Author

Topic: Texts/"passwords" as private keys source and transactions (Read 535 times)

full member
Activity: 297
Merit: 133
I know how it works and I've applied those steps. I am just saying that out of your 190 brainwallets only 3 (raspberry, grotesque, mischievousness) are really leading to an address with transaction history. Other 187 are leading nowhere.
Can you give me an example of one other from your list with the address you derived from this brainwallet, please?

I do not remember exactly why these bws has worked and given transactions. Because of that I have put them on this list. How it was exactly I don't remember.

I have no other lists.
legendary
Activity: 3808
Merit: 1723
Yeah you never really hear the term brainwallet anymore but in the early days it got pretty popular. Because you could of chosen some phrase and instead of worrying about remembering seeds or passwords you just needed to remember that phrase.

People used names and poems and other texts and they were surprised that one day their crypto was gone. Turns out you can easily find any common phrases or names or lines from movies. So people just coded bots and were surprised how many people used these brain wallets which were extremely unsafe.
newbie
Activity: 16
Merit: 8
Addresses are derived from public keys. Public keys are derived from private keys. Private keys are "derived" from brainwallets (WIFs exactly).

brainwallet => private key / WIF => public key => address

You need script to convert private key to one of the addresses (mostly main one 0/0/0).

I know how it works and I've applied those steps. I am just saying that out of your 190 brainwallets only 3 (raspberry, grotesque, mischievousness) are really leading to an address with transaction history. Other 187 are leading nowhere.
Can you give me an example of one other from your list with the address you derived from this brainwallet, please?
full member
Activity: 297
Merit: 133
I love the topic! However, I was unable to derive addresses (with TX) from those phrases. Are you sure there were addresses? Can you check again please?

Addresses are derived from public keys. Public keys are derived from private keys. Private keys are "derived" from brainwallets (WIFs exactly).

brainwallet => private key / WIF => public key => address

You need script to convert private key to one of the addresses (mostly main one 0/0/0).

Here are the parts of the script:

Code:
from bitcoin import *
import base58
import hashlib

sha=hashlib.sha256(x).digest()
tmp=b'\x80'+sha
h=base58.b58encode_check(tmp)
pub=privtopub(tmp)
addr=pubtoaddr(pub)
newbie
Activity: 16
Merit: 8
I love the topic! However, I was unable to derive addresses (with TX) from those phrases. Are you sure there were addresses? Can you check again please?
full member
Activity: 297
Merit: 133
Yes, I got the same WIF from your phrase. Address also. That means there was no transactions for this address, no output, no input. Then the private key is completely empty.

Then I don't understand what's the point of your list (?). You can use any string, even random string of 8 lowercase characters, receive 209 billion WIFs, of which 99.999999999999999% will lead to an address without transactions. I was expecting your 200 strings list is actually leading to addresses with history of transactions...

Yes, it is hunt for this 0.000...001 with balances.

As I checked this long time ago these brainwallets, there were some txes on them. Don't remember.

If you don't like my topic - just not write in it.
newbie
Activity: 16
Merit: 8
Yes, I got the same WIF from your phrase. Address also. That means there was no transactions for this address, no output, no input. Then the private key is completely empty.

Then I don't understand what's the point of your list (?). You can use any string, even random string of 8 lowercase characters, receive 209 billion WIFs, of which 99.999999999999999% will lead to an address without transactions. I was expecting your 200 strings list is actually leading to addresses with history of transactions...
full member
Activity: 297
Merit: 133
I wanted to ask OP how to treat his list of strings.
I know that phrase "mischievousness" is a real brainwallet that leads to address 16t9GqUj2ocEipDEfkrteUTTCXbCK7kJ1q (one SHA256 applied).

I wonder what address has OP derrived from phrase "BoingBoing00" and how he got there. By looking at the code he provided it gives you WIF (5KfhTr87eouEJKS2YFPdHHkdYzUpRwXJYUU4kMe7Knk5vdzfFh4), but the address (16zxUKMDd6eiSb35UJqQbjUvmPTmfzx7km) had no transactions.

