Author

Topic: Bruteforced attacked Instawallet (Read 3195 times)

sr. member
Activity: 383
Merit: 250
October 25, 2012, 05:17:34 PM
#16
Ug. I would advise against using any wallet service to store your Bitcoins. Spend just a few minutes reading the threads on this forum and you will see the bad things that have happened so far. Use either bitcoind or Bitcoin QT (Graphical version of Bitcoin) to store and spend your Bitcoins.

There are many instances where a hosted (shared) EWallet like Paytunia, Instawallet, EasyWallet, or an exchange's EWallet even work very well due to EWallets being convenient and nearly always accessible.

Instawallet and EasyWallet are special case EWallets, where there is no username / password, just a URL.  They are referred to as "low security wallets" and are suitable for low amounts.

They don't make great places for storing wealth, but for someone who simply needs an address to receive $5 worth of coins, it works just fine.

I would not trust them even to hold $1 worth of Bitcoin.

So you would have no problem handing your real wallet to someone on the bus or subway and asking them to hold it for you?

There is no insurance backing those services up. They can take your money and other peoples money and run with it as some have done in the past.

Fool me once, shame on you. Fool me twice, shame on me...

If you think the 3 people owning a registered business like instawallet will "run" with a few thousand euros/USDs to ruin their professionnal and social life for good, think twice. Our identities are public if you care to check. Just so you know 90% of the bitcoins are in cold storage and the redemption of a storage key by a single individual is NOT possible under our redemption process.

Without social trust, there is no efficient economy, period, regardless of the monetary system you are using.

To someone younger it might sound like a good idea, but I have learned that trust without insurance is not a good thing and that you will probably get burned.
legendary
Activity: 1220
Merit: 1015
e-ducat.fr
October 25, 2012, 05:32:03 AM
#15
Ug. I would advise against using any wallet service to store your Bitcoins. Spend just a few minutes reading the threads on this forum and you will see the bad things that have happened so far. Use either bitcoind or Bitcoin QT (Graphical version of Bitcoin) to store and spend your Bitcoins.

There are many instances where a hosted (shared) EWallet like Paytunia, Instawallet, EasyWallet, or an exchange's EWallet even work very well due to EWallets being convenient and nearly always accessible.

Instawallet and EasyWallet are special case EWallets, where there is no username / password, just a URL.  They are referred to as "low security wallets" and are suitable for low amounts.

They don't make great places for storing wealth, but for someone who simply needs an address to receive $5 worth of coins, it works just fine.

I would not trust them even to hold $1 worth of Bitcoin.

So you would have no problem handing your real wallet to someone on the bus or subway and asking them to hold it for you?

There is no insurance backing those services up. They can take your money and other peoples money and run with it as some have done in the past.

Fool me once, shame on you. Fool me twice, shame on me...

If you think the 3 people owning a registered business like instawallet will "run" with a few thousand euros/USDs to ruin their professionnal and social life for good, think twice. Our identities are public if you care to check. Just so you know 90% of the bitcoins are in cold storage and the redemption of a storage key by a single individual is NOT possible under our redemption process.

Without social trust, there is no efficient economy, period, regardless of the monetary system you are using.
legendary
Activity: 2506
Merit: 1010
October 25, 2012, 01:55:47 AM
#14
I was more concerned about those trading sites like BTCe (the only one I know of atm)

Well, there are a number of ways an account at an online service can get compromised.  BTC-e differs from Instawallet in that it used for account protection a username and password.

Obviously, security basics like not re-using your password with more than one service and using a strong password apply.

Because it is hard for many people to maintain secure computers free of malware, several exchanges and EWallets no support multi-factor authentication.  When multi-factor is implemented correctly, the spyware/malware can't perform a replay attack to get access to the funds.

Also, you are trusting that the EWallet operator maintains secure systems.   The track records at the exchanges overall has not been good.

