Globalmente falando era difícil acertar nas palavras escolhidas por alguém escolhido aleatoriamente. Mas, conhecendo uma pessoa pessoalmente, o cenário muda um pouco. Porque normalmente as pessoas vão dizer palavras que gostam, como o animal preferido, a fruta preferida, o mês preferido, etc. Então o acertar nas palavras acaba por ser mais fácil.
Sim, isso é verdade e como o ser humano não é uma boa fonte de entropia, isso acaba por criar uma seed com baixíssima entropia, o que tornaria extremamente arriscado usá-la, a não quer que adicionasse BIP39 Passphrase, escolhendo uma senha difícil como 7JF(F)CrPAa,]dUs^IPp ou usar palavras aleatórias (em torno de 6 a 8 palavras já fica bom) pra ficar mais fácil de memorizar já forneceria ótima segurança. Ex: desabafar
alojar
antimicótico
perdeste
axonal
estivesse
vaselina
terço
Eu usei como exemplo palavras em português, mas eu recomendaria palavras em inglês, pois com à acentuação e o "ç", ficaria mais difícil a recuperação... |
|
|
|
|
Ei my man, eu li seu tópico, mas como estava meio sem tempo, não deu pra ler tudo, você quer extrair as chaves privadas em formato WIF, certo? Essa wallet da peach não fornece um mnemônico? Você pode através do mnemônico BIP39 restaurar as chaves privadas de cada endereço em formato WIF em ferramentas para uso offline como Electrum, iancoleman etc, definindo corretamente o derivation path.
Seria ótimo se você fizesse um vídeo demonstrando como desvendou o mistério, eu acho ótimo essas coisas. Mas sei que fazer um vídeo requer muito tempo e pode ser trabalhoso, mas pretendo voltar aqui quando estiver aprendendo python (atualmente eu não conheço ou sei como usar essa linguagem).
|
|
|
|
I believe that some already know this project that can work offline similar to iancoleman.io/bip39 but this one is more updated and with more features, such as displaying P2TR addresses for Bitcoin (only works for Bitcoin and Testnet). The Projetc: https://bitcoiner.guide/seed/ Github: https://github.com/BitcoinQnA/seedtool However, when i go to the tool's github to download the public key to verify and validate the .html file, the public key is simply unavailable and I can't verify the integrity of the file, as per the command below, the key is unavailable. curl -sL https://bitcoiner.guide/public.key | gpg --import
gpg: no valid OpenPGP data found.
gpg: Total number processed: 0 There is a request on github stating that the public key is unavailable but there was no response. Does anyone have the public key for this tool and could post it here in text format or pastebin link? I know some will respond: Why not use the iancoleman that everyone knows? Well, iancoleman's tool is wonderful, as is this one too, but it seems that the dev left the project and is not adding any more features or updates, but this one has more resources such as last word generator, p2tr addresses to view, etc |
|
|
|
Eu estava pensando que praticamente todo serviço que você envia btc serve como mixer.
Se você enviar pra um casino e sacar, você poderá também receber outras moedas.
Concordo, se eu enviar/trocar moedas pra uma shapeshift da vida ou semelhante, vou receber a quantia equivalente menos as taxas em outra moeda que eu escolher, qual a diferença disso pra um mixer? Tudo bem que o mixer faz diversos envios simultâneos, esse é um detalhe importantíssimo que classica um serviço como um mixer. Tá virando uma bagunça, depois reclamam que é praticamente só os casinos que promovem campanhas de assinaturas, pois praticamente qualquer serviço de trocas de moedas podem ser considerados como mixer... Existe muita forma de fazer as coisas. Por isso, deve haver um equilibro nessa analise. Esse equilíbrio veem numa simples pergunta: qual é o objetivo desse serviço? O problema que eu tenho visto, é que por mau indu-lo, irritação pessoal, odiou ao bem dos outros, alguns users estão a fazer mais radicais do que as regras apresentadas pelo theymos. E ele acaba por alinhar um pouco nisso, para evitar confusões de maior.
Nesse caso especifico não percebi bem o que aconteceu, porque "foi rápido de mais", e eu só percebi que abriu e que fechou a tal campanha, e afins...
Por isso, o problema é quando as pessoas perdem o equilíbrio, sobre analise dos assuntos debatidos.
Isso na verdade se tornou uma competição para ver quem mais puxa saco do outro pra ganhar moral com os figurões do forum e com os gerentes de campanhas. Concordo com o ponto de praticamente tudo é mixer. Ficará complicado para novos negócios se encaixarem nessa burocracia que no fim não ajuda os membros nem os negócios a escalarem e se fomentarem. Então as regras precisam ser bem claras, pois, como já foi dito, tudo pode ser mixer.
