Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I Stole a User's Siacoin

mtlynch.io

Post reply on HN
Print view View original

41–50 of 73 posts

Re: How I Stole a User's Siacoin

#41

Post by kyle-rb »

IanCal wrote: post #37
thefifthsetpin wrote: post #36

Earlier quoted context omitted.

He didn't just post the passphrase, he also posted this: "If someone figures it out, I will send you free sias" I'd call that a clear invitation/authorization for anyone to try to crack his passphrase.

Reasonable, but not an invitation to transfer the entire amount then setup an automated process to transfer any remaining amount to your own address.

I don't know, I think transferring it was the reasonable thing to do, rather than leaving it in the compromised wallet.

It's like if you find someone's (real) wallet, and you pick it up and contact the owner to ask where to drop it off. Rather than leaving it there and just telling the owner what street corner it's on.

Re: How I Stole a User's Siacoin

#42

Post by dacox »

dantillberg wrote: post #4

I often wish that password entry for things fully under your control (i.e. when there are no retry limits aside from brute computational power) would come with limited brute forcing support. Such password dialogs could just let you type your best effort, and they could use the things you type to inform the guessing process; you could fat-finger a character or two, and it would just take a moment longer to log in as i…

For UX this would be nice. However, many applications that encrypt locally (like KeePass, etc.) perform key stretching, which would make this take quite a long time.

Re: How I Stole a User's Siacoin

#43

Post by illumin8 »

sweettea wrote: post #33
illumin8 wrote: post #31

Earlier quoted context omitted.

My brother accidentally deleted his wallet.dat from Dropbox a few years ago - he had given it a random filename and encrypted it with GPG so it was unrecognizable to hackers (and apparently him as well). It had 1,000 BTC in it! He had received them from a generous Bitcoin contributor in the early days who said "here you go, hold on to it, it will be worth something someday." I still give him a hard time about his $3…

Did he try Dropbox support to see if they have a backup?

Oh yeah, completely exhausted that route - it was over a year before he realized it and way past their retention period...

Re: How I Stole a User's Siacoin

#44

Post by hyperpower »

logicallee wrote: post #12

This was an amazing story, but there are LOT more take-aways here!!! First of all, let's look at something: the burden of memorizing 29 words was SO great, that despite carefully writing it down and double-checking it, the user failed to memorize it or even come close: after trying 500 times, they could not tell that ionic was a different word from tonic. No doubt they had looked at each handwritten word very careful…

> (In a pinch you do log 2 by taking the log and dividing by the log of 2)

In a pinch it's easier to reason that since 2^10 = 1024, 2^11 = 2048, and 1626 lies between those two numbers, log_2 1626 is a bit more than 10.

Memorizing powers of two is useful for lots of quick mental estimation!

Re: How I Stole a User's Siacoin

#45

Post by r00fus »

tonyhb wrote: post #21
jancsika wrote: post #16

So what are both "ionic" and "tonic" in the same dictionary for a human readable entropy library?

EFF has a new wordlist which can be used for things like this. It focuses on phonetic and spelling differences across each word so that this doesn't happen, plus it prevents words from "duplicating" when you combine them (ie the two words `in put` and `input` being the same). https://www.eff.org/deeplinks/2016/07/new-wordlists-random-p...

This is awesome. I had no idea my EFF money was doing great things like this in addition to fighting for net freedom :)

Re: How I Stole a User's Siacoin

#46

Post by Taek »

logicallee wrote: post #12

This was an amazing story, but there are LOT more take-aways here!!! First of all, let's look at something: the burden of memorizing 29 words was SO great, that despite carefully writing it down and double-checking it, the user failed to memorize it or even come close: after trying 500 times, they could not tell that ionic was a different word from tonic. No doubt they had looked at each handwritten word very careful…

The 29 words is from a legacy mistake. It's 32 bytes of entropy plus 6 bytes of checksum. We had originally only wanted 16 bytes of entropy and 6 byes of checksum, but the types we had were all 32 bytes. We implemented it initially with 32 bytes and shipped before rewriting it.

