12

Edit: The answer is that they are unsafe and have been attacked. Please don't use them!

Brain wallets can be created with a (minimum 15 character) pass phrase at https://www.bitaddress.org

There are no warnings given on the site about the safety of this. How secure are brain wallets?

A recent contest provided 5 bitcoin (receiving) addresses generated with a brain wallet pass phrase, with each address holding 1BTC as a prize.

The challenger did give some hints along the way, but within 7 hours, the first prize was taken, and after around 18 days, all of them were taken.

The author of the blog summarises that brain wallets are generally safe, but is this really the case?

With a well indexed database of the existing Bitcoin addresses that hold a positive balance and a well-tuned script for trying out likely pass phrases, surely there's some quite long phrases that would still be easy to guess?

3

This question is marked as answered, but it was answered back in 2013. The answer has changed since then. Here's a reply from 2015.

Brainwallets are hideously insecure. Don't use them. EVER!

Don't take my word for it. Here are some references:

http://www.coindesk.com/new-cracking-tool-exposes-major-flaw-in-bitcoin-brainwallets/

https://en.bitcoin.it/wiki/Brainwallet#Low_Entropy_from_Human-Generated_Passphrases

If you want an easy-to-memorize phrase, use Electrum or BIP0039. Don't use a brainwallet.

4

They can be made a heck-of-a-lot safer with simple key-stretching. The WarpWallet runs Scrypt on your passphrase, and outputs a string in the full 256-bit keyspace. It's at least 1000x more expensive to guess a WarpWallet address than a standard brainwallet address. And if you had access to high-end scrypt-computing hardware, you're probably better off using it to mine litecoins rather than go after WarpWallets. See https://keybase.io/warp. There's a 20BTC challenge to solve an 8-letter WarpWallet passphrase that's been open for almost a month.

  • As of today, it's still there. – Murch Feb 17 '14 at 10:11
  • 1
    98 days and still safe so far (note that half the reward is held separately): blockchain.info/address/1AdU3EcimMFN7JLJtceSyrmFYE3gF5ZnGj – Will Bickford Feb 26 '14 at 4:31
  • 1000x safer doesn't sound like a lot. It's just a few more character or one more word. – Omar Abid Nov 5 '15 at 8:09
  • It is worth noting that if the brain wallet generates BIP 39 seed words (see github.com/libbitcoin/libbitcoin-explorer/wiki/bx-mnemonic-new), the BIP 39 synthesis process natively uses PBKDF2 using 2048 rounds of HMAC-SHA512 which adds computational stretching that supports and additional passphrase. However, the base brainwallet phrase needs adequate entropy (~128 bits), and should not exist elsewhere on the Internet. – skaht Feb 24 at 4:10
3

If anything, then the contest just proved that brainwallets is more secure than one would think. After a few hours the "lorem ipsum dolor sit amet" address was "cracked", after two weeks the rest wasn't cracked.

The author of the contest (linjaaho) gave A LOT of hints, but even though that, it took around two days for the rest of the addresses to be cracked (and seriously 4 * "fuck", 3 * "testing", 3 * "aurinko" (sun), 3 * "goatse" is very easy passwords especially for someone knowing the hints).

So in the end, I would say that the contest just showed that brainwallets is way more safe that I would have thought. However, if you use a weak password then of course it would be better to use random. Also note that the default behaviour of bitcoin-qt (send charge to a new address) has some privacy and security advantages: https://bitcoin.stackexchange.com/a/8192/2785

3

There are no warnings given on the site about the safety of this. How secure are brain wallets?

As secure as you make them, in my opinion. Let's say you use all 92 characters in your password, and it's 30 letters long. That gives you an entropy of 92^30, or 195 bits. It would take more energy than can possibly be produced on earth to brute force it.

https://crypto.stackexchange.com/a/1160

These numbers have nothing to do with the technology of the devices; they are the maximums that thermodynamics will allow. And they strongly imply that brute-force attacks against 256-bit keys will be infeasible until computers are built from something other than matter and occupy something other than space.

Of course, there are probably side-channel attacks against it. However, I don't know enough about the implementation he's using to say.

With a well indexed database of the existing Bitcoin addresses that hold a positive balance

You don't need one. You just need a bloom filter with every bitcoin address ever seen in the blockchain, which can actually fit in 50 MB or so.

  • What do you mean by 92 characters in the password, especially in relation to bits? 26 letters in the alphabet * 2 (uppercase/lowercase) * symbols doesn't equal this (AFAIK - unless you're speaking of chars that aren't typical ASCII) – random65537 Mar 18 '13 at 5:36
  • 1
    @makerofthings7 You're forgetting numbers, and ><?:"{}|_+-=[]\;',./ Speaking of which, I forgot three more: `~ and space. – Nick ODell Mar 18 '13 at 6:33
  • 1
    92 characters is nice and all but as hotly debated as the XKCD password theory is, I have to admit there is some truth in saying that a long password you can remember is much better than a short one you can't. – David Perry Mar 18 '13 at 6:58
  • @DavidPerry My point is merely that you could create a very secure brainwallet. This doesn't mean that a password of 'asdfasdfasdfasdf' is secure. – Nick ODell Mar 18 '13 at 7:05
  • what if you made a brain wallet with chinese characters? or ascii codes that aren't on the keyboard? – Patoshi パトシ Jul 6 '15 at 3:57
0

Bit-for-bit, a human-generated password/passphrase will be lower entropy than a randomly generated one. This means that you will need to come up with a pretty long string (minimum of 30 characters, preferably longer than 40) and truly use your brain to create one. You need to minimize the use of full words, avoid sentences and common phrase structure, mix information (don't just use one piece of information to encode, use three or more), and generally make the string as random-looking as you can. The trade-off is that the closer you make it appear to a random one, the less likely you will be able to commit it to memory.

Ideally, you want to construct your password/passphrase offline, just in case.

As an example of the kind of password you are looking to construct, consider this:

cyFtlt9nuLeet$dyKtyt0tuWtec#iaGiab9maEnaE(ejnnbsyscaaa

This was created with 3 pieces of information related to three formerly popular songs, by three different artists. It is not random, and it is constructed from information I already have committed to memory. If I forget this password, I can always reconstruct it from the same base info.

If you can create a long password in a similar vein (using information only you have intimate familiarity with), and your computer is not compromised in some way, then you can create a secure brainwallet. If you can't, then I wouldn't recommend it. Memorizing a 12 word BIP39 recovery seed might be more up your alley.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.