How safe is a brain wallet?

Question

Edit: The answer is that they are unsafe and have been attacked. Please don't use them!

Brain wallets can be created with a (minimum 15 character) pass phrase at https://www.bitaddress.org

There are no warnings given on the site about the safety of this. How secure are brain wallets?

A recent contest provided 5 bitcoin (receiving) addresses generated with a brain wallet pass phrase, with each address holding 1BTC as a prize.

The challenger did give some hints along the way, but within 7 hours, the first prize was taken, and after around 18 days, all of them were taken.

The author of the blog summarises that brain wallets are generally safe, but is this really the case?

With a well indexed database of the existing Bitcoin addresses that hold a positive balance and a well-tuned script for trying out likely pass phrases, surely there's some quite long phrases that would still be easy to guess?

Answer 1

This question is marked as answered, but it was answered back in 2013. The answer has changed since then. Here's a reply from 2015.

Brainwallets are hideously insecure. Don't use them. EVER!

Don't take my word for it. Here are some references:

http://www.coindesk.com/new-cracking-tool-exposes-major-flaw-in-bitcoin-brainwallets/

https://en.bitcoin.it/wiki/Brainwallet#Low_Entropy_from_Human-Generated_Passphrases

If you want an easy-to-memorize phrase, use Electrum or BIP0039. Don't use a brainwallet.

Answer 2

They can be made a heck-of-a-lot safer with simple key-stretching. The WarpWallet runs Scrypt on your passphrase, and outputs a string in the full 256-bit keyspace. It's at least 1000x more expensive to guess a WarpWallet address than a standard brainwallet address. And if you had access to high-end scrypt-computing hardware, you're probably better off using it to mine litecoins rather than go after WarpWallets. See https://keybase.io/warp. There's a 20BTC challenge to solve an 8-letter WarpWallet passphrase that's been open for almost a month.

Answer 3

If anything, then the contest just proved that brainwallets is more secure than one would think. After a few hours the "lorem ipsum dolor sit amet" address was "cracked", after two weeks the rest wasn't cracked.

The author of the contest (linjaaho) gave A LOT of hints, but even though that, it took around two days for the rest of the addresses to be cracked (and seriously 4 * "fuck", 3 * "testing", 3 * "aurinko" (sun), 3 * "goatse" is very easy passwords especially for someone knowing the hints).

So in the end, I would say that the contest just showed that brainwallets is way more safe that I would have thought. However, if you use a weak password then of course it would be better to use random. Also note that the default behaviour of bitcoin-qt (send charge to a new address) has some privacy and security advantages: https://bitcoin.stackexchange.com/a/8192/2785

Answer 4

There are no warnings given on the site about the safety of this. How secure are brain wallets?

As secure as you make them, in my opinion. Let's say you use all 92 characters in your password, and it's 30 letters long. That gives you an entropy of 92^30, or 195 bits. It would take more energy than can possibly be produced on earth to brute force it.

https://crypto.stackexchange.com/a/1160

These numbers have nothing to do with the technology of the devices; they are the maximums that thermodynamics will allow. And they strongly imply that brute-force attacks against 256-bit keys will be infeasible until computers are built from something other than matter and occupy something other than space.

Of course, there are probably side-channel attacks against it. However, I don't know enough about the implementation he's using to say.

With a well indexed database of the existing Bitcoin addresses that hold a positive balance

You don't need one. You just need a bloom filter with every bitcoin address ever seen in the blockchain, which can actually fit in 50 MB or so.

Answer 5

Bit-for-bit, a human-generated password/passphrase will be lower entropy than a randomly generated one. This means that you will need to come up with a pretty long string (minimum of 30 characters, preferably longer than 40) and truly use your brain to create one. You need to minimize the use of full words, avoid sentences and common phrase structure, mix information (don't just use one piece of information to encode, use three or more), and generally make the string as random-looking as you can. The trade-off is that the closer you make it appear to a random one, the less likely you will be able to commit it to memory.

Ideally, you want to construct your password/passphrase offline, just in case.

As an example of the kind of password you are looking to construct, consider this:

cyFtlt9nuLeet$dyKtyt0tuWtec#iaGiab9maEnaE(ejnnbsyscaaa

This was created with 3 pieces of information related to three formerly popular songs, by three different artists. It is not random, and it is constructed from information I already have committed to memory. If I forget this password, I can always reconstruct it from the same base info.

If you can create a long password in a similar vein (using information only you have intimate familiarity with), and your computer is not compromised in some way, then you can create a secure brainwallet. If you can't, then I wouldn't recommend it. Memorizing a 12 word BIP39 recovery seed might be more up your alley.