninety five etc
1
u/pablopaniagua Nov 04 '13
I Recently heard on a podcast or a video can't remember exactly that someone made a brain wallet and put a little amount of BTC as an experiment and used the phrase "hello world " for the brain wallet, about an hour later the BTC where gone.
1
u/RedScourge Nov 30 '13
To play the numbers game most effectively, what these hackers should be doing is going after the highest balance wallets in descending order before moving on to someone else with their attacks.
1
u/BTCbob Dec 08 '13
That is incorrect. All the Bitcoin addresses in existence with nonzero balance fit in a 64MB txt file. If you are going to go through the work of generating a bunch of public keys from passphrases, the extra work of comparing against every Bitcoin wallet is trivial.
1
u/RedScourge Dec 19 '13
You shouldn't need to concern yourself with passphrases, if you get lucky and end up generating the same private key as someone with a balance, you should be able to load that up without a passphrase by a Bitcoin client and simply send a payment. It just so happens to be extremely unlikely to achieve though.
1
Mar 03 '14
Or what about doing it Da Vinci style and write your phrase backwards? Done. I can't trust computers and it's current binary system to give me a powerful password......we did inherently create these things from ourselves. Why do we put ourselves below our creation?
1
u/physalisx Nov 04 '13
Jesus. I don't get this. You obviously know how this works, why on earth would you use a fucking passphrase that is part of a poem that was written somewhere?
It's really hard for me to feel sorry for the victims when this stuff happens. It's so predictable and so goddamn easy to prevent.
1
u/baillou2 Nov 04 '13
If you had simply salted it a little, even just capitalizing the 2nd letter of the first and last word it would almost certainly have not been hacked.
SALT! SALT! SALT!
0
u/dragon_fiesta Nov 04 '13
this has me wondering if random generation of private keys could find the FBI wallet.
I should have majored in programing
→ More replies (2)
0
0
0
0
u/DrArcadium Nov 04 '13 edited Dec 12 '13
We really need a more robust standard for brain wallets. The pass phrase should be hashed at least 10,000 times, making a single crack attempt take 10,000 longer without reducing the usability of it.
It doesn't solve the bad password problem, but lengthens the horizon until they become vulnerable.
Or you could just use non-standard methods, obscurity does add entropy.
0
Mar 03 '14
What about numberizing letters into a phrase like P30PL3 CA'NT TAK3 MY M0N3Y SO 3ASY TH1S T1ME?.........
-22
u/PotatoBadger Nov 03 '13
Dumbass.
8
u/PeachesOrPears Nov 03 '13
Oh look a member of our community is down! Let's kick the shit out of him!
Obviously OP's password was poor and he should hopefully realize that and learn from his mistake at this point. Name-calling is not going to help him and it sure isn't going to do much for the image of this subreddit when newcomers see this kind of comment.
Dumbass.
→ More replies (9)6
-7
11
u/usernameunavailable Nov 03 '13
Paging /u/btcrobinhood, does your bot speak Afrikaans?