5 ms·

Reminds me of attacks people were running on 'brainwallets' a while back - i.e. wallets whose initial key material was just a passphrase you'd remember. The ide

Reminds me of attacks people were running on 'brainwallets' a while back - i.e. wallets whose initial key material was just a passphrase you'd remember. The idea was that you could keep the passphrase stored nowhere and not have to worry about it being stolen by... well, any of the 10,000 things out there looking for cryptocurrency keys. Of course, there is no way in hell you can actually make the human brain store enough entropy perfectly, and once people realized that these wallets were crackable, they all got drained pretty quick. Owning Bitcoin is like paying into an involuntary bug bounty program. Every time someone finds a bug, your life savings get wiped out.

alchemist1e9 3y ago
Do you have a reference for large numbers of brain wallets being drained? I believe you are repeating a myth/FUD, but I might be wrong.
- ryan-c 3y ago
  https://www.cs.unm.edu/~vasek/papers/vasekfc16.pdf https://www.cs.unm.edu/~vasek/papers/vasekfc16.pdf Also, there was an ethereum wallet with over 40,000 ETH that got drained.
  - alchemist1e9 3y ago
    From their conclusion: > By examining 300 billion candidate passwords, we found 884 brain wallets that were active at some point in time. Unfortunately, we also found that nearly all were drained – usually quickly. While our findings are necessarily incomplete, they certainly suggest that brain wallets are not a secure method for using bitcoin. Perhaps the most surprising result of our analysis is the relative scarcity of brain wallets in use today. This is actually quite encouraging, because it means that fewer users are at risk to these attacks than has previously been supposed. I don’t think that logic holds up. It’s pretty much an entire paper of FUD. And no, anyone with 400,000 ETH who claims they used a brain wallet, and oppsie .. someone stole it. Is having a boating accident, if you know what I mean.
    - ryan-c 3y ago
      Someone used the passphrase "how much wood could a woodchuck chuck if a woodchuck could chuck wood" to store 250 BTC. I personally drained it by mistake, then tracked down the owner, via the pool he'd mined it from. I'm a co-author of that paper, we later got funding to do a larger cracking run and found more wallets, and even some that still had balances. See slide 18: https://rya.nc/files/measuring_the_use_and_abuse_of_brain_wallets.pdf https://rya.nc/files/measuring_the_use_and_abuse_of_brain_wa... Feeding a massive corpus reddit comments and six years of IRC logs into the cracking tool was particularly interesting. > And no, anyone with 400,000 ETH who claims they used a brain wallet, and oppsie .. someone stole it. Is having a boating accident, if you know what I mean. It was about 40,000. The password was "guybrush", and I spoke to the guy who made it. He didn't understand how the tool worked when he made an address. Much later, the Ethereum foundation sent him the ETH. It was gone by the time he went to spend it. Dude put out a press release offering to let whoever did it keep half if they gave back the other half. The ETH hasn't moved since the day it was stolen, almost eight years ago. I assure you, the guy made a genuine fucky wucky. If I'd gone blackhat with this research, I could be retired to a volcano lair on a private island by now. WTF is your angle here?
      - alchemist1e9 3y ago
        That sounds exactly like a well acted boating accident. My angle is that simple brain wallets that use a combination of a memorable phrase with some individual information, like the user’s name, birthdate, address and a 4 digit PIN, used as salt, are then extremely secure. And your paper and the original comment I responded to don’t emphasize that it’s the user’s use of such an systen that makes them vulnerable not the foundation of the technique of brainwallets. Basically you’re blaming the car for the drivers not understanding how to drive and immediately crashing.
        ryan-c 3y ago
        > don’t emphasize that it’s the user’s use of such an systen that makes them vulnerable not the foundation of the technique of brainwallets. That's because it is the foundation of the technique that makes them vulnerable. They are an "attractive nuisance". A system must be evaluated based on "typical use", not "perfect use". You come across as a social Darwinist who would be happy for all the warning labels to be removed from everything and all safety regulations repealed. The world you advocate for would be an awful dystopia. You have nothing to say I haven't heard before.