Well, you should take some brainwallets, list of passwords, or any other, and convert them to WIFs using my script.
The things here are:

1. You may use SHA256 once or twice on the input data (line of text), once give more hits, twice is the original way which should be used. Usually I use SHA256 once for brainwallets.
2. You may put readable ASCII characters to convert to WIFs or already use binary data in form of SHA256 (32 bytes of any value).

Yes, I got the same WIF from your phrase. Address also. That means there was no transactions for this address, no output, no input. Then the private key is completely empty.
newbie
Activity: 16
Merit: 8
I wanted to ask OP how to treat his list of strings.
I know that phrase "mischievousness" is a real brainwallet that leads to address 16t9GqUj2ocEipDEfkrteUTTCXbCK7kJ1q (one SHA256 applied).

I wonder what address has OP derrived from phrase "BoingBoing00" and how he got there. By looking at the code he provided it gives you WIF (5KfhTr87eouEJKS2YFPdHHkdYzUpRwXJYUU4kMe7Knk5vdzfFh4), but the address (16zxUKMDd6eiSb35UJqQbjUvmPTmfzx7km) had no transactions.
legendary
Activity: 952
Merit: 1385
Can you please try explaining again? For example this part:
Quote
export transactions, mess around with this export to get back commonly used words/texts
How do you mess with transactions? There is not much text within a bitcoin transaction.

That's not about a 'text' itself. You may use transaction or block hash as a private key (or as a text for sha256).
But of course do not expect anything.
newbie
Activity: 16
Merit: 8
Huh
I've checked your code and still don't understand how the list of 200 phrases gets you to addresses with history of transactions.
I've checked them with multiple hashing SHA256 and only three seem to be valid (with just single SHA256):
raspberry, grotesque, mischievousness

Can you please try explaining again? For example this part:
Quote
export transactions, mess around with this export to get back commonly used words/texts
How do you mess with transactions? There is not much text within a bitcoin transaction.
full member
Activity: 297
Merit: 133
...

I tried a few, by entering the sha256 hash into Bitaddress, and the resulting addresses into Blockchair, but none of them show any past transactions. What did I do wrong? I like the challenge of doing the same for those 40 billion leaked passwords.

I was using SHA256 once and twice, so maybe that's why you don't see any transactions.

I double the passwords by using SHA256 once and twice (this makes the process two times longer).
legendary
Activity: 3290
Merit: 16489
Thick-Skinned Gang Leader and Golden Feather 2021
brainwallets are not popular anymore.
I'm pretty sure some people still use them. Example: me Smiley There's only a smal amount in it, and I haven't checked it for years, but I dare to say my setup is complicated enough to never be brute-forced.

I guess the remaining brainwallets in use have decent passwords too. One way to stop "generic" brute-forcing is by adding something personal as a salt, for instance your licence plate. That easily makes it 8 orders of magnitude more difficult to brute-force, and an attacker would have to "multiply" his database of all existing passwords with all existing licence plates.
I'm not using my licence plate, and I'm not disclosing what I'm doing.
legendary
Activity: 952
Merit: 1385
These are 200 addresses, where there were 18k in the github link. What's the difference? Time?

I think the difference is in pool of used phrases. OP wrote:
From 500 000 passwords I've got

0.5mln is not so much, probably if database would be bigger, there results could be closer to 18k.
It is interesting exercise, but I think currently it has not so much sense, as brainwallets are not popular anymore. It could be good to see which phrases were used, but IMHO it is just a sociological experiment (to see how many people created a wallet using dog's name etc.).
legendary
Activity: 3024
Merit: 2148
This should be a reminder to anyone who wants to make their own brainwallet. There are people out there who have servers for monitoring huge numbers of potential brainwallets, and the moment such address receives coins, they get instantly swept by a bot. Don't think that the passphrase that you came up with is highly complex and unique, it's possible that someone's algorithm will come up with this phrase when they will build their list of potential brainwallets.
sr. member
Activity: 333
Merit: 506
What's a common password? You probably mean hacked passwords which were in sale? Some of these look completely random.

