So... hunter2 is not ok?
Seven asterisks is a really shitty password.
For anyone that's confused, they're referring to http://bash.org/?244321
How to steal Bitcoins that are protected by weak passphrases
71–80 of 97 posts
Re: How to steal Bitcoins that are protected by weak passphrases
#72Conspiracy theory : Is directory.io phishing ? It is possible that people would try to find their private key on directory.io for fun. You can do that by jumping to the relevant page. Meanwhile, the servers at directory.io would cache the GET requests and blast through the handful of keys on that page. The site is likely generating the pages on the fly. You can type directory.io/ x : 904625697166532776746648320380374…
Directory.io is not phishing. The chances of someone finding an adress that has ever been used by anyone ever, (aside from people sending coins to the first one for fun) is impossible.
(I guess it's only a joke site.)
The problem is that some moron can enter his private key there, to see what the site says about it. Then if the owner reads the server logs, he can read the private key. To be clear, never ever never ever never ever put your private key in a random website.
I hope that most morons only know the public address (that is a hash of the public key), and don't know about the private key that is stored in a wallet. In https://www.google.com/search?q=site:Directory.io the numbers are too low, so they are probably only a few random keystrokes, not "real" private keys.
Re: How to steal Bitcoins that are protected by weak passphrases
#73Deterministically generating wallets is just dumb. It's the exact opposite of randomly generating wallets. We spend all this time on making things cryptographically secure and then mess it up by using a tiny subset of the keyspace. Why would anyone find this to be a good idea?
It's trivial to use a "large" subset of the keyspace if you have any clue whatsoever about information theory. Just pull ten words uniformly at random from a list of the 4096 most common, hash them, and you've got yourself a 120 bit key right there. (Or even hash them another 128 times to give yourself an effective 7 bits of extra security.)
However, obviously idiots who will pick a 2 word passphrase should not be encouraged to use a brainwallet.
Re: How to steal Bitcoins that are protected by weak passphrases
#74Re: How to steal Bitcoins that are protected by weak passphrases
#75Bitcoin wallets are surprisingly tricky to implement. Use a good one that a lot of others are using, not the edgy one. Don't try to customize your key pair, just use what's generated for you. Split the wallet you spend from from the one that has real money on it. Backup the real one with a paper wallet and keep that safe.
Re: How to steal Bitcoins that are protected by weak passphrases
#76Oddly enough, the website brainwallet.org which is used to create most brainwallets seems to be in itself malicious. nullc on reddit makes an interesting comment about it. > "Yes, the creator of Brainwallet.org got his start with password based private keys by cracking them. Here is an old IRC log extract I pulled out for someone else who didn't believe this: https://people.xiph.org/~greg/brainwallet.txt* More recent…
nullc on reddit == Gregory Maxwell
Re: How to steal Bitcoins that are protected by weak passphrases
#77Brain wallets should never be used. Even experts fail at picking phrases with enough entropy. Full stop. You should be very carefull with your Bitcoin. I would go with one of the zero trust multisignature wallets because I like 2factor and I don't like the idea of some malware taking the funds away at will when it finds a key in memory.
Warp Wallet has had a 20 BTC bounty on cracking an 8-bit alphanumeric password for a few months now, still unclaimed: https://keybase.io/warp There are safe(r) ways to use a brain wallet, but it shouldn't be done without understanding the math and the risks. At the end of the day, redundant and physically secure paper wallets will always be the best option.
I guess scrypt makes it much harder in memory requirements to bruteforce dictionaries and famose phrases/documents although still risky with keyloggers.
The most promising web wallet i've seen so far is https://greenaddress.it which seems pretty much like "Electrum" online but with two factor which in theory means a local keylogger can't steal your bitcoin.
Re: How to steal Bitcoins that are protected by weak passphrases
#78Earlier quoted context omitted.
I think the cluster at the end of July/beginning of August of 2013 was me. I am not entirely sure because it was during BlackHat/defcon and I was drunk. Was a few thousand sampled from the rockyou list? Post a pgp key I have a question for you.
If you are referring to the big cluster, that time frame doesn't quite match up but feel free to message me. http://pgp.mit.edu/pks/lookup?op=get&search=0xADC50AF9F559FA...
Thanks, will send you something a bit later.
Re: How to steal Bitcoins that are protected by weak passphrases
#79Earlier quoted context omitted.
Directory.io is not phishing. The chances of someone finding an adress that has ever been used by anyone ever, (aside from people sending coins to the first one for fun) is impossible.
(I guess it's only a joke site.) The problem is that some moron can enter his private key there, to see what the site says about it. Then if the owner reads the server logs, he can read the private key. To be clear, never ever never ever never ever put your private key in a random website. I hope that most morons only know the public address (that is a hash of the public key), and don't know about the private key tha…
> The problem is that some moron can enter his private key there, to see what the site says about it. Then if the owner reads the server logs, he can read the private key. To be clear, never ever never ever never ever put your private key in a random website.
You would think that the word "private" in "private key" would give them a clue... or do most people now not really understand the concept of privacy anymore?
Re: How to steal Bitcoins that are protected by weak passphrases
#80How does that site work which has every bitcoin address listed. Does it just generate those on the fly based on the page number?
Yes, I think so. It just couldn't have generated the list before, it's just not feasible.
FWIW, the footer says 'It took a lot of computing power to generate this database. Donations welcome: 1Bv8dN7pemC5N3urfMDdAFReibefrBqCaK;'.