Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to steal Bitcoins that are protected by weak passphrases

palkeo.com

Post reply on HN
Print view View original

61–70 of 97 posts

Re: How to steal Bitcoins that are protected by weak passphrases

#61

Post by cheesemunger »

lolbrainwallets wrote: post #52
cheesemunger wrote: post #46

Earlier quoted context omitted.

Here you go: http://i.imgur.com/XmOqvvW.jpg I have a few more but they are even more confusing. Red nodes are brainwallets and blue nodes addresses that brainwallets transfer to. You will notice the massive cluster on the left, that is the 'researcher' who is actively probing the network. The rest are standard brainwallet transactions and thefts. The big red dot is a bug :P Hope that was useful

I think the cluster at the end of July/beginning of August of 2013 was me. I am not entirely sure because it was during BlackHat/defcon and I was drunk. Was a few thousand sampled from the rockyou list? Post a pgp key I have a question for you.

If you are referring to the big cluster, that time frame doesn't quite match up but feel free to message me. http://pgp.mit.edu/pks/lookup?op=get&search=0xADC50AF9F559FA...

Re: How to steal Bitcoins that are protected by weak passphrases

#62

Post by Jonathan_Swift »

I don't really know but speculate that Mt. Gox' receivership may well have nothing to do with weaknesses in the BitCoin cryptosystem.

- Magic the Gathering's BitCoin Cookbook http://www.warplife.com/tips/finance/money/bitcoin/mt-gox/fo...

tl;dr: Forensic Accounting is the way the Feds busted Al Capone for tax evasion; they never did pin a murder rap on him.

Even if no one is cooking the books a shop like Mt. Gox needs Forensic Accountants anyway, because someone could always have made an honest mistake.

I myself Found Religion the day I decided I'd grown weary of a ten-cent error in my quickbooks. I required eighteen hours to clue in to that it was two separate errors that totalled ten cents, as well as to locate the actual errors.

(Now I use GnuCash. There's a damn good reason for double-entry accounting; GnuCash uses it but Quicken and QuickBooks do not!)

Re: How to steal Bitcoins that are protected by weak passphrases

#63

Post by Bootvis »

enscr wrote: post #33
sp332 wrote: post #30

Earlier quoted context omitted.

With 2FA, the string changes each time you log in.

There's a finite probability of landing on the combination of login+password+2FA-string at any given instance.

Finite and positive ;)

Re: How to steal Bitcoins that are protected by weak passphrases

#64

Post by Cthulhu_ »

cheesemunger wrote: post #46
thesimpsons1022 wrote: post #35

Earlier quoted context omitted.

I am interested :D

Here you go: http://i.imgur.com/XmOqvvW.jpg I have a few more but they are even more confusing. Red nodes are brainwallets and blue nodes addresses that brainwallets transfer to. You will notice the massive cluster on the left, that is the 'researcher' who is actively probing the network. The rest are standard brainwallet transactions and thefts. The big red dot is a bug :P Hope that was useful

Mmmm, graph porn <3

Re: How to steal Bitcoins that are protected by weak passphrases

#65

Post by lukifer »

sodastream wrote: post #60

Brain wallets should never be used. Even experts fail at picking phrases with enough entropy. Full stop. You should be very carefull with your Bitcoin. I would go with one of the zero trust multisignature wallets because I like 2factor and I don't like the idea of some malware taking the funds away at will when it finds a key in memory.

Warp Wallet has had a 20 BTC bounty on cracking an 8-bit alphanumeric password for a few months now, still unclaimed: https://keybase.io/warp

There are safe(r) ways to use a brain wallet, but it shouldn't be done without understanding the math and the risks. At the end of the day, redundant and physically secure paper wallets will always be the best option.

Re: How to steal Bitcoins that are protected by weak passphrases

#66

Post by ChuckMcM »

nadaviv wrote: post #21
nwh wrote: post #12

Oddly enough, the website brainwallet.org which is used to create most brainwallets seems to be in itself malicious. nullc on reddit makes an interesting comment about it. > "Yes, the creator of Brainwallet.org got his start with password based private keys by cracking them. Here is an old IRC log extract I pulled out for someone else who didn't believe this: https://people.xiph.org/~greg/brainwallet.txt* More recent…

"correct horse battery staple" is a reference to xkcd [0]. Its not meant to be "random" and not meant to be used by anyone. I assume that people who send funds to that address are fully aware that anyone can access them. [0] http://xkcd.com/936/

It would be an interesting way to launder the block chain.

Re: How to steal Bitcoins that are protected by weak passphrases

#68

Post by mcherm »

enscr wrote: post #11

Slightly different Q : Say I have a private key with some money. All I have to do is type 'importprivkey ' in a new client and the money shows up (am I missing something)? If everyone randomly starts entering a couple of completely random combinations, is there a finite possibility that someone might simply steal a wallet? Is it like spinning a wheel of fortune? Found a very interesting analogy here : http://www.redd…

Yes, there is a finite probability of just guessing a very fat wallet via a random guess. But there is also a finite probability that a briefcase with a million dollars in it gets caught in a tornado and falls out of the sky onto your head.

I'm not sure which finite probability is larger, but I'm not holding my breath for either one.

Re: How to steal Bitcoins that are protected by weak passphrases

#69

Post by caf »

LocalPCGuy wrote: post #8
Aqueous wrote: post #4

Earlier quoted context omitted.

What about a high entropy set of 4 words for the passphrase? This should give you fairly decent security.

Not if those 4 words are in the dictionary. Crackers are definitely aware of this password generation technique and it isn't hard to run through 4 word combinations from a dictionary. In the end, the best password right now is a 16+ random password made up of uppercase letters, lowercase letters, numbers and symbols. Use a password manager to manage and store your passwords.

It depends on the size of your dictionary. If you want to run through all combinations of 4 words from a 131072 word dictionary you need to test 2^68 combinations.

Re: How to steal Bitcoins that are protected by weak passphrases

#70

Post by fiveturns »

enscr wrote: post #29

Conspiracy theory : Is directory.io phishing ? It is possible that people would try to find their private key on directory.io for fun. You can do that by jumping to the relevant page. Meanwhile, the servers at directory.io would cache the GET requests and blast through the handful of keys on that page. The site is likely generating the pages on the fly. You can type directory.io/ x : 904625697166532776746648320380374…

Author here.

Somebody did set up a website somewhere that allowed users to see if their private key was in the "database". It would jump them to the correct page, and, steal their private key in the process.

I didn't like them potentially stealing my revenue, so I implemented this feature myself. The pluses beside the private key are permalinks.

For example: http://directory.io/warning:understand-how-this-works!/5HpHa...

That's the private key in Bitcoin's importprivkey format.

I purposely didn't add a search box and named the URL's path to discourage its use.

http://directory.io/faq

(I don't actually check the logs)

Post reply on HN