But, this isn't earning, but theft. Even if there was an idiot, who used a brainwallet whose password wasn't strong enough, it wouldn't mean you can take their money. For the same reason you won't steal them if they'd forgotten their wallet right next to you.
I would say those particular ones look completely not random. Many of those would be easily the same person based on the non-randomness of them with more ties possible based on the looking up the originating addresses. I'm thinking about the very not even distribution in it: certain numbers and letters are entirely skipped, some are in caps, there is also the inclusion of certain kinds of words.

These are 200 addresses, where there were 18k in the github link. What's the difference? Time?
legendary
Activity: 3290
Merit: 16489
Thick-Skinned Gang Leader and Golden Feather 2021
Importing 40B of "passwords" into Bitcoin Core would take months, I think, that's why I do not go for that amount.
Doesn't Bitcoin Core fit the entire wallet into RAM? Importing billions of addresses will never work.
If you can help me reproduce the address belonging to any of the 200 "passwords", I'd like to use this to give the 40 billion passwords a try. I think "bitcoin-tool" can create addresses from hex private keys, and from there I can sort and compare them at about a billion at a time. It will take a while, but I'm curious enough to want to know how many of those passwords have been used to create a brainwallet.
full member
Activity: 297
Merit: 133
...

I must have messed sth up with correlation between brainwallet texts and private keys.

Try yourself some solutions! It is fun!



That means my solution could have been so much faster without using Bitcoin Core at all!

Yes, one grep is enough to test all addresses with brainwallets.

I do that in Bitcoin Core, I want to be sure. I place each private key with 0 date so BC scans each private key from the beginning of blockchain.
It takes 2h on my PC with 500k brainwallets.

Importing 40B of "passwords" into Bitcoin Core would take months, I think, that's why I do not go for that amount.

[moderator's note: consecutive posts merged]
legendary
Activity: 3290
Merit: 16489
Thick-Skinned Gang Leader and Golden Feather 2021
Ah, so this is what this other thread of yours is all about: Export private keys that had movement - Bitcoin Core
That means my solution could have been so much faster without using Bitcoin Core at all!

From 500 000 passwords I've got
Where did this list come from? In another topic a link to 40 billion passwords was posted, so why limit yourself to only half a million?

Quote
(SHA256 once and later twice which gives 1M passwords)
I tried a few, by entering the sha256 hash into Bitaddress, and the resulting addresses into Blockchair, but none of them show any past transactions. What did I do wrong? I like the challenge of doing the same for those 40 billion leaked passwords.
full member
Activity: 297
Merit: 133
What's a common password? You probably mean hacked passwords which were in sale? Some of these look completely random.

For example:

https://github.com/dwyl/english-words/blob/master/words.zip

And well known passwords that were used in Linux systems by users over the years.
legendary
Activity: 1512
Merit: 7340
Farewell, Leo
Take common passwords from the Internet, convert them to WIF (line by line), import them in Bitcoin Core, check for transactions (these are there, but addresses are empty)
What's a common password? You probably mean hacked passwords which were in sale? Some of these look completely random.

and earn some free money if someone was dumb enough to actually hold any coins in any of these keys?
But, this isn't earning, but theft. Even if there was an idiot, who used a brainwallet whose password wasn't strong enough, it wouldn't mean you can take their money. For the same reason you won't steal them if they'd forgotten their wallet right next to you.
full member
Activity: 297
Merit: 133
Could you explain exactly how you convert the passwords into WIF format? Because I can't find any used addresses with those passwords you provided with a simple single or double SHA256 like brainwalletx does.

Also, could you give an example of an address that you found that had coins at some point in time? I suspect that your way of connecting which address correspond to which password is flawed.

I use Python script for that:

Code:
#!/usr/bin/env python3

import base58
import hashlib
import sys

with open("input.txt","r") as f:
content = f.readlines()

content = [x.strip() for x in content]

o = open('output.txt','w')

for line in content:
a=line.encode('utf-8')
b=hashlib.sha256(a).digest()
c=b.hex()
d='80'+c
f=bytes.fromhex(d)
g=base58.b58encode_check(f)
h=g+" 0\n"
o.write(h)
i=hashlib.sha256(b).digest()
j=i.hex()
k='80'+j
l=bytes.fromhex(k)
m=base58.b58encode_check(l)
n=m+" 0\n"
o.write(n)

Run under WSL1 on Windows.

