Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Milk Sad Disclosure

milksad.info

Post reply on HN
Print view View original

61–70 of 133 posts

Re: Milk Sad Disclosure

#61

Post by sowbug »

ryanatdistrust wrote: post #41
codetrotter wrote: post #39

Earlier quoted context omitted.

This xkcd comic has been instrumental to me. I wrote a command-line utility a couple of years ago that I use myself regularly to generate secure and memorable passwords https://github.com/ctsrc/Pgen With this tool you can also see how many bits of entropy the passphrase generation settings you are using will result in. For example, generating a 5 word passphrase using the long wordlist pgen -l -n 5 will yield a passp…

It looks neat, I'll pass this along to the team and take a deeper look at it later.

Also generating a BIP39 seed from https://iancoleman.io/bip39/ and using as many words from the output as you want for your purposes.

Re: Milk Sad Disclosure

#62

Post by sowbug »

tedunangst wrote: post #44

Weird. I've been assured, repeatedly, that time seeded PRNGs are never used for crypto and it's not an issue worth addressing.

There is no single codebase for "crypto," so that would be an extraordinary assurance for someone to make. Even Bitcoin has many different compatible implementations of varying quality.

Re: Milk Sad Disclosure

#63

Post by MauranKilom »

tomjakubowski wrote: post #23
kmeisthax wrote: post #11

Reminds me of attacks people were running on 'brainwallets' a while back - i.e. wallets whose initial key material was just a passphrase you'd remember. The idea was that you could keep the passphrase stored nowhere and not have to worry about it being stolen by... well, any of the 10,000 things out there looking for cryptocurrency keys. Of course, there is no way in hell you can actually make the human brain store e…

You only need a phrase of twelve words from a 2048 word dictionary to have 128 bits of entropy. Twelve words is up to "Thy kingdom" in the Lord's Prayer, so certainly people are able to memorize twelve word phrases or even 24 word phrases without too much trouble. And English is a lot more than 2048 words - so you could probably use a shorter phrase and still be fine.

For reference, normal English writing has about 1 bit of entropy per character.

Re: Milk Sad Disclosure

#64

Post by astrange »

NelsonMinar wrote: post #9

"On Libbitcoin Explorer 3.x versions, bx seed uses the Mersenne Twister pseudorandom number generator (PRNG) initialized with 32 bits of system time." That's a hell of an amateur mistake to make. 50/50 odds whether it was incompetence or deliberate fraud. Maybe 80/20; that flaw is so simple anyone can attack it. Which apparently is happening right now. It's much better if your crypto library generates keys only you c…

Mersenne Twister is an attractive nuisance. It's complicated and insecure, but a CSPRNG can be done in a few lines of code.

I think people pick it because it has a cool sounding name.

Re: Milk Sad Disclosure

#65

Post by yieldcrv »

RustyRussell wrote: post #40

Worth noting: libbitcoin is an obscure project with an impressive name. In that it's not used by bitcoind or any wallets I know of: it's mainly of interest here because the book Mastering Bitcoin used it for examples.

there are a couple crypto programming youtube videos like that, remix IDE put up a warning at one point

its an interesting attack vector

provide educational resources with compromised examples

wait for dev or their users to deposit funds in the copy and pasted contract or dependency

long game, been wondering how well that worked

Re: Milk Sad Disclosure

#66

Post by kmeisthax »

ajross wrote: post #15
kmeisthax wrote: post #11

Reminds me of attacks people were running on 'brainwallets' a while back - i.e. wallets whose initial key material was just a passphrase you'd remember. The idea was that you could keep the passphrase stored nowhere and not have to worry about it being stolen by... well, any of the 10,000 things out there looking for cryptocurrency keys. Of course, there is no way in hell you can actually make the human brain store e…

> Of course, there is no way in hell you can actually make the human brain store enough entropy perfectly Sure there is. Have horse batteries taught us nothing? https://xkcd.com/936/ Don't confuse key length with entropy. A properly-scaled PBKDF remains secure with as little as 48 bits or so. Needless to say, though, a 32 bit time value is hardly a properly designed key derivation input.