- yieldcrv 3y ago
  What would change your view about that? This was one of the best uses of GPUs 10 years ago, people still have those instances running just in case people use “obscure” common phrases from books again instead of mnemonics Its more like anyone that thought they were clever got swept. There arent statistics, just threads on bitcointalk and reddit
  - alchemist1e9 3y ago
    If you used common phrases from books you definitely aren’t clever and deserve to have your funds swept.
    - nullc 3y ago
      The person who originated the practice and created the first "brainwallet" site did exactly what you're doing: insisted that it was secure, and insisted that people who lost their funds deserved it. Are you also doing what he did? stealing the funds of the deserving victims yourself? Eventually taking the weak brainwallets he talked people into creating wasn't enough: He lost his bitcoin (I think via gambling but maybe an exchange hack), whined he was broke for a while, and whined that not many people were making hackable brainwallets, then added a more explicit vulnerability to the site. He vanished after it was caught.
- werrett 3y ago
  It’s not not a myth. Not even really lost to time (or a simple Google search). E.g https://www.reddit.com/r/Bitcoin/comments/1zti1p/17956_hacked_brainwallet_passwords/ https://www.reddit.com/r/Bitcoin/comments/1zti1p/17956_hacke... https://www.wired.com/2015/07/brainflayer-password-cracker-steals-bitcoins-brain/ https://www.wired.com/2015/07/brainflayer-password-cracker-s...
  - alchemist1e9 3y ago
    FUD!! and you know it if you actually took time to read the post. > I could find the passwords for 17.956 of the addresses. * Only 2 addresses of the hacked brainwallets are currently not empty, and the total money that I could actually steal is 0.00115215 BTC. > Somebody seems to have systematically flooded the blockchain with transaction to brainwallets. E.g. this transaction: https://blockchain.info/tx/ba421da33e5f85669d9312b804e22fa4cfd1392bb7bb51c7390c91d8598cd071 https://blockchain.info/tx/ba421da33e5f85669d9312b804e22fa4c... It seems that each target address is actually a brainwallet and alphabetically ordered. The passwords for the first 3 addresses are Hollister, hollowing, Nobody’s real brain wallets are being hacked! It’s just left over traces from someone running aome testing in early days of bitcoin. This one says 17K wallets … oppsie all empty and obviously programmatically generated! i.e not used for real. The other paper found 800!! supposedly… all empty. A well designed brainwallet is perfectly fine and safe, just don’t use a sequential phrase from known sources and modify the words you do. Obviously.
    - nullc 3y ago
      > Nobody’s real brain wallets are being hacked! It’s just left over traces from someone running aome testing in early days of bitcoin. I've talked to a LOT of real people who's real brainwallets were hacked. Certainly there is also some 'testing' but that doesn't change the fact that there have been real and substantial losses. Brainwallets are very dangerous. A brainwallet is the same thing as using a user provided password to secure a high value system that has an unsalted and public password hash database. This is a negligent practice. In the corporate world it wouldn't be shocking to learn that a security engineer was instantly fired for implementing such a practice. Good security advice results in practical security even if the user uses the system less than perfectly. Attacker-originated security "advice" provides security only under unrealistic perfect use. Telling people to use brainwallets is like recommending one-time-pad encryption. In practice the security will be fragile if not outright broken though in theory with it may go okay sometimes. Correct usage would require secure mechanically generated uniformly random seed phrases with a hundred plus bits of entropy. That isn't generally what people do in practice and the few who have often have issues with retention of the string being inevitably very poor, causing them to lose the funds by forgetting (esp after getting a fever). (Of course, if they're going to write it down and they didn't generate it themselves then it's not something anyone should be calling a brainwallet anymore.)
ajross 3y ago
> Of course, there is no way in hell you can actually make the human brain store enough entropy perfectly Sure there is. Have horse batteries taught us nothing? https://xkcd.com/936/ https://xkcd.com/936/ Don't confuse key length with entropy. A properly-scaled PBKDF remains secure with as little as 48 bits or so. Needless to say, though, a 32 bit time value is hardly a properly designed key derivation input.
- codetrotter 3y ago
  This xkcd comic has been instrumental to me. I wrote a command-line utility a couple of years ago that I use myself regularly to generate secure and memorable passwords https://github.com/ctsrc/Pgen https://github.com/ctsrc/Pgen With this tool you can also see how many bits of entropy the passphrase generation settings you are using will result in. For example, generating a 5 word passphrase using the long wordlist pgen -l -n 5 will yield a passphrase like: joyous embolism outsider evasion mashed And when we ask the tool for the entropy with these settings pgen -l -n 5 -e it will tell us: Current settings will create passphrases with 64.62 bits of entropy. And hey, if you have reason to not trust the randomness capabilities of the program or your computer guess what :) My program supports the use of physical dice to generate your password. Have a look, try it out yourselves :D https://github.com/ctsrc/Pgen https://github.com/ctsrc/Pgen
  - ryanatdistrust 3y ago
    It looks neat, I'll pass this along to the team and take a deeper look at it later.
    - sowbug 3y ago
      Also generating a BIP39 seed from https://iancoleman.io/bip39/ https://iancoleman.io/bip39/ and using as many words from the output as you want for your purposes.
  - avnigo 3y ago
    That’s excellent! I had the same idea I completed a few weeks ago in python trying to write it with the standard library and have it be easily auditable. You can check it out here if you want: https://github.com/avnigo/nodice-cli https://github.com/avnigo/nodice-cli
tomjakubowski 3y ago
You only need a phrase of twelve words from a 2048 word dictionary to have 128 bits of entropy. Twelve words is up to "Thy kingdom" in the Lord's Prayer, so certainly people are able to memorize twelve word phrases or even 24 word phrases without too much trouble. And English is a lot more than 2048 words - so you could probably use a shorter phrase and still be fine.
- rcoveson 3y ago
  The thing about the Lord's Prayer doesn't really follow. If you use a grammatically correct and semantically commonplace 12 word sequence like that, you surely don't have 128 bits of entropy. But the ease of memorization comes almost entirely from those attributes! To get 128 bits of entropy with words, you need to pick about thirteen out of a million words--which is on the order of all the words in the English language--and give all of them equal probability. The sequence needs to be fully random as well. What you end up with will surely be easier to memorize than a UUID, but substantially more difficult than the start of the Lord's Prayer. EDIT: Math is wrong, I was thinking 10 bits per million instead of 20. So 6-7 words out of a million (whole language) or 13 words out of a thousand (very limited subset of the language). Point about random selection still stands, but it's certainly easier than 13 very uncommon words. Still much harder than a realistic sentence of that length, though.
- quonn 3y ago
  But the phrases are random, so unlike poems or prayers they are difficult to memorize.
  - sparkie 3y ago
    Create your own haiku, never publish it. What are the odds of someone creating exactly the same haiku?
    - nullc 3y ago
      Probably much higher than you suspect. Making password haikus is an obvious idea which has been suggested many times before. I'm sure that even with a great statistical model of password haikus (say an LLM) yours would still be one in a billion which still seems unlikely, but a cracking cluster can try billions per second. In these cases it's very easy to have security that depends on the odds that a powerful attacker just hasn't gotten around to seriously trying the broad class of predictable generation schemes you've used.
TravelTechGuy 3y ago
Your last sentence should be a t-shirt.
iraqmtpizza 3y ago
Encrypting your hard drive is like paying into an involuntary bug bounty program. Every time someone finds a bug, your nudes get posted to the internet.
- ryanatdistrust 3y ago
  [flagged]