Na verdade é bem simples. Tudo que mexe com dinheiro vai ser obrigado a pedir KYC. Você vai ter que mander seu passaporte, selfie segurando documento, comprovante de endereço, etc... nenhuma transação com um terceiro centralizado vai poder ser feita de forma anonima, tudo vai ser rastreado completamente. Se mixers pedissem KYC, analisassem a origem das moedas, e salvassem todos os dados para pedidos governamentais, provavelmente continuariam de pé. Concordo com o @Pumared, ele tirou as palavras do meu teclado. Isso é um futuro horrível pra nossa privacidade, acho que isso é exagero demais... Mas acredito que vamos vencer essa guerra pela privacidade, isso acontece porque a população fica dando muita corda pro governo e o governo vai cada vez minando nossas liberdades pouco a pouco, pois a população não raciocina direito e não diferenciam segurança x liberdade/privacidade, precisa haver bom senso. |
|
|
|
The first weirdness here is that they could just generate another BIP39 seed with the same word count and use that as the encryption key (ie. generate a 128 bit entropy, append the checksum and encode it using the word list). Instead of generating multiple integers below 2048!
I think I get it what you mean, the code could simply generate an encrypted mnemonic code, but with a valid BIP-39 checksum and this could be used as a decoy wallet if someone found it, but would that really be possible? i think i remember having or being part of a conversation about this in the past. let M1 be the original seed phrase, M2 be the encrypting seed phrase. Both BIP39 compliant being independent of one another M2 being chosen at random of course. Then let M3= M1+M2 mod 2048 for each word. Then you store M3 out in the open anywhere you like. M2 gets stored in secret somewhere. You recover by doing M1=M3-M2 mod 2048 very simple. No need for any python software or anything. But the burden is that you have to store 2 things rather than one. Even if one of them doesn't need to be private, it still adds to the storage burden. And adds complexity to the situation obviously. But the recovery process can be done by hand. without a computer.
Interesting, the dev of this method commented this, he has an account here at btctalk, could we convince him, consult him to see if the code is OK even after 6 years? Or if he could improve the code to generate 12/24 word seeds with a valid checksum? He already created a topic talking about it several years ago, but it didn't have much relevance There is one problem with using this method and that it requires you to go to a computer and decrypt the encrypted seed so that you can reveal the OTP secret key.
A strong, robust backup solution should not require you to use specialized decryption tools. It should be intuitive for all Bitcoin wallets like the way the current procedure is very easy to memorize and understand.
However, this is the intention, to add an extra layer of security to obtain the information necessary to reconstruct the wallet. Also, you can save the OTP-key offline if you want, similar to BIP-39 passphrase. As long as the recovery method is done on an air-gapped computer I don't see any problems. Furthermore, several other methods and even traditional ones such as multisig require the use of an offline computer to sign transaction and then transmit it to a PC connected to the network. I don't know about you guys, but I found this method to be the most interesting I've ever seen and it deserves attention, as it meets my levels of paranoia, which I'm sure can be improved. Of course at the moment I wouldn't use it for my real seeds or main wallets. This could be added into advanced wallets like electrum as an extension. I'd not use this backup method at the moment unless for testing purposes, as I have been using it for over 1 month testing almost every day and it has not had any failures. I think BIP-85 is the most mature method for plausible negations for creating child seeds, it can create new seeds based on its parent seed and if it adds passphrase, it creates a child seed based on its parent seed + passphrase (if any), so you must have both to recover... the difference between the BIP-85 and this One Time Pad method is that the BIP-85 creates 12-word sentences with valid checksums! |
|
|
|
|
I've never tried to send 0 sat/B on Bitcoin core, but I don't think it's allowed, as I vaguely remember trying that.
Why would you want to send at 0 sat/b even though you know your transaction will never be accepted? 1 sat/B has a chance of being accepted, although it may take many days, due to the current state of the mempool.
How nice it was to send transactions paying 1 sat/B fee... anyway, you can still use Bitcoin Core even if your storage disk is smaller than the current blockchain size when opening Bitcoin Core for the first time, in the configuration, you will be asked if you want to prune the blockchain to X size... Ex: 2gb, 4 gb, then it is downloaded to 4gb (or whatever size you define) and the old blocks are deleted... You lose some resources, but they are not absolutely important.
|
|
|
|
Searching for ways to store my seed phrase safely, I found this method: seed-otp or one-time-pad, this cipher method is available in the Seed Tool, mnemonic creation tool similar to iancoleman, but with more features. This tool allows you to create an authentication key (OTP key) that is used to encrypt your recovery seed, by combining the two a new 12-word phrase is created that is completely different from your seed phrase, this new 12-word phrase is your encrypted seed by one-time-pad.  In the example above, I clicked on New Key[1], which resulted in an output in the "One Time pad key" field [2] which is the OTP-key and when clicking on Encrypt (I forgot to mark this as an item 4 in the image), it generates the encrypted mnemonic which is only decrypted with the generated otp key[2] (Sorry for the continuity error when skipping the "Encrypt" item).  Having the two items: encrypted mnemonic words and OTP-key and clicking on Decrypt: will result in the original recovery words This prevents anyone who has access to the encrypted seed from having access to your funds, as they would have to have the authentication key and you can store this key wherever you see fit, such as in a keepass (this is the idea suggested by the creator of this method of cipher). You can check more details on the project's github. But what I want to know is: if someone has already used it, is it still considered safe, since it only had a single release on github in 2018 and was never updated again, it appears that the project was abandoned? One of the cons is that the cipher phrase cannot be used as a valid BIP-39 seed, as it does not have a checksum, so it cannot be used as a decoy wallet as it can no longer be used as plausible deniability in case of a 5$ wrench attack, unless you use the argument that it's an invalid BIP-39 seed that you used in Electrum for N reasons, since Electrum allows you to restore seeds without checksum (invalid). Another detail to be noted is that this encryption method (one-time-pad) is already old, as it was used in the Second World War and the Cold War to exchange confidential information and is considered an encryption method as one of the impossible to use be broken by brute force. |
|
|
|
A new signature campaign "MrStork Exchange Service" has been opened by the campaign manager Hhampuz.