I use these passwords all the time. However, you should keep in mind the text in the comic:

> (Plausible attack on a weak remote web service. Yes, cracking a stolen hash is faster, but it's not what the average user should worry about.)

This is almost a sound assumption for most web services[1]. However, this is Bitcoin. The only thing the attacker has is your hash. And you're using a payments system which economically incentivizes the creation of ever-larger systems for brute-forcing hashes. The network's hash power as a whole is estimated to be around 331 exahashes per second, so 68 bits of entropy would take one second to crack.

Correct horse battery staple would be cracked in fractions of a second by the full network. Eight common words would take 12 days. If we go further to 12 words, then we do get reasonable levels of security, but I'm assuming hashrates stay constant forever which is a bad assumption. And 12 word passphrases will already be about as much of a pain to remember as the 'password policy compliant' passwords xkcd was railing against.

[1] The most likely attack is actually credential-stuffing, not brute-force. xkcd is assuming you already use separate passwords.

Related: The password hashes for the xkcd forums actually did leak and it turned out most people's passwords were "correct horse battery staple".

No, not four random words. I mean the literal text "correct horse battery staple".

Re: Milk Sad Disclosure

#67

Post by lrvick »

ryan-c wrote: post #54
ryanatdistrust wrote: post #45

Earlier quoted context omitted.

My numbers are very rough estimates and not good enough to do work on. More accurate information may be made public later.

I would be interested to see performance stats - I would expect an optimized attack (batch point inversion, large precomputed table to speed up multiplication, not bothering to try to be constant time) to run well over an order of magnitude faster than that. Not that it's particularly worth bothering if you have an 80 core machine and only 13 billion keys to check.

And indeed, we did have an 80 core machine. <1 day after some code optimization passes.

Re: Milk Sad Disclosure

#68

Post by [deleted] »

astrange wrote: post #64
NelsonMinar wrote: post #9

"On Libbitcoin Explorer 3.x versions, bx seed uses the Mersenne Twister pseudorandom number generator (PRNG) initialized with 32 bits of system time." That's a hell of an amateur mistake to make. 50/50 odds whether it was incompetence or deliberate fraud. Maybe 80/20; that flaw is so simple anyone can attack it. Which apparently is happening right now. It's much better if your crypto library generates keys only you c…

Mersenne Twister is an attractive nuisance. It's complicated and insecure, but a CSPRNG can be done in a few lines of code. I think people pick it because it has a cool sounding name.

[deleted]

Re: Milk Sad Disclosure

#69

Post by alchemist1e9 »

ryan-c wrote: post #28
alchemist1e9 wrote: post #16

Earlier quoted context omitted.

Do you have a reference for large numbers of brain wallets being drained? I believe you are repeating a myth/FUD, but I might be wrong.

https://www.cs.unm.edu/~vasek/papers/vasekfc16.pdf Also, there was an ethereum wallet with over 40,000 ETH that got drained.

From their conclusion:

> By examining 300 billion candidate passwords, we found 884 brain wallets that were active at some point in time. Unfortunately, we also found that nearly all were drained – usually quickly. While our findings are necessarily incomplete, they certainly suggest that brain wallets are not a secure method for using bitcoin. Perhaps the most surprising result of our analysis is the relative scarcity of brain wallets in use today. This is actually quite encouraging, because it means that fewer users are at risk to these attacks than has previously been supposed.

I don’t think that logic holds up.

It’s pretty much an entire paper of FUD.

And no, anyone with 400,000 ETH who claims they used a brain wallet, and oppsie .. someone stole it. Is having a boating accident, if you know what I mean.

Re: Milk Sad Disclosure

#70

Post by TacticalCoder »

> https://blog.ledger.com/Funds-of-every-wallet-created-with-t...

This "Milk Sad" was apparently discovered by the guys at Ledger (they make a hardware wallet but which can also be used as a U2F device for, say, SSH logins).

These guys are good. Their CTO (or ex-CTO ?) was part of the original FIDO alliance that came up with the U2F spec.

Post reply on HN