I'm running an interesting brain wallet security test

nabeton

full member

Activity: 137

Merit: 100

Quote from: boumalo on July 02, 2014, 04:29:08 PM

Quote from: nabeton on July 02, 2014, 04:10:59 PM

hey, now I am bit confused Huh

how come you can reach bitcoins in that wallet without knowing its private key.
are you saying that anybody can just spent time creating new wallets with random passphrase and if he hits one already used it generates same address again?

Then why I need paper wallet with "root key", if knowing passphrase is enough.

I thought passphrase in armory is just to encrypt dat file, or you are talking about different passphrase.

sorry for stupid query, but I'm starting to worry about my BTC.

edit: first google link and I don't worry anymore. armory is not brain wallet.

You can get the private key from the passphrase because the private key was generated from the passphrase

https://brainwallet.github.io/
https://en.bitcoin.it/wiki/Brainwallet

The passphrase must have a good entropy, if you use a paper wallet you don't need a passphrase but you can encrypt your wallet for additional safety

yea, thanks for clarify, that was one of my stupid post, I was reading thread about armory (I'm using it) and mess it up together with this thread. completely my error.

boumalo

legendary

Activity: 1918

Merit: 1018

Quote from: nabeton on July 02, 2014, 04:10:59 PM

hey, now I am bit confused Huh

how come you can reach bitcoins in that wallet without knowing its private key.
are you saying that anybody can just spent time creating new wallets with random passphrase and if he hits one already used it generates same address again?

Then why I need paper wallet with "root key", if knowing passphrase is enough.

I thought passphrase in armory is just to encrypt dat file, or you are talking about different passphrase.

sorry for stupid query, but I'm starting to worry about my BTC.

edit: fist google link and I don't worry anymore. armory is not brain wallet.

You can get the private key from the passphrase because the private key was generated from the passphrase

https://brainwallet.github.io/
https://en.bitcoin.it/wiki/Brainwallet

The passphrase must have a good entropy, if you use a paper wallet you don't need a passphrase but you can encrypt your wallet for additional safety

nabeton

full member

Activity: 137

Merit: 100

hey, now I am bit confused Huh

how come you can reach bitcoins in that wallet without knowing its private key.
are you saying that anybody can just spent time creating new wallets with random passphrase and if he hits one already used it generates same address again?

Then why I need paper wallet with "root key", if knowing passphrase is enough.

I thought passphrase in armory is just to encrypt dat file, or you are talking about different passphrase.

sorry for stupid query, but I'm starting to worry about my BTC.

edit: first google link and I don't worry anymore. armory is not brain wallet.

infested999

hero member

Activity: 854

Merit: 500

Quote from: linjaaho on March 06, 2013, 01:25:47 AM

Two weeks ago I started to run a little security test on brain wallets. I created five brain wallets, and deposited one bitcoin to each of them. The password for every wallet is ridiculously easy (a kind of password that security professionals would kill me if they knew Cool

).

Currently, only one of the five wallets has been ripped. I think the "problem" with my test is that no one assumes that someone is storing his/her coins behind a stupid password. Prove me I'm wrong Cool

.

And no, I'm not trolling. After one month has passed, I'll reveal the passwords here and everyone can check with Blockchain.info that I was not kidding. Meanwhile, you can follow me on Twitter.

Looking back at this, the Bitcoin price when OP started this experiment was $30 on February 20, 2013 (2 weeks before March 6, 2013).

Apparently four wallets are still open, that leaves $4,000 in this thread.

EDIT: I found the follow-up Tweet here: https://twitter.com/linjaaho/statuses/311041344330153985

The password was "fuckfuckfuckfuck"

TheButterZone

legendary

Activity: 3038

Merit: 1032

RIP Mommy

Quote from: linjaaho's original blog post at http://linja-aho.blogspot.fi/2013/03/small-contest-hack-my-bitcoins-and-keep.html

But because I'm impatient, here is a hint for passphrases:
...
only allowed characters are small letters (a-z) and spaces

Quote from: linjaaho's later edited blog post at http://linja-aho.blogspot.fi/2013/03/small-contest-hack-my-bitcoins-and-keep.html

in the four unhacked passwords, there are no spaces, just words after words

hashcode

newbie

Activity: 13

Merit: 0

I had fun following this over on r/bitcoin/ , but I don't think you have much to worry about people guessing these brain wallets. Everyone on there, myself included, needed a LOT of hints before the last 4 passes were cracked

If you're running another experiment anytime soon, let me know Wink

hathmill

full member

Activity: 186

Merit: 100

1. http://lmgtfy.com/?q=most+used+passwords&l=1
2. http://brainwallet.org/
3. http://blockchain.info/address/16ga2uqnF1NqpAuQeeg7sTCAdtDUwDyJav
4. http://coderedd.net/r/Bitcoin/comments/xgpw1/could_somebody_steal_bitcoin_by_guessing/

SIGNW

newbie

Activity: 41

Merit: 0

Quote from: mokahless on March 07, 2013, 11:11:42 PM

aside: @SIGNW - I don't think trolling means what you think it does.

haha whoops. I was tired from guessing brainwallets. I *knew* it didn't sound right, but entered it anyways.

