You're using math that assumes people generate their passphrases or passwords randomly. It is possible for people to do this. A small number of them do. The problem is that, as every database leak that's included hashed passwords has shown, the vast majority of people choose weak passwords. This is a problem, since brainwallets automatically leak what amounts to a hash immediately on use.

So yes, I believe that most people are not capable of choosing a password or passphrase that is sufficiently strong to use as a brainwallet, and there is a mountain of evidence to support me. This is not a matter of ego. I would not feel comfortable in my ability to come up with a password or passphrase that could not be cracked without a secure random number generator. Is it really so hard to believe that I, and others like me, genuinely want to help prevent people from losing money?

I am not saying "it's impossible to create a brainwallet that won't be cracked". My argument is that so many people are not able to evaluate whether their passwords or passphrases are strong enough that assisting them in creating a brainwallet is an act of gross negligence.

I was asked by someone to comment here, since I wrote brainflayer and have coauthored two papers about brainwallet cracking.


Haven't I seen you posting https://bitcointalk.org/index.php?topic=421842.0 in the past about cracking bitcoin keys? Hard to tell, since you've tried to purge your old posts, but your motivation here is highly suspect.

What motivation do you think us "crypto guys" have for trying to prevent people from using brainwallets, other than to save people from themselves?


You didn't read the paper, then. Threads on bitcoin talk where people are bragging about cracking brain wallets are listed. Hundreds of BTC have been taken.

I have personally had correspondence with people who have lost over 100BTC due to forgetting their brainwallet passphrase. I spoke on the phone with someone who lost about 47k ether from a brainwallet.

If someone wants to store bitcoin using a memorized secret, they should use BIP39, optionally combined with BIP32, and use spaced repetition to memorize the seed.

If you absolutely insist on coming up with a passphrase yourself and storing bitcoin with it, go use WarpWallet with your email address, name, or phone number as a salt. It's several orders of magnitude more secure against cracking, and multiple independent implementations of the algorithm exist.

Actually, let's make that 5BTC or $3000 worth of BTC based on CoinDesk's bitcoin price index at the time of claim, whichever is more. I'm sure otherwise, someone will claim I'm assuming that me having to pay would crash the price.

If blockchain.info still has the feature that allows a "public message" to be added to a transaction, that would be a good option for signaling. A message could also be encoded in a series of vanity addresses.

For the fellow who figured "how much wood could a woodchuck chuck if a woodchuck could chuck wood" would make for a good brainwallet password, I was able to track him down via his transactions, but luck was a major factor in my ability to do that.

This problem was actually discussed somewhat by a fellow who went by "btcrobinhood" on reddit, see here: https://github.com/btcrobinhood/bips/blob/master/bip-1337.mediawiki (note that I have no opinion on that proposal at this time).

Well, this result demonstrates that only the outputs of that puzzle transaction were searched by whoever did that, which only mildly surprises me.

If someone posts in this thread a different private key that also works out to 1PVwqUXrD5phy6gWrqJUrhpsPiBkTnftGg, I'll pay them 5BTC.

The explanation is either a deliberately weak key or bad generation code, and I'm saying that deliberately weak seems more likely because I can't come up with a good explanation of how bad generation code would result in that particular key.

It is far more plausible that this was a "challenge" someone made, to see how long it would take to be solved - I have found many such transactions. I doubt that a weak PRNG is the cause of this key, but it being a collision with a properly generated key is so unlikely that we can safely assume that is not what happened. Even if it were, it's not really any cause for concern. Managing to crack a single key via collision by absurd luck is not going to be repeatable.

A few keys I've found:

I don't understand why you would give that advice, given that you're aware that it is much easier (but still so hard as to be not a remotely plausible threat) to brute force a collision with a P2SH address than it is to do so for a P2PKH address.

Overnight, I got the same email to both my butterfly labs email address and bitcointalk address.

The attacks described in the paper only apply to reduced round versions of keccak which aren't ever used other than for cryptanalysis. They won't work on the regular version, which has 24 rounds.

That would be *very* weak as a password hashing algorithm, and I doubt this is true. Simple Machines Forum seems to use salted sha1 as the default.

Edit: On LeakedSource, it says very old passwords were hashed with md5 and newer ones were hashed with sha256crypt (which is salted and slow).

I am also seeing this. I use a unique email address that is a long string of random alphanumeric characters - too many to guess. It was added to my bitcoin talk account February 2013.

One from "BitCoin-Carrding" admin@ink-hack.su, and just now 'Eden Smizaski invited you to view the file "WorldPay_Trade_Report_-_ September 2016.zip" on Dropbox.' which is a zipfile full of nasty obfuscated javascript.

That was accounted for in my estimate.

There's a fork of vanitygen that will generate vanity p2sh addresses using a script in the format of [OP_1 PUBKEY OP_1 OP_CHECKMULTISIG], and there are more efficient methods possible.

I recently generated this one: 1woukheyeacxfpxtpkxjqxureevdkbywj

I have a few that are all uppercase aside from the 1 as well, though I haven't used them.

This one's a little silly:

1MdxK1BVKBMTv8VdBTKy8Kx3BBvVvK8vyd

Contains only twelve unique characters.

Generating addresses with no repeated characters is trivially easy.

FWIW, my interest in this project is primarily to find various "easter egg" transactions people have made, and try to infer the cracking others have done in the past. I find it unlikely at this point that there are keys produced by broken random number generators that have not already been drained.

Do you simply not understand the concept of geeks sinking a bunch of time into a project because they enjoy it?

For example, people are still working on cracking the RC5-72 challenge even though there's little point to it now, and no possibility of making money off it.

It'll be mostly based on supervanitygen - it has a bunch of very nice optimizations for fast incremental searching, and I've been hacking on the code for other projects.

FWIW, I just posted this: https://rya.nc/forensic-bitcoin-cracking.html

The first unspent output on the transaction described should be somewhere between 2^51 and 2^52, but it's only worth a few dollars.

I'm using custom software to generate mine, but in general, check out vanitygen. Depending on what you want, it may take a long time.

Alrighty, mission accomplished.  
This one has 32 lowercase letters - everything but the leading 1.

-----BEGIN BITCOIN SIGNED MESSAGE-----
2016-09-02 controlled by ryanc
-----BEGIN SIGNATURE-----
1woukheyeacxfpxtpkxjqxureevdkbywj
IAlRxeZ5ucqbGmcwsINInPJA4uzD3GKLMk2IPiJzLHGBEL3UxvtFunkUU0GpIkJHVIB5d9TyLVcL3dZ bBDdrQIQ=
-----END BITCOIN SIGNED MESSAGE-----