Topic: If you used Brainwallet.org - MUST READ! - Security Breach! - page 6. (Read 52829 times)

Looks like one of my comments made to this thread was deleted.

This won't happen because if you don't take it immediately then someone else's bot will certainly do it. You have to be faster than all other bots or you won't get anything.

"Fraud? What fraud? Its my own brain wallet, I can do with it whatever I want."

If it is taking small amounts it is missing out on the larger amounts that will be deposited when the user thinks it is secure.

I guess for me the risk of being arrested for wire fraud and computer crimes for a small fraction of a bitcoin just seems moronic.

But if it is going to be written down I might as well generate a completely random private key and be safer.

Wait until a competing bot decides to take the money? It would be an idiotic bot if it did not secure any available balance immediately.

I totally agree that more noobs like the OP will lose their money which would be evitable if brainwallets were known only as a concept on well documented blogs and not easily accessible to noobs through sites like brainwallet.org. Still I can't see why it shouldn't be possible to memorize secure passwords. What is your estimate how long it would take for a sentence long, yet memorizable like this one to end up in a rainbowtable? With a mutation like every second word later? Without ever mentioning the sentence on the internet?

I ever only made one Brainwallet for a friend with one Bitcoin. She is of the non-smartphone-and-better-non-computer type, so I promised her to give her the bitcoin to "this piece of paper". I made her think up five long words that are mutually unrelated. She wrote them down and I consider this a safe password until I hear of more serious brain wallets being breached than stfu! (five closely related symbols)

Whatyourhowittakealong,memorizablethistoupaisestimatelongwouldforsentenceyetlikeoneendinrainbowtable <- memorizable password as of above

Simply put the pass phrase and instructions on a piece of paper in your safe, just like you would your paper wallets.  This is not an issue.

Having said that I agree that the entire concept:

SHA256() -> private key

is very dangerous and should not be attempted by just about everyone (including myself here), hence the name of this thread should be changed to warn everyone about all brain wallets, not just those produced by brainwallet.org, this is not a brainwallet.org issue, it is a brain wallet issue.

brainwallet.org and bitaddress.org and any other sites that allow/help users to produce these things should at the very least warn their customers to only do it if they know what they are doing and outline the risks.

Yeah, that would be great.
You don't even need it to be a full featured wallet: as long as it's a "hardware containing private keys", that are used by a software, that would be a great first step.

+1

Indeed - I have a brainwallet and although it doesn't have much BTC (it was an experiment) it is still intact after nearly 1 year (and I have memorised the pass phrase).


As was pointed out - the poor choice of password meant your private key was easily hacked.

If you are going to use a "password" (rather than a pass phrase) then the advice "if you can remember your password then it is not good enough" should be heeded.

I imported the private key into Bitcoin-QT using the importprivkey command in the console.

Users are almost always the weak point. This is the case here.

It is possible to generate a "secure enough" brainwallet.

There is a terrifying amount of misunderstanding of cryptography on this thread.

Brainwallet.org needs to be shut down, yesterday. The title of the thread is correct because the very fact that the site exists is a security breach.

Justus is telling the truth here. You cannot invent or memorise a private key, it isn't possible unless you are the kind of person who competes in international memorisation competitions for fun. And maybe not even then. This isn't about stupid users or smart users, there is absolutely nothing stopping someone from just generating a larger and larger rainbow table every day and that is quite obviously what is happening.

Please tell us which wallet app you imported the key into do we can ask the developers to put a warning in the ui about it. The community clearly needs to sound the alarm about this stupid concept much louder than we have done.

The private key (Wallet Import Format) changes because it is encoded with the flag character to indicate compressed/uncompressed form (see my post above). That 01 suffix changes the base58 value completely.

If you look ate the public key, the uncompressed version starts 04 followed by 128 characters (64 bytes) which are the X and Y coordinates.
Look at the compressed public key and its starts 02 or 03 (which is a flag to indicate the sign of the Y coordainate) followed by the same X coordinate value as the uncompressed public key.

Its just so the wallet that you are importing it into knows whether to use the compressed or uncompressed public key. It you convert the WIF key back to hex, the compressed private key is identical to the uncompressed one, with the addition of a '01' flag character at the end. I guess its done this way to make it foolproof (the user does not need to specify to the wallet whether to use the compressed or uncompressed public key to generate the address as it is already flagged in the WIF private key string).

Take a look at my script at https://bitcointalksearch.org/topic/m.2642261 as it shows the procedure to generate both of the WIF keys from the hex private key quite clearly (just search for WIF). Its simply an 80 prefix. followed by the key value, followed by an 01 suffix (for the compressed key only). To this is appended a double sha256 checksum (just the leading 4 bytes, ie 8 characters in hex), then the whole hex string is base 58 encoded.

Burt,
  I am not sure this is correct - when you go to http://brainwallet.org/ and toggle between compressed and uncompressed both the public and private key changes.  You cannot use the compressed private key to access the uncompressed public key or vice-verse without changing between the two. 

Why is it then that under the details tab on bitaddress.org is there an option of "Private Key WIF (compressed, 52 characters base58, starts with a 'K' or 'L')?"

Another thing you can do is repeat hash hundreds and hundred of times. And use a salt - with the original phrase and added to each hash. You can even have a simple formula that changes the salt each hash.

57899@##$% as me salt.
"I like big butts" as my passphrase.

Each hash I change the salt according to the number performed and add it to the previous hash, changing the salt so it grows each time, resulting in a huge salt by last hash.

Reapeat, say, 722 times.

All I have to remember is the salt (write it down), the pass phrase, and the algorythm I used to alter the salt each iteration.

Try cracking that from a rainbow table.

But I still don't like brain wallets. Paper for me. Stored in a secure place.

KISS

What kind of idiot would write a bot like that?
You wait until it has at least half a coin in it before transfering it out.

Well I guess for really common words it has to be fast or someone else gets it.

-=-

I have two problems with brain wallets -

A) If I die, my survivors have no way to access it.

B) No matter how clever I think I am, if the pass phrase is something I can remember, it has a higher liklihood of being brute forced than a key that is high entropy random generated.

Paper wallets for me.

He's just saying SHA256 brain private keys are a bad idea, and sites like Brainwallet.org should be taken down so that is not easy for misinformed people to create weak private keys.  How hard we should try to protect people from themselves, I guess that's a philosophical/ideological debate that is OT.

As for the evidence of a rainbow table, how about this:


The only thing slightly surprising to me is that mechs's password "stfu!" has punctuation, but I just checked and that verbatim string is in the Rockyou password dump, and anyway it's not much more creative than just "stfu" alone.


Agreed.  More accurate, less alarming, more applicable.

Compressed or uncompressed only applies to public keys, not private keys.  All private keys are the same, there is no compressed form.  For every private key there is only one public key but the public key can be expressed in two different forms.  Each form maps to a different public key address.  So, every private key maps to two different public key addresses.

Not a bot, it was just that the address you generated was already set up to sweep to another address long before you generated it - as explained in other posts.

Almost.  For completeness:
Since every X coordinate in the finite prime field corresponds to exactly two Y coordinates in the finite prime field, one positive and one negative, it is possible to define the exact X,Y coordinate of the public key by using the X coordinate and a sign indicator to tell you which of the two possible Y coordinates to use.

Both forms of the public key are equally secure in that a) they both describe exactly the same information and b) given the X,Y coordinates of a point in either form it is equally difficult to calculate the private key used to generate the public key point.

Yes the ECC is the "hard part" of the calculation but going from uncompressed to compressed public key form is trivial and then the extra hashes to calculate the two different public key addresses is also trivial.  I expect "lazy hacker" if the compressed form was not compromised.

Whether you use the compressed or uncompressed public key to generate the public key address does not matter at all since the issue here is the passphrase used to create the private key.

Given a very large numer of private keys generated from a very large number of common/simple pass phrases they will simply set up sweeps of both versions of the public key address generated from each private key.


Yes, I think that you should (please) change the title to "If you use any brain wallet - MUST READ! - Security Risk!"  as this issue of losing your BTC when using a common/simple pass phrase applies to any brain wallet, not just those from brainwallet.org.

The issue here was that the passphrase for a brain wallet was too simple.  Not that the private key was not kept private.