*tired

gapthemind

newbie

Activity: 34

Merit: 0

Dude where is my car

I will give him an offer he cant refuse

But tbh I think it would be hard to guess a password like that, its not like guessing a password from people using
12345678987654321 or qwertyuioplkjhgfdsa, that can be the case.

TheButterZone

legendary

Activity: 3038

Merit: 1032

RIP Mommy

Quote from: mokahless on March 07, 2013, 11:11:42 PM

I spent about 10-20 minutes randomly guessing phrases and found only one address from a phrase I had come up with myself: "may the force be with you". It once contained a single satoshi probably a long time ago.

... in a Galaxy Far Far Away?

mokahless

sr. member

Activity: 471

Merit: 256

This is an interesting challenge. Let's spread it around and see how long it takes.
I spent about 10-20 minutes randomly guessing phrases and found only one address from a phrase I had come up with myself: "may the force be with you". It once contained a single satoshi probably a long time ago.
I think your level of easy may boil down to if someone knows what kind of personality and person you are. If they don't know this, a dictionary attack might work faster since we know they are all lowercase English letters with spaces.

aside: @SIGNW - I don't think trolling means what you think it does.

SIGNW

newbie

Activity: 41

Merit: 0

Quote from: linjaaho on March 07, 2013, 04:18:13 PM

Quote from: ?? on ??

Well the good news about brain wallets is that they are still hard to guess even if they are "easy" pass-phrases.

I think you are right - here are some hints to make the competition easier:
http://linja-aho.blogspot.fi/2013/03/small-contest-hack-my-bitcoins-and-keep.html

Thanks! I've been ~~trolling~~ lurking here for a while, but came from the Redditsphere asking for some passphrase formatting hints. Time to get guessing!

stdset

hero member

Activity: 572

Merit: 506

May be your passwords are not so stupid.

Let's estimate how difficult it is to rip your addresses.
Min length is 15 chars. Bruteforsing such passphrase char by char is hopeless, since we have about 3*10^21 combinations for the shortest password.
So let's try to use a dictionary. Let's say it contains 20000 words (it should contain more, but we want to make conservative estimation). Passphrase contains at least 3 of such words, what gives us 8*10^12 combinations. And this is the easyest case. Also it was assumed, that we know algorithm used to generate all those keys from passphrases. But one could md5 them first, or do whatever else. For somebody who isn't a hacker it is obvously pointless to try. Even if you are a hacker, it is most likely still pointless, since reward is too small and task probably isn't that easy.
And, btw, how many combinations could decent bruteforsing application try a second?

linjaaho

newbie

Activity: 2

Merit: 0

Quote from: ?? on ??

Well the good news about brain wallets is that they are still hard to guess even if they are "easy" pass-phrases.

I think you are right - here are some hints to make the competition easier:
http://linja-aho.blogspot.fi/2013/03/small-contest-hack-my-bitcoins-and-keep.html

baumberg

newbie

Activity: 10

Merit: 0

First I thought that I had found your address, but then I was thinking they: "Hey... who stores 1000 BTC with such an easy pwd?" Wink

investr

full member

Activity: 222

Merit: 100

Another failed one: Setec Astronomy

This is a ridiculously hard request considering the possibility of punctuation permutations. How about a hint letting us know if there is any punctuation or capitalization?

Nicolai

newbie

Activity: 39

Merit: 0

haha nice :-)

I haven't found any of your addresses (yet Wink

), but here are some addresses I found, that previously have had bitcoins on them:

Quote

The Times 03/Jan/2009 Chancellor on brink of second bailout for banks
correct horse battery staple
Satoshi Nakamoto

Herodes

hero member

Activity: 868

Merit: 1000

Interessant historie.

mintymark

sr. member

Activity: 286

Merit: 251

True, but ony briefly, for 30 seconds in Nov 2012.

drb

newbie

Activity: 6

Merit: 0

Slightly related: I just tried the wallet with passphrase: 'bitcoin is awesome'

Some dude had 500 BTC on that wallet. WTF!

Topic: I'm running an interesting brain wallet security test (Read 7378 times)