I know this isn't the discussion topic , but I'll be brief: The campaign was moved to the archival board, I don't understand what happened, I'm just speculating  |
|
|
|
I couldn't find a dedicated thread for Bitbox hardware wallets, so this one will do. The company has releases a new BitBox app update that introduces a few changes and improvements. One new feature that was added is child keys following the BIP85 standard. The BitBox02 can now generate separate child keys of 12 or 24 words derived from your main (parent) seed. Lost child keys can always be recovered by the holders of the parent seed. Source: https://bitbox.swiss/blog/bitbox-04-2024-brienz-update/I just tested it on my bitbox, for now it's working normally, even if the bitbox has the passphrase feature enabled, the bitbox generates a new child seed with the additional entropy of the passphrase, everything behaves as it should be. Today I will continue to do more tests on it. I have such irresponsible people in my family circle. They would lose their feet if they could take them off. There is still the issue with them getting hacked or leaking the seed somehow, but at least you could protect them from losing their keys.
A problematic scenario that could represent a risk to you is that if your family member is hacked, as he doesn't understand anything, he may think that you stole from him, since you hypothetically generated a child seed for him. |
|
|
|
-
Other HW that allow you to export digital backups: Bitbox02, Coldcard, Keystone (correct me if I'm wrong). The bitbox doesn't encrypt the backup, I think they keep the seedphrase in plain text (I never inserted the SD card with the bitbox backup into the PC, only into the bitbox). But as long as the user is using passphrase, even if someone has physical access to the SD card containing the bitbox wallet backup, the attacker will never have access to the funds. However, I liked the passport backup method better (I believe coldcard uses the same method), as it keeps the backup encrypted in a 7zip file. Encrypted backups with a sufficiently secure password help to duplicate backups more easily, as they remove points of failure, because even if the attacker has physical access, he needs the password to access the wallet. |
|
|
|
I completely support your idea! Seed storage on digital media is a crucial topic, we definitely need more threads like this on the forum.
Recently, i made a thread suggesting creating/importing seeds in wallets like Electrum or Sparrow, as they allow you to export encrypted digital backups. Security tips for making encrypted backups of your seedphrase. |
|
|
|
|
Infelizmente isso é verdade, vale adicionar também que a maioria não investe, desde que eu conheci o Bitcoin, meus hábitos de consumo mudaram, pois passei a valorizar mais minha saúde financeira afim de obter mais frações de Bitcoin. Sou grato a Satoshi por isso, Bitcoin é educação financeira também!
|
|
|
|
|
Rapaz... Eu tinha algumas btc testnets, hoje até nos faucets está difícil conseguir, a maioria não funciona mais. Eu usava muito pra fazer testes em carteiras ou em transações de Bitcoin.
|
|
|
|
Bitcointalk Username: Forsyth Jones Profile Link: https://bitcointalk.org/index.php?action=profile;u=941526Post Count: 1313 Forum Rank: Hero Member Are you able to wear our Signature, Avatar & Personal Text? Yes Stake Username: forsyth8jones I'm applying for this campaign because according to the thread it's OFNP. |
|
|
|
Bitcointalk Usermane: Forsyth Jones
Blackjack.fun Username: Forsyth Jones
Since everyone is applying, why not?  Reapplying |
|
|
|
|
Thanks a lot Hhampuz for the opportunity, it was great working with you during these successful 2 weeks.
I hope the Airbet campaign comes back someday, anyway thanks, see you again.
|
|
|
|
|
Parabéns pra quem teve a "brilhante" ideia de prevenir crimes declarando censura contra as tecnologias de criptografia de mensagens, então quer dizer que assinar mensagens PGP agora é proibido? hahahha don't make me laugh.
É a mesma coisa que eu proibir os carros para prevenir acidentes de carros. Não é assim, deve-se ir atrás do suspeito/acusado e não descontar em fatores externos ou meios utilizados que não tem nada a ver.
E olha que a interpol é um orgão especializado no combate no crime organizado, terrorismo... é uma organização séria... e mostrar um gafe desse pra mim significa que não sabem nada ou possuem conhecimento ZERO em tecnologias cibernéticas.
Boa sorte eles tentarem bloquear mensageiros realmente privados e descentralizados (como não é o caso do WhatsApp, já que o mesmo é centralizado).
|
|
|
|
|
Show Posts
