Topic: Stop the "correct horse battery staple" debacle. (Read 2627 times)

I see. Thanks for your help.

I now finally understand why Electrum seed is just 128 bits when it has 12 words, it is simply because log1626/log 2*12 = 128.005

Well since each word is random and there are 7776 possible outcomes that means each word has Log(7776) = 12.925 bits of entropy each.   The entropy of the password would be # of words * entropy of each word.

5 words = ~64 bits    <- sufficient for low security applications*
6 words = ~78 bits
7 words = ~90 bits    <- sufficient for medium security applications*
8 words = ~102 bits   <- sufficient for high security applications* which rely on an additional factor (i.e. bitcoin wallet requires passphrase AND the actual wallet.dat)
9 words = ~116 bits   
10 words = ~130 bits  <- beyond brute force of nation states both today and into the conceivable future

* This assumes the passwords are stored securely using a key derivation function (strong hash, thousands of rounds, per record salt)

DISCLAIMER: I strongly recommend against using a brain wallet for any reason but if someone is going to use them they should have a realistic understanding of what level of entropy is necessary to prevent compromise.

Brain wallets require no second factor so the only security is a sequence which simply can't be brute forced by anything possible today (even by nation states) or for the foreseeable future.  >128 bits of password strength is considered beyond brute force due to the sheer energy requirements necessary to search that keyspace.  Remember with a brain wallet attacker(s) can simply precompute all probable keys (and that would include shorter diceware sequences).  They can continue forever and slowly expand the database of know addresses.  So the only real security would be a passphrase which is beyond brute force, anything else could have already been broken before you ever used it, or could be broken at any point in the future. 

So for RANDOM passphrases we are talking about:

Dicewords (7,776 words) = 10 symbols (words)
All keyboard symbols (95 unique printable symbols on standard US keyboard) = 20 symbols
Case sensitive alphanumeric (a-z, A-Z, 0-9) = 22 symbols
Case insensitive alphanumeric (a-z, 0–9) = 26 symbols
Case insensitive Latin alphabet (a-z) = 28 symbols
Arabic numerals (0–9) = 40 symbols

So of these sequences I know which one is the easiest for me to memorize
chive edt oat puffy crust kiss long omaha lucky bank
2q4$7hG33d$EAV$gsaR4
NSQPYAFSNTAKNPMVZDRRKWXXACVW
TU9MQW97U99D42Y7TS4J6EGGKN
3363486927993949454245366885937555332592

Remember this only applies to truly random sequences.  Human "random" passwords, ones based on symbol substitution (p@ssw0rd!), or taken from a book/move/song have significantly less entropy.  For most of those it is only a matter of time until they are precomputed by attackers.

Apart from the "random" issue, there is one more problem.
The site quoted is using a list of 7776 English words, but if you ask me to pick a few words myself, I would probably be picking the words from just a few hundred words (probably items in my house, people's name, brand name etc.).

BTW, how is the entropy of the password calculated?

It actually will as long as they are RANDOM words.  The random is the hard part.  Humans are actually very bad at coming up with random values.  If you ask people to pick a random number between one and ten a significant portion (usually 20% to 50%) will randomly pick seven and very few will pick one or ten.

Using a true random source like rolling dice is a good method to generate a secure passphrase.  Here is an example:
http://world.std.com/~reinhold/diceware.html

These were rolled randomly
chive eat oat puffy crust kiss = 63 bits of entropy (probably better than 99% of the non-random passwords used on this site right now)
chive eat oat puffy crust kiss long = ~80 bits of entropy (strong enough for most applications, roughly the equivalent of 12 digit random alphanumeric (Y22N^56a%$98)
chive edt oat puffy crust kiss long omaha lucky bank = ~128 bits of entropy (considered beyond brute force regardless of the computing power of the attacker)

To be honest, I don't think the idea illustrated is correct.
Combining a few common words won't give you a great password at all.

Every single satoshi should be given to xkcd, its his password after all.



source: https://xkcd.com/936/

People still arrive on http://brainwallet.org/#generator and think they are generating their own private brain wallet and they send to 1JwSSubhmg6iPtRjtyqhUYYH7bZg3Lfy1T...

I tried to import it into armory.py and got a seg fault.  I might try the new version.

I thought of this but had the idea someone will get their transaction first (maybe a few milliseconds quicker) and that one would be accepted. All the rest that followed would double spend.

Not just this address either. Brain wallets are dangerously insecure unless care is taken selecting the passphrase. Discussed at length in this thread https://bitcointalksearch.org/topic/if-you-used-brainwalletorg-must-read-security-breach-251037

NEWBIES ... read that thread before you use a brainwallet. A badly chosen passphrase will lose your coin.

Do not even try to add the private key to your wallet 
And because many people try to spend the coins, it is not worth to try to do the same 

You just answered your own question. Because the private key is known, the instant anyone sends coins to that address, somebody will attempt to transfer those coins to their own addresses before anyone else does. But since everybody else has the exact same plan, the result is a great many transactions from many different people all trying to spend the same coins.

I thought that was what the testnet is for.

the system is being tested for exploitability

I've never really understood what's going on with that account? The private key is publicly known. But why all the double spends?

I've always wondered what the fees would cost to do that.