I received this email today:



I clicked on the button and I was redirected to a website with a strange domain name: i4tprol8ckgjwhlysqxabacf.alimentaegypt.com

And see what they asked me to do:



It is very certain it was made to steal Exodus wallets.


And this official page from the real Exodus app alerts:

https://support.exodus.com/article/638-i-received-an-email-from-exodus-asking-me-to-provide-my-12-word-phrase-password

[0.38]

Well, it all started yesterday when I received a message in Telegram from this supposed exchange.

They told me I received a prize in Bitcoin of approximately 0.38 (about 14 000 USD).

The message I received from them told me that it was very easy to withdraw funds:

   Нow уou can сollect уour winnings?

   1.Register аn aсcount оn thе ехchаngеr: http://bit.ly/xlmcahype
   2.Gо tо settings
   3.Yоu can аctivatе thе рromo cоde on thе «Sеttings» -> «Referral prоgrаm»
   4.Withdraw BTС tо your addrеss
   5.Dоne

But it was not as easy as expected. I can only withdraw funds to external addresses if I make a deposit of 200 USD from that address.

It sounded suspicious to me. So, I am not going to make a deposit to try and get that 0.38 BTC because I probably will not get it (but surely they will get my 200 USD).

   ...let your ‘Yes’ be ‘Yes,’ and your ‘No,’ ‘No.’

      For whatever is more than these is from the evil one. - Matthew 5:37

You have been warned!

[4 294 967 296]

People said Bitcoin private keys should be random, and generated from a random source. OK, I agree.

But I see there is a problem with that kind of usage as losing keys are very easy and remembering all of them is not practical.

Deterministic wallets solve the problem, but you still have to rely on complicated parsing of data and software to interpret them.


Then why not simply one pick a random private key:

Code:

0x72401339D3318F8FA1707C21447D220ED03D1086E1D0388F976C8DE223619C77

And mask it with a random pattern, for example I know I will not use more than 4 294 967 296 addresses in my lifetime then we can do:

Code:

0xFFFFFFFFFFFFFFF00000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
and
0x72401339D3318F8FA1707C21447D220ED03D1086E1D0388F976C8DE223619C77
------------------------------------------------------------------
0x72401339D3318F8000000001447D220ED03D1086E1D0388F976C8DE223619C77

Then I know all my private keys are within the range:

Code:

0x72401339D3318F8000000001447D220ED03D1086E1D0388F976C8DE223619C77 - 0x72401339D3318F8FFFFFFFF1447D220ED03D1086E1D0388F976C8DE223619C77

And this can be applied to most (if not all) coins. A single point of failure, we can even write it down on a piece of paper easily; no need to track thousands of random private keys that can get lost or a big and complicated to parse file you can't write down.


I am not saying everyone should adopt this method or anything, this choice is personal.


My question is: There are any known problems or risks of using such a method? Is there a weakness somehow for using addresses like that? It is OK "x and x+1" private keys, or should this be avoided?


Thank you!


EDIT:
Probably a less riskier, more realistic, yet simple alternative (about 1 million addresses, which is more than enough for most people):

Random key:

Code:

0x397263A2C8131ABE3BEF02ECCA92F3AC751C50B7232816A9767B0386710DA6DF

Random mask:

Code:

0xFFFFFFF0FFFFFFFFFFFFF0FFFFFFFFFF0FFFF0FFFFFFFFFFFFFFFFF0FFFFFFFF

Addresses range:

Code:

0x397263A0C8131ABE3BEF00ECCA92F3AC051C50B7232816A9767B0380710DA6DF - 0x397263AFC8131ABE3BEF0FECCA92F3ACF51C5FB7232816A9767B038F710DA6DF

It may be a bit inconvenient to generate many addresses, but just a quick script will do that. The important is that you just need one key and one mask, the rest is just simple.