Yes, I was doing more research and something is not right with the connection between phrase and address.

I am still in research about the topic.

Now I have managed to get these phrases:

Code:
01201291
065332245
07111996
0953294511
1985aag
1992422
1unseen1
2063045
20683442
250485
25101970
251079
254948
25703581
2580456
259107al
2598897
259988
2679492
269422679
336783
64156415
644lords
6621034
7388b4c4
7sisters
A#45
adagio123
adagny
afddssdf
agnomical
alexboy1
algoristic
anathema
apogee
ariose
atacamenan
autograph's
avsp55
baniva
barriguda
bc1672b798787bf507361247cef6784c7f34cbe13d01da59b369bb050a69792c939adfe6a84f025fb6a1b4e836b94f2c2fff9ba63467bbdb880cd7226f2aa0a9  -
beaching
beachless
beast's
Bette's
billa
blackseed
blya64
BoingBoing00
But I do not propose all these things
byteme1
cabirean
calyceraceous
calyptra
cd0d4cc32346750408f7d4f5e78ec9a6e5b79a0d
cherried
conch's
Confucian's
crane's
crevasse's
Crisco
datachip60
datorn
daunas
daunts
dave
Devil#2017
downspout
dune2
DuPont
edgarela
edgewise
edwardean
efendim
efever79
effacement's
effaces
effectful
entophytically
extracranial
felling
Ferrari@13579
finnish
fl4tr0n
gastroalbuminorrhea
ghghgh77
glaciometer
Golf001
gordon
grotesque
grouped and combined
hallelujah
hhhsmh
Honshu's
hydroferrocyanic
hyperalgesis
inconsidered
incorrigibility's
infamize
inge
inveighing incessantly
jacket's
kaartje1
Kenyans
knighthood's
knur
latirostres
leinad99
Like attempting to number the waves on the snore of a limitless sea
Lizzie
lomekol1
lx76
M@ster#5555
maike
maker
mandarinate
marcus15
marjam52
Maronite
meanness
Meuse's
micaela
mischievousness
mizzle
mouillure
muslined
myroker
mythologist's
neglectingly
nettlefire
Nova#54
octuple
One@45
orthodome
oscheal
otorrhagia
ototomy
pancreatism
parallelepipedic
pomp and pageantry
preprice
promptness's
proteroglyphic
pusey
pyroheliometer
pyrrhonic
quinoline
raspberry
rattoner
recarbonate
redivertible
replicatory
replight
reprosper
reptility
rhemist
salicylize
sanguinicolous
sarahw
sarcocarcinoma
schizaeaceous
scrofuloderma
scrofulosis
seacoast's
semimagical
seroimmunity
Server#98
settee's
sevim
Shadow4444
shamond
Sign1111
skola190
snowberg
standee
startle
Sudoku
swarbie
t3st1ng
tarnishment
tellurism
TORRES33
trionychoid
Trudeau
truelike
unavertibly
unconfinedness
unique personality
unkemptly
unpounded
untumultuous
ustas
walepiece
warmth's
whoknows420
wilma0823
wingspread's
wondermongering
Wroclaw's
Www$
wyne
yak's
zaki67
zeuxian
zingiber
zyklop
full member
Activity: 161
Merit: 230
Could you explain exactly how you convert the passwords into WIF format? Because I can't find any used addresses with those passwords you provided with a simple single or double SHA256 like brainwalletx does.

Also, could you give an example of an address that you found that had coins at some point in time? I suspect that your way of connecting which address correspond to which password is flawed.
legendary
Activity: 3668
Merit: 6382
Looking for campaign manager? Contact icopress!
I guess I expected some luck to find any balance, but didn't.

