How to steal Bitcoins that are protected by weak passphrases • Hacker News Board

Re: How to steal Bitcoins that are protected by weak passphrases

#21

Post by nadaviv » Sat, Mar 08, 2014, 7:16 PM UTC

nwh wrote: post #12

Oddly enough, the website brainwallet.org which is used to create most brainwallets seems to be in itself malicious. nullc on reddit makes an interesting comment about it. > "Yes, the creator of Brainwallet.org got his start with password based private keys by cracking them. Here is an old IRC log extract I pulled out for someone else who didn't believe this: https://people.xiph.org/~greg/brainwallet.txt* More recent…

"correct horse battery staple" is a reference to xkcd [0]. Its not meant to be "random" and not meant to be used by anyone. I assume that people who send funds to that address are fully aware that anyone can access them.

[0] http://xkcd.com/936/

Re: How to steal Bitcoins that are protected by weak passphrases

#22

Post by dutchbrit » Sat, Mar 08, 2014, 7:18 PM UTC

Directory.io first of all does not contain all private keys - it's more of a joke.

Anyway, if a brain wallet has a weak password, you have quite a good chance of cracking it easily. But you have to know that it's a brain wallet. But using a brain wallet is just silly.

Also, don't forget cracking private keys using weak signatures, although good luck finding someone who has a wallet and a weak signature...

http://www.nilsschneider.net/2013/01/28/recovering-bitcoin-p...

EDITED - I didn't read the post correctly, my apologies.

Re: How to steal Bitcoins that are protected by weak passphrases

#23

Post by nwh » Sat, Mar 08, 2014, 7:21 PM UTC

nadaviv wrote: post #21

nwh wrote: post #12

Oddly enough, the website brainwallet.org which is used to create most brainwallets seems to be in itself malicious. nullc on reddit makes an interesting comment about it. > "Yes, the creator of Brainwallet.org got his start with password based private keys by cracking them. Here is an old IRC log extract I pulled out for someone else who didn't believe this: https://people.xiph.org/~greg/brainwallet.txt* More recent…

"correct horse battery staple" is a reference to xkcd [0]. Its not meant to be "random" and not meant to be used by anyone. I assume that people who send funds to that address are fully aware that anyone can access them. [0] http://xkcd.com/936/

I doubt it, they've sent almost 5BTC over 2300 transactions to that address so far. I personally know somebody who got caught out with it, and another with the static change address in the transaction view of the same site.

Re: How to steal Bitcoins that are protected by weak passphrases

#24

Post by enscr » Sat, Mar 08, 2014, 7:22 PM UTC

dutchbrit wrote: post #22

Directory.io first of all does not contain all private keys - it's more of a joke. Anyway, if a brain wallet has a weak password, you have quite a good chance of cracking it easily. But you have to know that it's a brain wallet. But using a brain wallet is just silly. Also, don't forget cracking private keys using weak signatures, although good luck finding someone who has a wallet and a weak signature... http://www.…

Can't vouch for what's on directory.io but it goes as far as http://directory.io/9046256971665327767466483203803742801002... & beyond... have you tried paging through?

https://en.bitcoin.it/wiki/Private_key

"In Bitcoin, a private key is a 256-bit number, which can be represented one of several ways. Here is a private key in hexadecimal..."

Edit : The bitcoin private key being a number was in response to your redacted comment.

Re: How to steal Bitcoins that are protected by weak passphrases

#25

Post by gcb0 » Sat, Mar 08, 2014, 7:23 PM UTC

cheesemunger wrote: post #9

I have spent quite a lot of time (~250h) on this problem as part of my dissertation and found ~18k brainwallets. Most of the 10k brainwallets found by the author have probably been made by another 'researcher' who is actively probing the network to look for thieves. There are many other similar analyses online which have better and more interesting results than this. Edit: I can upload some rather large and confusing…

Just upload the dissertation when it's done. We all have ADD :)

Re: How to steal Bitcoins that are protected by weak passphrases

#26

Post by palkeo » Sat, Mar 08, 2014, 7:25 PM UTC

dutchbrit wrote: post #22

Directory.io first of all does not contain all private keys - it's more of a joke. Anyway, if a brain wallet has a weak password, you have quite a good chance of cracking it easily. But you have to know that it's a brain wallet. But using a brain wallet is just silly. Also, don't forget cracking private keys using weak signatures, although good luck finding someone who has a wallet and a weak signature... http://www.…

Of course directory.io is a joke :)

A private key IS a number : https://en.bitcoin.it/wiki/Private_key The one you shown was just encoded in base58 !

Re: How to steal Bitcoins that are protected by weak passphrases

#27

Post by [deleted] » Sat, Mar 08, 2014, 7:27 PM UTC

nadaviv wrote: post #21

nwh wrote: post #12

Oddly enough, the website brainwallet.org which is used to create most brainwallets seems to be in itself malicious. nullc on reddit makes an interesting comment about it. > "Yes, the creator of Brainwallet.org got his start with password based private keys by cracking them. Here is an old IRC log extract I pulled out for someone else who didn't believe this: https://people.xiph.org/~greg/brainwallet.txt* More recent…

"correct horse battery staple" is a reference to xkcd [0]. Its not meant to be "random" and not meant to be used by anyone. I assume that people who send funds to that address are fully aware that anyone can access them. [0] http://xkcd.com/936/

[deleted]

Re: How to steal Bitcoins that are protected by weak passphrases

#28

Post by kzrdude » Sat, Mar 08, 2014, 7:29 PM UTC

cheesemunger wrote: post #9

I have spent quite a lot of time (~250h) on this problem as part of my dissertation and found ~18k brainwallets. Most of the 10k brainwallets found by the author have probably been made by another 'researcher' who is actively probing the network to look for thieves. There are many other similar analyses online which have better and more interesting results than this. Edit: I can upload some rather large and confusing…

Please link to the better analyses!

Re: How to steal Bitcoins that are protected by weak passphrases

#29

Post by enscr » Sat, Mar 08, 2014, 7:29 PM UTC

Conspiracy theory : Is directory.io phishing ?

It is possible that people would try to find their private key on directory.io for fun. You can do that by jumping to the relevant page. Meanwhile, the servers at directory.io would cache the GET requests and blast through the handful of keys on that page.

The site is likely generating the pages on the fly. You can type directory.io/

x : 904625697166532776746648320380374280100293470930272690489102837043110636675

Re: How to steal Bitcoins that are protected by weak passphrases

#30

Post by sp332 » Sat, Mar 08, 2014, 7:40 PM UTC

enscr wrote: post #16

nwh wrote: post #14

Earlier quoted context omitted.

There's 2^160 different public keys, the chance of hitting one of this accidentally is so vanishingly small that it doesn't even warrant thinking about it. The improbability of this event is literally the basis of all cryptology; big keyspaces are difficult to bruteforce without unlimited resources and unlimited energy.

If you analyse it as probability it makes a lot more sense than intuitively thinking about it. A login & a password combination can also be seen as a unique string combination and so is 2FA i.e. a 3 string combination. Not really multiple levels of security mathematically.

With 2FA, the string changes each time you log in.