So ideally, if you have to have funds at an exchange, you are only doing that when you are actively trading.  Otherwise withdraw the funds rather than use the EWallet as a savings account.
hero member
Activity: 644
Merit: 500
October 24, 2012, 11:45:57 PM
#13
Sorry for the tittle error. I just noticed it now....

I really was not worried about small amounts of money in an instawallet. I was more concerned about those trading sites like BTCe (the only one I know of atm)


legendary
Activity: 3416
Merit: 4658
October 24, 2012, 06:02:20 PM
#12
I would not trust them even to hold $1 worth of Bitcoin.

So you would have no problem handing your real wallet to someone on the bus or subway and asking them to hold it for you?
I hand my credit card to a complete stranger in a restaurant pretty often.
I've handed my coat over to a coat-check service on occasion.
I've even handed my car keys over to a complete stranger and had them hold on to them for me for a few hours.

I wouldn't just randomly hand money to someone for no reason, but if there was a reasonable reason to have a stranger hold on to a small amount of cash for me, I'd probably be ok with it.
legendary
Activity: 1246
Merit: 1076
October 24, 2012, 05:44:01 PM
#11
Ug. I would advise against using any wallet service to store your Bitcoins. Spend just a few minutes reading the threads on this forum and you will see the bad things that have happened so far. Use either bitcoind or Bitcoin QT (Graphical version of Bitcoin) to store and spend your Bitcoins.

There are many instances where a hosted (shared) EWallet like Paytunia, Instawallet, EasyWallet, or an exchange's EWallet even work very well due to EWallets being convenient and nearly always accessible.

Instawallet and EasyWallet are special case EWallets, where there is no username / password, just a URL.  They are referred to as "low security wallets" and are suitable for low amounts.

They don't make great places for storing wealth, but for someone who simply needs an address to receive $5 worth of coins, it works just fine.

I would not trust them even to hold $1 worth of Bitcoin.

So you would have no problem handing your real wallet to someone on the bus or subway and asking them to hold it for you?

There is no insurance backing those services up. They can take your money and other peoples money and run with it as some have done in the past.

Fool me once, shame on you. Fool me twice, shame on me...
If there are less than $20 in the wallet, then I see no problem with having someone hold it for me, especially if they have held other's wallets without incident in the past.
hero member
Activity: 1078
Merit: 502
October 24, 2012, 05:43:54 PM
#10
Buteforced?  How do you say that?  "Butt-forced"?  In that case, it's drawing up nasty imagery in my head.


haha that's what I came up with when I read the title. Butt Forced wallet..... mmmmmm
legendary
Activity: 1400
Merit: 1005
October 24, 2012, 05:40:45 PM
#9
Buteforced?  How do you say that?  "Butt-forced"?  In that case, it's drawing up nasty imagery in my head.
sr. member
Activity: 383
Merit: 250
October 24, 2012, 05:34:33 PM
#8
Ug. I would advise against using any wallet service to store your Bitcoins. Spend just a few minutes reading the threads on this forum and you will see the bad things that have happened so far. Use either bitcoind or Bitcoin QT (Graphical version of Bitcoin) to store and spend your Bitcoins.

There are many instances where a hosted (shared) EWallet like Paytunia, Instawallet, EasyWallet, or an exchange's EWallet even work very well due to EWallets being convenient and nearly always accessible.

Instawallet and EasyWallet are special case EWallets, where there is no username / password, just a URL.  They are referred to as "low security wallets" and are suitable for low amounts.

They don't make great places for storing wealth, but for someone who simply needs an address to receive $5 worth of coins, it works just fine.

I would not trust them even to hold $1 worth of Bitcoin.

So you would have no problem handing your real wallet to someone on the bus or subway and asking them to hold it for you?

There is no insurance backing those services up. They can take your money and other peoples money and run with it as some have done in the past.