The thing is.. especially since it was noticed how unsafe brainwallets are, most probably others have done this job already... years ago (this is usually one of the big problems in reinventing the wheel).
full member
Activity: 297
Merit: 133
Those are brainwallet and they were very common in bitcoin's early days. No one uses them anymore since they are unsafe and it doesn't matter how many time you hash the password.
Someone already found more than 18k used addresses. You can check his topic here for more details:
Collection of 18.509 found and used Brainwallets

There are many bots monitoring these addresses 24/24 to steal any coins they receive. This why you probably will never find any brain wallet with a balance.

I have one 8 GB wallet and it does have very many transactions.

Volume of my experimental wallets is 78 GB in size.

I didn't found any address that have any positive balance. Excluding prepared fake wallet with ~150 BTC.

@nc50lc I didn't known the name "brainwallet" but that's right! I am trying brainwallets.

@pooya87 I guess I expected some luck to find any balance, but didn't. I have my job, I do that in free time.
legendary
Activity: 3472
Merit: 10611
So what's the point of all this effort that you put into this work? Is it to get lucky and earn some free money if someone was dumb enough to actually hold any coins in any of these keys?
I assure you that you would have earned a lot more money if you had spent your time more constructively.
legendary
Activity: 2534
Merit: 6080
Self-proclaimed Genius
Ah, so this is what this other thread of yours is all about: Export private keys that had movement - Bitcoin Core

You basically reinvented "Brainwallet" if you're not aware of the term.
legendary
Activity: 2702
Merit: 3045
Top Crypto Casino
Those are brainwallet and they were very common in bitcoin's early days. No one uses them anymore since they are unsafe and it doesn't matter how many time you hash the password.
Someone already found more than 18k used addresses. You can check his topic here for more details:
Collection of 18.509 found and used Brainwallets

There are many bots monitoring these addresses 24/24 to steal any coins they receive. This why you probably will never find any brain wallet with a balance.
sr. member
Activity: 333
Merit: 506
Beautiful work there. Thanks for sharing.

Code:
01201291
065332245
07111996
0953294511
1985aag
1992422
1unseen1
2063045
20683442
250485
25101970
251079
254948
25703581
2580456
259107al
2598897
259988
2679492
269422679
336783
64156415
644lords
6621034
7388b4c4
7sisters
A#45
adagio123
adagny
afddssdf
agnomical
alexboy1
algoristic
anathema
apogee
ariose
atacamenan
autograph's
avsp55
baniva
barriguda
beaching
beachless
beast's
Bette's
billa
blackseed
blya64
BoingBoing00
But I do not propose all these things
byteme1
cabirean
calyceraceous
calyptra
cd0d4cc32346750408f7d4f5e78ec9a6e5b79a0d
cherried
conch's
Confucian's
crane's
crevasse's
Crisco
datachip60
datorn
daunas
daunts
dave
Devil#2017
downspout
dune2
DuPont
edgarela
edgewise
edwardean
efendim
efever79
effacement's
effaces
effectful
entophytically
extracranial
felling
Ferrari@13579
finnish
fl4tr0n
gastroalbuminorrhea
ghghgh77
glaciometer
Golf001
gordon
grotesque
grouped and combined
hallelujah
hhhsmh
Honshu's
hydroferrocyanic
hyperalgesis
inconsidered
incorrigibility's
infamize
inge
inveighing incessantly
jacket's
kaartje1
Kenyans
knighthood's
knur
latirostres
leinad99
Like attempting to number the waves on the snore of a limitless sea
Lizzie
lomekol1
lx76
M@ster#5555
maike
maker
mandarinate
marcus15
marjam52
Maronite
meanness
Meuse's
micaela
mischievousness
mizzle
mouillure
muslined
myroker
mythologist's
neglectingly
nettlefire
Nova#54
octuple
One@45
orthodome
oscheal
otorrhagia
ototomy
pancreatism
parallelepipedic
pomp and pageantry
preprice
promptness's
proteroglyphic
pusey
pyroheliometer
pyrrhonic
quinoline
raspberry
rattoner
recarbonate
redivertible
replicatory
replight
reprosper
reptility
rhemist
salicylize
sanguinicolous
sarahw
sarcocarcinoma
schizaeaceous
scrofuloderma
scrofulosis
seacoast's
semimagical
seroimmunity
Server#98
settee's
sevim
Shadow4444
shamond
Sign1111
skola190
snowberg
standee
startle
Sudoku
swarbie
t3st1ng
tarnishment
tellurism
TORRES33
trionychoid
Trudeau
truelike
unavertibly
unconfinedness
unique personality
unkemptly
unpounded
untumultuous
ustas
walepiece
warmth's
whoknows420
wilma0823
wingspread's
wondermongering
Wroclaw's
Www$
wyne
yak's
zaki67
zeuxian
zingiber
zyklop

"Like attempting to number the waves on the snore of a limitless sea"

A poetic description of all addresses. So beautiful, nearly numberless in possibility, yet eventually boring.
full member
Activity: 297
Merit: 133
Theory:

Take common passwords from the Internet, convert them to WIF (line by line), import them in Bitcoin Core, check for transactions (these are there, but addresses are empty),
export transactions, mess around with this export to get back commonly used words/texts as private key sources (that had transactions).

Effect:

From 500 000 passwords I've got (SHA256 once and later twice which gives 1M passwords) ca 200 passwords that have been used as source for private key (later converted to WIF).
Each line represents text which converted to private key/WIF (sha256 once and twice) would give address with transactions. So these are "passwords" which people used for their generation of addresses.

These are the passwords:

Code:
01201291
065332245
07111996
0953294511
1985aag
1992422
1unseen1
2063045
20683442
250485
25101970
251079
254948
25703581
2580456
259107al
2598897
259988
2679492
269422679
336783
64156415
644lords
6621034
7388b4c4
7sisters
A#45
adagio123
adagny
afddssdf
agnomical
alexboy1
algoristic
anathema
apogee
ariose
atacamenan
autograph's
avsp55
baniva
barriguda
beaching
beachless
beast's
Bette's
billa
blackseed
blya64
BoingBoing00
But I do not propose all these things
byteme1
cabirean
calyceraceous
calyptra
cd0d4cc32346750408f7d4f5e78ec9a6e5b79a0d
cherried
conch's
Confucian's
crane's
crevasse's
Crisco
datachip60
datorn
daunas
daunts
dave
Devil#2017
downspout
dune2
DuPont
edgarela
edgewise
edwardean
efendim
efever79
effacement's
effaces
effectful
entophytically
extracranial
felling
Ferrari@13579
finnish
fl4tr0n
gastroalbuminorrhea
ghghgh77
glaciometer
Golf001
gordon
grotesque
grouped and combined
hallelujah
hhhsmh
Honshu's
hydroferrocyanic
hyperalgesis
inconsidered
incorrigibility's
infamize
inge
inveighing incessantly
jacket's
kaartje1
Kenyans
knighthood's
knur
latirostres
leinad99
Like attempting to number the waves on the snore of a limitless sea
Lizzie
lomekol1
lx76
M@ster#5555
maike
maker
mandarinate
marcus15
marjam52
Maronite
meanness
Meuse's
micaela
mischievousness
mizzle
mouillure
muslined
myroker
mythologist's
neglectingly
nettlefire
Nova#54
octuple
One@45
orthodome
oscheal
otorrhagia
ototomy
pancreatism
parallelepipedic
pomp and pageantry
preprice
promptness's
proteroglyphic
pusey
pyroheliometer
pyrrhonic
quinoline
raspberry
rattoner
recarbonate
redivertible
replicatory
replight
reprosper
reptility
rhemist
salicylize
sanguinicolous
sarahw
sarcocarcinoma
schizaeaceous
scrofuloderma
scrofulosis
seacoast's
semimagical
seroimmunity
Server#98
settee's
sevim
Shadow4444
shamond
Sign1111
skola190
snowberg
standee
startle
Sudoku
swarbie
t3st1ng
tarnishment
tellurism
TORRES33
trionychoid
Trudeau
truelike
unavertibly
unconfinedness
unique personality
unkemptly
unpounded
untumultuous
ustas
walepiece
warmth's
whoknows420
wilma0823
wingspread's
wondermongering
Wroclaw's
Www$
wyne
yak's
zaki67
zeuxian
zingiber
zyklop
Jump to: