Everyone keeps saying brain wallets are insecure. Can someone explain to me WHY?
What if I had a brain wallet that is 200 characters long which is the concatenation of all of my family members names along with punctuation's and numbers? How about that?
And how long is a private key? I don't see how a brain wallet is insecure if you come up with something ONLY you can know.
Someone else already mentioned entropy. Humans are really bad at creating randomness. But that's only one part of it. The other part is time, and how it's on the attacker's side.
An attacker can generate a lot of brainwallets with a lot of different words and phrases. Then they watch the blockchain to see if any of those addresses receive coins. If they do, the attacker swoops in and steals the coins. What does the attacker do while he's waiting? Generate more brainwallets! Every dictionary word. Every l33tspeak variant of every dictionary word. All short phrases. All phrases in every book, ever. Obscure foreign-language poems. Bitcoin addresses don't take up much storage space, so the attacker can keep them all and watch them. He has all the time in the world.
Maybe you'll be lucky and find a passphrase that no one else has generated. But it's risky. On the other hand, you can easily generate a secure and memorable wallet with Electrum, which translates a 128-bit random key into twelve words. There are also other mnemonic systems you can use. So why risk getting your coins stolen from your brainwallet when it's so easy to store them securely?
It's not to do with length, but entropy. Humans are terrible at creating randomness, even what you think is hard to guess could in all probability be guessed with enough iteration.
Family names for example are easy to guess, there's a finite number of them and a vast portion of names are from a set of only a few hundred.
What's the chance of you remembering what names are, the spelling, punctuation and ordering? Fairly low I suspect, humans are also terrible at remembering explicit data like that.
As soon as people start trying to be clever, the probably shifts from theft to irrecoverable loss. Just use the cryptographic keys the way they are supposed to be used, 256 bits of entropy created with a CSRNG.
200 characters sounds a bit excessive to me. What are the chances of a typo while trying to enter your password, just to generate the private key?
My suggestion, if you wish to use a secure enough password, is first to make sure you are not largely using actual words or phrases. Certainly, use information only you know, organized in a way only you could reconstruct readily and consistently. I'd keep the length under 100 characters, so as to minimize the chances of persistent typos.
A random private key would still be mathematically more secure, but the chances of loss may be higher if you have difficulty securing and protecting it. How many people have "lost" Bitcoin because they forgot the password to their wallet, or the wallet was uninstalled? How many people have had their Bitcoin stolen because copies of the keys were stored in an unsecure fashion or location?
You really need to find your risk tolerance on both sides. Do you want something less cryptographically secure but more easily recoverable (lower chance of loss, higher chance of theft), or more cryptographically secure and less easily recoverable (higher chance of loss, lower chance of theft)?
I personally lean toward making a brainwallet password which is secure enough to protect my Bitcoin for the length of my lifetime (or longer, if possible), rather than use a piece of wallet software where I might lose the private keys if my hard drive fails, or where copies of the private keys may be more readily stolen because I couldn't keep them secure enough.
Very interesting presentation on this topic, about cracking bitcoin brainwallets:
Brain wallets can be secure, if you can generate and remember about 80 bits of entropy and they are processed with an an appropriate key hardening algorithm like bcrypt or scrypt. A random English word has about 12 bits, so about seven words is the bear minimum, or about 13 completely random base64 characters.
Since most people will chose something like 'uberSecret#wallet87' that barely has 40 bits of entropy, most such seeds are easily guessed in a few minutes on an ordinary computer so brain wallets should be used only by people who understand what they are doing. A standard step in any password hack is getting the cyphertext of the password - in Bitcoin's case that is distributed through the blockchain to a global network of people with the hardware and skills to attack it. Also, there is no salting, so you really need at least 80 bits.
Assuming that there are ~2000 possible names and in total 20 members of the family you could name like that, you'd have 2000^20 ~ 2^245 possible combinations, so it wouldn't be awful in comparison to a CSPRNG. And yes, if you happened upon a combination of characters no other human being considers plausible that would be secure. However, the chances of that given that we're tuned to producing sequences that others can relate to are not as good as you'd think.
The biggest flaw is that you'd be using public information. Given a birth registry, one could generate all possible passwords with the family name scheme quite quickly. There are only n_population combinations which is nothing for a password cracker. You run into a similar problem if you decide to use a poem, the SHA256 of the PNG of your favourite meme, a StackOverflow answer or anything else that seems obscure but is inherently in the public sphere. SHA256 of a baby photo only you have? Maybe. But then again, its probably just as much trouble to store the SHA256 itself, and a CSPRNG will give you that.
Also you can do this exactly once. If someone finds your scheme and lands on your combination then what? Adding a few characters and numbers to spice things up after that will create a key that isn't all that different from the perspective of a password cracker since then you'll effectively be using a password of maybe 8 characters once someone knows your original one. Sure, you could go wild here, but you step into territory where you might as well just use a CSPRNG since it'll be just as hard to remember. Its not impossible that this could happen with a CSPRNG but all you do then is spin it up and use the next combination it gives.
Its all about risk really. If you and your friends decide to put the Poker pot into a wallet secured by the SHA256 of an image of the party sitting around the table? Maybe that's enough if the wallet is only used for the night. But if you want to do anything longer term with a more significant amount of money, then I say go with the recommendations of people that have studied this problem purely from the security perspective.