Fool me once, shame on you. Fool me twice, shame on me...
legendary
Activity: 2506
Merit: 1010
October 24, 2012, 05:20:09 PM
#7
Ug. I would advise against using any wallet service to store your Bitcoins. Spend just a few minutes reading the threads on this forum and you will see the bad things that have happened so far. Use either bitcoind or Bitcoin QT (Graphical version of Bitcoin) to store and spend your Bitcoins.

There are many instances where a hosted (shared) EWallet like Paytunia, Instawallet, EasyWallet, or an exchange's EWallet even work very well due to EWallets being convenient and nearly always accessible.

Instawallet and EasyWallet are special case EWallets, where there is no username / password, just a URL.  They are referred to as "low security wallets" and are suitable for low amounts.

They don't make great places for storing wealth, but for someone who simply needs an address to receive $5 worth of coins, it works just fine.
hero member
Activity: 812
Merit: 1006
October 24, 2012, 05:06:17 PM
#6
Even if instawallet had just 64-bit wallets or something, still finding a wallet would be pretty hard, since they probably have some kind of DDOS protection which limits the amount of wallets you can try. But they have 128-bit wallets, which means that even if you brute force 100000 wallets/second, you won't find a valid wallet in a year.
sr. member
Activity: 383
Merit: 250
October 24, 2012, 05:05:10 PM
#5
Ug. I would advise against using any wallet service to store your Bitcoins. Spend just a few minutes reading the threads on this forum and you will see the bad things that have happened so far. Use either bitcoind or Bitcoin QT (Graphical version of Bitcoin) to store and spend your Bitcoins.
legendary
Activity: 2506
Merit: 1010
October 24, 2012, 04:58:45 PM
#4
If those in that pastebin were actual funded Instawallet accounts, the URLs weren't discovered through brute force cracking.

Now if those URLs were sent by Instawallet users via e-mail (which transmits in clear-text) or in SMS/text messaging (which transmits in clear-text on telecom networks), or on corporate networks with packet inspection or on compromised Windows systems, etc., then certainly like any bearer instrument, these URLs are vulnerable to being hijacked by a thief.   That's one reason why the FAQ reads

Quote
do not recommend to store significant amounts of Bitcoins here.

 - https://instawallet.org/static/faq
legendary
Activity: 2506
Merit: 1010
October 24, 2012, 04:51:49 PM
#3
Instawallet account identifiers have too high entropy for brute forcing them being profitable.

If those in that pastebin were actual funded Instawallet accounts, the URLs weren't discovered through brute force cracking.

And that is quantified here:

16 bytes of random data is 128 bits, which means there are 2^128 = 340282366920938463463374607431768211456 possible Instawallet URLs. Let's say there are 10000 Instawallets in use (in reality the number is nowhere this large, but let's be optimistic and assume that Instawallet will grow). So you have a chance of 10000 to 2^128 to find a wallet with coins if you just guess once.
newbie
Activity: 41
Merit: 0
October 24, 2012, 04:38:23 PM
#2
None of those instawallet "accounts" (as far as I can see) has or ever had any bitcoins on them. Instawallet account identifiers have too high entropy for brute forcing them being profitable.

Instawallet is as safe as any other "shared wallet" out there.
hero member
Activity: 644
Merit: 500
October 24, 2012, 04:35:15 PM
#1
http://bitbin.it/paste.php?id=0cWM1t7K

I'm new to the bitcoin thingy and as I was waiting for my equipment to be shipped I have been doing the freebitcoin facet thing.

I been using an instawallet service to stash my mBTC lolz and came across this website after typing in the google search [instawallet.org btc]

Then I been hearing about the gpu's being taken in by private pool hash services. However they are offering money for hash power OTHER than BTC hashing and got me thinking.

What if the rogue hashing processors are being pooled to attack websites such as installets or other services. Look I really don't understand much of this but is that link for real?

I guess instawallets are just temporary in nature but what about accounts in large exchanges? Are they safe?

Jump to: