3 ms·

What do you mean you can't prevent brute forcing? You can count login attempts server side and throw a recaptcha every 5th try say. I could be thinking the wro

by ge96 9y ago

What do you mean you can't prevent brute forcing? You can count login attempts server side and throw a recaptcha every 5th try say. I could be thinking the wrong space though I don't know what Siacoin is or KDF. edit: after reading... >If you’re not familiar with Siacoin, it’s a cryptocurrency that allows you to rent out your spare hard disk space or buy space from others. Interesting not sure I'd do it, what scale you need for this to be worth something as a leasee (leaser?) That was pretty cool that distance between keys... ahh automation me like, parse out the function/tasks write it out, then let the computer do its magic. Batch processing yeahhhhhhh

AgentME 9y ago
This example with Siacoin is more similar to the situation that you have a file encrypted with a password on your computer than it is similar to a network service that users send their password to in order to log in. For anyone interested in a little more detail: Bitcoin and every decentralized cryptocurrency operates on the concept of a blockchain, which is synchronized to every user (and regularly appended to). Most cryptocurrency blockchains effectively contain a list of (hashes of) public keys known as addresses and currency amounts. You own some currency if you know the private key corresponding to an amount listed in the blockchain, and using that private key you can sign a transaction to send the amount associated with it to another address. (That's the easy half of how Bitcoin and friends work. The other half is the innovative part about getting everyone to agree on the same blockchain even when people create conflicting transactions attempting to double-spend the same money. This involves continuous proof-of-work mining generally. It's not super relevant to anything in OP's post though.) The user in the OP post who had their Siacoin stolen was using a system (often called a "brain wallet") where their private key was generated from a 29-word phrase. Anyone who knew the 29-word phrase could use that to generate the private key and then create a transaction to steal the currency associated with it. If you almost know the 29-word phrase, then you could brute-force it by repeatedly modifying the phrase, generating the private key, and then looking at your copy of the blockchain to see if that private key had any currency associated with it. (Well, actually the brain wallet system uses a checksum like credit card numbers do, so most invalid 29-word phrases just fail the checksum check and don't need to bother checking the blockchain itself, but that doesn't really impact anything about this process.)
- ge96 9y ago
  I see, thanks for the clarification.

by ge96 9y ago

AgentME 9y ago

This example with Siacoin is more similar to the situation that you have a file encrypted with a password on your computer than it is similar to a network service that users send their password to in order to log in. For anyone interested in a little more detail: Bitcoin and every decentralized cryptocurrency operates on the concept of a blockchain, which is synchronized to every user (and regularly appended to). Most cryptocurrency blockchains effectively contain a list of (hashes of) public keys known as addresses and currency amounts. You own some currency if you know the private key corresponding to an amount listed in the blockchain, and using that private key you can sign a transaction to send the amount associated with it to another address. (That's the easy half of how Bitcoin and friends work. The other half is the innovative part about getting everyone to agree on the same blockchain even when people create conflicting transactions attempting to double-spend the same money. This involves continuous proof-of-work mining generally. It's not super relevant to anything in OP's post though.) The user in the OP post who had their Siacoin stolen was using a system (often called a "brain wallet") where their private key was generated from a 29-word phrase. Anyone who knew the 29-word phrase could use that to generate the private key and then create a transaction to steal the currency associated with it. If you almost know the 29-word phrase, then you could brute-force it by repeatedly modifying the phrase, generating the private key, and then looking at your copy of the blockchain to see if that private key had any currency associated with it. (Well, actually the brain wallet system uses a checksum like credit card numbers do, so most invalid 29-word phrases just fail the checksum check and don't need to bother checking the blockchain itself, but that doesn't really impact anything about this process.)

ge96 9y ago
I see, thanks for the clarification.