alchemist1e9 3y ago

Do you have a reference for large numbers of brain wallets being drained? I believe you are repeating a myth/FUD, but I might be wrong.

ryan-c 3y ago
https://www.cs.unm.edu/~vasek/papers/vasekfc16.pdf https://www.cs.unm.edu/~vasek/papers/vasekfc16.pdf Also, there was an ethereum wallet with over 40,000 ETH that got drained.
- alchemist1e9 3y ago
  From their conclusion: > By examining 300 billion candidate passwords, we found 884 brain wallets that were active at some point in time. Unfortunately, we also found that nearly all were drained – usually quickly. While our findings are necessarily incomplete, they certainly suggest that brain wallets are not a secure method for using bitcoin. Perhaps the most surprising result of our analysis is the relative scarcity of brain wallets in use today. This is actually quite encouraging, because it means that fewer users are at risk to these attacks than has previously been supposed. I don’t think that logic holds up. It’s pretty much an entire paper of FUD. And no, anyone with 400,000 ETH who claims they used a brain wallet, and oppsie .. someone stole it. Is having a boating accident, if you know what I mean.
  - ryan-c 3y ago
    Someone used the passphrase "how much wood could a woodchuck chuck if a woodchuck could chuck wood" to store 250 BTC. I personally drained it by mistake, then tracked down the owner, via the pool he'd mined it from. I'm a co-author of that paper, we later got funding to do a larger cracking run and found more wallets, and even some that still had balances. See slide 18: https://rya.nc/files/measuring_the_use_and_abuse_of_brain_wallets.pdf https://rya.nc/files/measuring_the_use_and_abuse_of_brain_wa... Feeding a massive corpus reddit comments and six years of IRC logs into the cracking tool was particularly interesting. > And no, anyone with 400,000 ETH who claims they used a brain wallet, and oppsie .. someone stole it. Is having a boating accident, if you know what I mean. It was about 40,000. The password was "guybrush", and I spoke to the guy who made it. He didn't understand how the tool worked when he made an address. Much later, the Ethereum foundation sent him the ETH. It was gone by the time he went to spend it. Dude put out a press release offering to let whoever did it keep half if they gave back the other half. The ETH hasn't moved since the day it was stolen, almost eight years ago. I assure you, the guy made a genuine fucky wucky. If I'd gone blackhat with this research, I could be retired to a volcano lair on a private island by now. WTF is your angle here?
    - alchemist1e9 3y ago
      That sounds exactly like a well acted boating accident. My angle is that simple brain wallets that use a combination of a memorable phrase with some individual information, like the user’s name, birthdate, address and a 4 digit PIN, used as salt, are then extremely secure. And your paper and the original comment I responded to don’t emphasize that it’s the user’s use of such an systen that makes them vulnerable not the foundation of the technique of brainwallets. Basically you’re blaming the car for the drivers not understanding how to drive and immediately crashing.
      - ryan-c 3y ago
        > don’t emphasize that it’s the user’s use of such an systen that makes them vulnerable not the foundation of the technique of brainwallets. That's because it is the foundation of the technique that makes them vulnerable. They are an "attractive nuisance". A system must be evaluated based on "typical use", not "perfect use". You come across as a social Darwinist who would be happy for all the warning labels to be removed from everything and all safety regulations repealed. The world you advocate for would be an awful dystopia. You have nothing to say I haven't heard before.
yieldcrv 3y ago
What would change your view about that? This was one of the best uses of GPUs 10 years ago, people still have those instances running just in case people use “obscure” common phrases from books again instead of mnemonics Its more like anyone that thought they were clever got swept. There arent statistics, just threads on bitcointalk and reddit
- alchemist1e9 3y ago
  If you used common phrases from books you definitely aren’t clever and deserve to have your funds swept.
  - nullc 3y ago
    The person who originated the practice and created the first "brainwallet" site did exactly what you're doing: insisted that it was secure, and insisted that people who lost their funds deserved it. Are you also doing what he did? stealing the funds of the deserving victims yourself? Eventually taking the weak brainwallets he talked people into creating wasn't enough: He lost his bitcoin (I think via gambling but maybe an exchange hack), whined he was broke for a while, and whined that not many people were making hackable brainwallets, then added a more explicit vulnerability to the site. He vanished after it was caught.
werrett 3y ago
It’s not not a myth. Not even really lost to time (or a simple Google search). E.g https://www.reddit.com/r/Bitcoin/comments/1zti1p/17956_hacked_brainwallet_passwords/ https://www.reddit.com/r/Bitcoin/comments/1zti1p/17956_hacke... https://www.wired.com/2015/07/brainflayer-password-cracker-steals-bitcoins-brain/ https://www.wired.com/2015/07/brainflayer-password-cracker-s...
- alchemist1e9 3y ago
  FUD!! and you know it if you actually took time to read the post. > I could find the passwords for 17.956 of the addresses. * Only 2 addresses of the hacked brainwallets are currently not empty, and the total money that I could actually steal is 0.00115215 BTC. > Somebody seems to have systematically flooded the blockchain with transaction to brainwallets. E.g. this transaction: https://blockchain.info/tx/ba421da33e5f85669d9312b804e22fa4cfd1392bb7bb51c7390c91d8598cd071 https://blockchain.info/tx/ba421da33e5f85669d9312b804e22fa4c... It seems that each target address is actually a brainwallet and alphabetically ordered. The passwords for the first 3 addresses are Hollister, hollowing, Nobody’s real brain wallets are being hacked! It’s just left over traces from someone running aome testing in early days of bitcoin. This one says 17K wallets … oppsie all empty and obviously programmatically generated! i.e not used for real. The other paper found 800!! supposedly… all empty. A well designed brainwallet is perfectly fine and safe, just don’t use a sequential phrase from known sources and modify the words you do. Obviously.
  - nullc 3y ago
    > Nobody’s real brain wallets are being hacked! It’s just left over traces from someone running aome testing in early days of bitcoin. I've talked to a LOT of real people who's real brainwallets were hacked. Certainly there is also some 'testing' but that doesn't change the fact that there have been real and substantial losses. Brainwallets are very dangerous. A brainwallet is the same thing as using a user provided password to secure a high value system that has an unsalted and public password hash database. This is a negligent practice. In the corporate world it wouldn't be shocking to learn that a security engineer was instantly fired for implementing such a practice. Good security advice results in practical security even if the user uses the system less than perfectly. Attacker-originated security "advice" provides security only under unrealistic perfect use. Telling people to use brainwallets is like recommending one-time-pad encryption. In practice the security will be fragile if not outright broken though in theory with it may go okay sometimes. Correct usage would require secure mechanically generated uniformly random seed phrases with a hundred plus bits of entropy. That isn't generally what people do in practice and the few who have often have issues with retention of the string being inevitably very poor, causing them to lose the funds by forgetting (esp after getting a fever). (Of course, if they're going to write it down and they didn't generate it themselves then it's not something anyone should be calling a brainwallet anymore.)

