So is there any safe way to store bitcoins? It's getting kind of frustrating to not have a best practice.
Bitcoin Brain Wallets: A flawed, dangerous idea.
21–30 of 33 posts
Re: Bitcoin Brain Wallets: A flawed, dangerous idea.
#22This article misses the real flaw with the pass phrase; pass phrases aren't really 2^B (where B = bits obviously) entropy. They're D^N entropy where N = number of words and D = size of the dictionary. The OED has 171K words in it, so say you're using a 7 word phrase that's ~4.3 * 10^36 possibilities. In reality most people's vocabulary is no more than 60K words whch gives us 2.8 * 10^33.
If instead you use only 16 character password with no dictionary words (i.e. completely random or sufficiently randomized memorable words) you have 3.4 * 10^38 possibilities.
3.4 * 10^38 > 4.3 * 10^36 > 2.8 * 10^33
I think everybody should use what works for them, and pass phrases are easy to remember but they have the exact same trade off that using pure dictionary words does at shorter lengths; it's easier to crack.
Re: Bitcoin Brain Wallets: A flawed, dangerous idea.
#23This article misses the real flaw with the pass phrase; pass phrases aren't really 2^B (where B = bits obviously) entropy. They're D^N entropy where N = number of words and D = size of the dictionary. The OED has 171K words in it, so say you're using a 7 word phrase that's ~4.3 * 10^36 possibilities. In reality most people's vocabulary is no more than 60K words whch gives us 2.8 * 10^33. If instead you use only 16 ch…
A couple of problems. First off:
>If instead you use only 16 character password with no dictionary words (i.e. completely random) you have 3.4 * 10^38 possibilities.
You're confusing characters and bytes. If you limit yourself to what can be typed on a typical keyboard, you're looking at a set of 95 characters, not 256. That gives you 4.4E31 possibilities (or ~105 bits of entropy). If you limit yourself to what most password fields will accept, it's more like a set of 75 characters (optimistically), giving you 1E30 possibilities (~100 bits).
Secondly, I'm not sure the comparison is fair in terms of memorability. 7 words will fit easily in my working memory. 16 characters will not. If I have an exceptional working memory, I might be able to fit 10 characters in it, and suddenly we're down to 63 bits of entropy, compared to 77 bits for a 7 word pass phrase, even if we limit ourselves to a 2000 word dictionary. And committing those 7 words to long term memory is still going to be way easier than committing the random 9 character string.
Incidentally, 77 bits is very close to the 80 bits that NIST recommends for the strongest passwords. 63 is quite a long way off.
Re: Bitcoin Brain Wallets: A flawed, dangerous idea.
#24This actually misses the worst problem. Brain wallets are essentially unsalted. You can build a gigantic rainbow table once and then watch those addresses forever after. And you aren't attacking a single address at a time. You're attacking them all in parallel. Even if the expected time to crack one password is very long, the expected time to crack some password can be much, much smaller.
>This actually misses the worst problem. Brain wallets are essentially unsalted. You can build a gigantic rainbow table once and then watch those addresses forever after.
The phrases generated by passphra.se have 44 bits of entropy. That means your rainbow table has to be on the order of hundreds of petabytes. I have doubts that the attack you're proposing could be implemented in practice. If it were a problem, you could just tack on a few more words and take the table into the yottabyte range.
Re: Bitcoin Brain Wallets: A flawed, dangerous idea.
#25He talks about how the XKCD article password is commonly known as if this is worrying for some reason. But it's no surprise for anyone getting started with brainwallets who has gone to brainwallet.org and noticed that the default passphrase entered into their client side generator is 'correct horse battery staple'. The chance of you coming up at random with a phrase that is the default in a popular brainwallet genera…
>The chance of you coming up at random with a phrase that is the default in a popular brainwallet generator is so low as to not be worth worrying about.
1 in 2^44, in fact. Unlikely enough that if you tried once per millisecond, you'd expect it to happen only once in 550 years.
Re: Bitcoin Brain Wallets: A flawed, dangerous idea.
#26Completely agree with the article. Whether you realise it or not, what you want from a private key is lots of entropy. A simple pass phrase is easily cracked, a complicated one is hard to remember (and it needs to be remembered exactly). There may potentially be a small amount of middle ground here, particularly if your memory is very good, but what happens if you get dementia as you get older?. If you must use a pas…
So, you're wrong about the entropy in the pass phrase. XKCD goes into the math, and for a sufficiently long phrase, there's plenty of entropy. And yes he takes into consideration there's only so many English words.
I have had this conversation before, what is "sufficiently long"?.
Remembering 10 random words in order isn't that much easier than 10 random alpha numeric chars and symbols. The words might have some mnemonic value, but the point is, if you need entropy, don't mess about, use a real private key.
Re: Bitcoin Brain Wallets: A flawed, dangerous idea.
#27Excellent! The first of today's several Bitcoin threads! All board the fail train, next stop mom's basement leeching electricity with 20 badly set up graphics cards and fans.
> next stop mom's basement leeching electricity with 20 badly set up graphics cards and fans.
No one does that any more. The amount of computing power in the blockchain is impressive. FPGAs didn't last too long; people are using ASICs now.
It's a shame if all those farms of GPUs are wasted. I guess I should have looked on ebay for people selling them off cheap. Or maybe they're just being used for protein folding now.
It's interesting that by tying mining to value has driven people to create home clusters and now people have developed ASICs. It'd be cool if those could have some other use in future.
Re: Bitcoin Brain Wallets: A flawed, dangerous idea.
#28This actually misses the worst problem. Brain wallets are essentially unsalted. You can build a gigantic rainbow table once and then watch those addresses forever after. And you aren't attacking a single address at a time. You're attacking them all in parallel. Even if the expected time to crack one password is very long, the expected time to crack some password can be much, much smaller.
>This actually misses the worst problem. Brain wallets are essentially unsalted. You can build a gigantic rainbow table once and then watch those addresses forever after. The phrases generated by passphra.se have 44 bits of entropy. That means your rainbow table has to be on the order of hundreds of petabytes. I have doubts that the attack you're proposing could be implemented in practice. If it were a problem, you c…
Yes, but I'm highly confident that a significant fraction of users are not using passphra.se or similar.
They're making something up, and humans are extremely bad at generating high entropy that way.
Re: Bitcoin Brain Wallets: A flawed, dangerous idea.
#29Earlier quoted context omitted.
So, you're wrong about the entropy in the pass phrase. XKCD goes into the math, and for a sufficiently long phrase, there's plenty of entropy. And yes he takes into consideration there's only so many English words.
I have had this conversation before, what is "sufficiently long"?. Remembering 10 random words in order isn't that much easier than 10 random alpha numeric chars and symbols. The words might have some mnemonic value, but the point is, if you need entropy, don't mess about, use a real private key.
You realise that a 10 word Diceware passphrase is significantly stronger than a 10 character (alphanumeric + specials) password, right?
95^10 = 5.9873694e+19
7776^10 = 8.0828128e+38
Re: Bitcoin Brain Wallets: A flawed, dangerous idea.
#30Earlier quoted context omitted.
I have had this conversation before, what is "sufficiently long"?. Remembering 10 random words in order isn't that much easier than 10 random alpha numeric chars and symbols. The words might have some mnemonic value, but the point is, if you need entropy, don't mess about, use a real private key.
You realise that a 10 word Diceware passphrase is significantly stronger than a 10 character (alphanumeric + specials) password, right? 95^10 = 5.9873694e+19 7776^10 = 8.0828128e+38
Yeah and both are weaker than a truly random private key, I give up, it's only money after all.