It's been like that for almost 2 years now, and while 29 is a lot, you aren't going to memorize 17 words either.

The checksum is 6 bytes, and a laptop can verify maybe 100,000 tries per second. So checking for a mistake of 1 word out of 29 will take you maybe 0.5 seconds. 2 words will take 6.5 hours.

If you find one that matches the checksum, it would take maybe 30 minutes on an SSD to scan the blockchain and realize that it's the wrong seed even though the checksum is correct.

But at 6 bytes of checksum, you'd be unlikely to bump into an incorrect but valid seed having just 2 words incorrect.

These seeds are used precisely because they are easier to distinguish than alphanumeric randomness. In this case, 'ionic' and 'tonic' ended up being an unlucky word pair, but we will swap out the word 'tonic' for 'tonsil' I think and that should fix the confusion. (The library only reads the first three characters, so there will be no compatibility issues with this change)

Re: How I Stole a User's Siacoin

#47

Post by Taek »

hyperpower wrote: post #44
logicallee wrote: post #12

This was an amazing story, but there are LOT more take-aways here!!! First of all, let's look at something: the burden of memorizing 29 words was SO great, that despite carefully writing it down and double-checking it, the user failed to memorize it or even come close: after trying 500 times, they could not tell that ionic was a different word from tonic. No doubt they had looked at each handwritten word very careful…

> (In a pinch you do log 2 by taking the log and dividing by the log of 2) In a pinch it's easier to reason that since 2^10 = 1024, 2^11 = 2048, and 1626 lies between those two numbers, log_2 1626 is a bit more than 10. Memorizing powers of two is useful for lots of quick mental estimation!

12 words of 1626 characters is almost exactly 128 bits, which is what is typically accepted as cryptographically secure.

We added a checksum though and then grabbed 256 bits instead of 128, so the numerical alignment no longer applies sadly.

Re: How I Stole a User's Siacoin

#48

Post by Taek »

sp332 wrote: post #20
codys wrote: post #17

Earlier quoted context omitted.

The need for embedded some form of error correcting codes into readable keys like these is a really good point. While not the same, I'm reminded of the issue with etherium addresses where they've (after initially having no extra checking) started using mixed case to provide a checksum to detect incorrect entries. Otherwise, it's really easy to send coins to a very slightly different address due to a typo. With Saicoi…

It does have a checksum. That means error-correcting works just like in the article, by picking the nearest valid code. This could be built-in to the software.

It would take about 0.5 seconds of brute forcing for the library to figure out if you had gotten a word wrong, so that's actually reasonable.

Re: How I Stole a User's Siacoin

#49

Post by StavrosK »

tonyhb wrote: post #21
jancsika wrote: post #16

So what are both "ionic" and "tonic" in the same dictionary for a human readable entropy library?

EFF has a new wordlist which can be used for things like this. It focuses on phonetic and spelling differences across each word so that this doesn't happen, plus it prevents words from "duplicating" when you combine them (ie the two words `in put` and `input` being the same). https://www.eff.org/deeplinks/2016/07/new-wordlists-random-p...

That's fantastic. My only complaint is that none of the lists' lengths are a power of two, but that's easily fixed by truncating one.

Re: How I Stole a User's Siacoin

#50

Post by lend000 »

bubbabojangles wrote: post #3

I used to mine Bitcoin back in 2011 and I lost my wallet.dat file (through several stupid moves on my part). It's got approx 103 BTC in it, anyone is welcome to it, I've given up trying. https://blockchain.info/address/166BuLPWHUjqoqiYp5rGE3B5r5Am...

Any hints on how you generated you key/passphrase? Did you use Satoshi's original Bitcoin client? Will reward information which results in successful discovery :)
Post reply on HN