ajross 3y ago

> Of course, there is no way in hell you can actually make the human brain store enough entropy perfectly Sure there is. Have horse batteries taught us nothing? https://xkcd.com/936/ https://xkcd.com/936/ Don't confuse key length with entropy. A properly-scaled PBKDF remains secure with as little as 48 bits or so. Needless to say, though, a 32 bit time value is hardly a properly designed key derivation input.

codetrotter 3y ago
This xkcd comic has been instrumental to me. I wrote a command-line utility a couple of years ago that I use myself regularly to generate secure and memorable passwords https://github.com/ctsrc/Pgen https://github.com/ctsrc/Pgen With this tool you can also see how many bits of entropy the passphrase generation settings you are using will result in. For example, generating a 5 word passphrase using the long wordlist pgen -l -n 5 will yield a passphrase like: joyous embolism outsider evasion mashed And when we ask the tool for the entropy with these settings pgen -l -n 5 -e it will tell us: Current settings will create passphrases with 64.62 bits of entropy. And hey, if you have reason to not trust the randomness capabilities of the program or your computer guess what :) My program supports the use of physical dice to generate your password. Have a look, try it out yourselves :D https://github.com/ctsrc/Pgen https://github.com/ctsrc/Pgen
- ryanatdistrust 3y ago
  It looks neat, I'll pass this along to the team and take a deeper look at it later.
  - sowbug 3y ago
    Also generating a BIP39 seed from https://iancoleman.io/bip39/ https://iancoleman.io/bip39/ and using as many words from the output as you want for your purposes.
- avnigo 3y ago
  That’s excellent! I had the same idea I completed a few weeks ago in python trying to write it with the standard library and have it be easily auditable. You can check it out here if you want: https://github.com/avnigo/nodice-cli https://github.com/avnigo/nodice-cli

tomjakubowski 3y ago

You only need a phrase of twelve words from a 2048 word dictionary to have 128 bits of entropy. Twelve words is up to "Thy kingdom" in the Lord's Prayer, so certainly people are able to memorize twelve word phrases or even 24 word phrases without too much trouble. And English is a lot more than 2048 words - so you could probably use a shorter phrase and still be fine.

rcoveson 3y ago
The thing about the Lord's Prayer doesn't really follow. If you use a grammatically correct and semantically commonplace 12 word sequence like that, you surely don't have 128 bits of entropy. But the ease of memorization comes almost entirely from those attributes! To get 128 bits of entropy with words, you need to pick about thirteen out of a million words--which is on the order of all the words in the English language--and give all of them equal probability. The sequence needs to be fully random as well. What you end up with will surely be easier to memorize than a UUID, but substantially more difficult than the start of the Lord's Prayer. EDIT: Math is wrong, I was thinking 10 bits per million instead of 20. So 6-7 words out of a million (whole language) or 13 words out of a thousand (very limited subset of the language). Point about random selection still stands, but it's certainly easier than 13 very uncommon words. Still much harder than a realistic sentence of that length, though.
quonn 3y ago
But the phrases are random, so unlike poems or prayers they are difficult to memorize.
- sparkie 3y ago
  Create your own haiku, never publish it. What are the odds of someone creating exactly the same haiku?
  - nullc 3y ago
    Probably much higher than you suspect. Making password haikus is an obvious idea which has been suggested many times before. I'm sure that even with a great statistical model of password haikus (say an LLM) yours would still be one in a billion which still seems unlikely, but a cracking cluster can try billions per second. In these cases it's very easy to have security that depends on the odds that a powerful attacker just hasn't gotten around to seriously trying the broad class of predictable generation schemes you've used.

TravelTechGuy 3y ago

Your last sentence should be a t-shirt.

iraqmtpizza 3y ago

Encrypting your hard drive is like paying into an involuntary bug bounty program. Every time someone finds a bug, your nudes get posted to the internet.

ryanatdistrust 3y ago
[flagged]