Bitcoin Forum
December 05, 2019, 07:53:15 PM *
News: Latest Bitcoin Core release: 0.19.0.1 [Torrent]
 
   Home   Help Search Login Register More  
Pages: [1] 2 »  All
  Print  
Author Topic: How long, strong should a bitcoin wallet pass-phrase be?  (Read 1713 times)
KonstantinosM
Hero Member
*****
Offline Offline

Activity: 1128
Merit: 623


Life is a taxable event


View Profile
April 19, 2015, 07:04:07 PM
 #1

10 characters, 20? 25?

Letters, numbers, special characters?

What if a user used only letters and numbers for example?





Say a hacker gets a wallet.dat with the pass-phrase helloworld, would it break in seconds? Now what if it is helloworld!~~ or HelloWorld!~~!

Are all these "weak" pass-phrases?


What if the wallet is than also backed up online which is known as a bad practice. What are the implications of that?
1575575595
Hero Member
*
Offline Offline

Posts: 1575575595

View Profile Personal Message (Offline)

Ignore
1575575595
Reply with quote  #2

1575575595
Report to moderator
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
1575575595
Hero Member
*
Offline Offline

Posts: 1575575595

View Profile Personal Message (Offline)

Ignore
1575575595
Reply with quote  #2

1575575595
Report to moderator
Amph
Legendary
*
Offline Offline

Activity: 2254
Merit: 1003



View Profile
April 19, 2015, 07:15:45 PM
Last edit: April 19, 2015, 08:20:23 PM by Amph
 #2

you can try this, to see how strong your password is

https://howsecureismypassword.net/

usually something with 10-12 is good enough, just change the combination for every site
gadman2
Legendary
*
Offline Offline

Activity: 972
Merit: 1000


WWW.HOMETOWNARMS.COM


View Profile WWW
April 19, 2015, 08:05:36 PM
 #3

you can try this, to see how strong your password is

http://www.tomshardware.com/reviews/nvidia-geforce-gtx-980-970-maxwell,3941-12.html

usually something with 10-12 is good enough, just change the combination for every site

I have a feeling that's not the right link lol.

This might be of better use: https://howsecureismypassword.net/

Amph
Legendary
*
Offline Offline

Activity: 2254
Merit: 1003



View Profile
April 19, 2015, 08:20:51 PM
 #4

you can try this, to see how strong your password is

http://www.tomshardware.com/reviews/nvidia-geforce-gtx-980-970-maxwell,3941-12.html

usually something with 10-12 is good enough, just change the combination for every site

I have a feeling that's not the right link lol.

This might be of better use: https://howsecureismypassword.net/

yeah you are right(your link was the one that i wanted to post), it's because i was arguing with another user on another forum about gpu consumption, i confused the two link

my bad  Cheesy
pedrog
Legendary
*
Offline Offline

Activity: 2338
Merit: 1005



View Profile
April 19, 2015, 08:46:05 PM
 #5

If you make them NSA proof they are good enough.  Smiley
 
Edward Snowden on Passwords https://www.youtube.com/watch?v=yzGzB-yYKcc

AltcoinInvestor
Sr. Member
****
Offline Offline

Activity: 294
Merit: 250



View Profile
April 19, 2015, 11:32:55 PM
 #6

Long passwords may be seen as "strong passwords" but they might not be.
For instance;
if you use english letters only 10 char password; there're 26^10 different possibilities.
260.000.000.000
if you use alphanumerical 10 char password; there're 36^10 different possibilities
360.000.000.000
if you use alphanumerical + special chars (let's say there's 20 different special char like /,*-?=_ etc) total 8 char password; there're  56^6 different possibilities
~1.736.000.000.000

Also check this;
Rude Boy
Hero Member
*****
Offline Offline

Activity: 770
Merit: 500


View Profile
April 20, 2015, 03:23:47 AM
Last edit: October 29, 2015, 01:24:35 PM by Rude Boy
 #7

12 letter is enough, if you combine both upper & lower case, numbers and special characters.
See my wifi password below:
U,F4%rw$RE,.?54
this password might take years to brute force (even with super computers).
But the thing is you've to remember you password.
And change your password frequently.


~Rude Boy
coinableS
Legendary
*
Offline Offline

Activity: 1092
Merit: 1001



View Profile WWW
April 20, 2015, 04:14:41 AM
 #8

Clicked on this link expecting to see the xkcd.com cartoon on entropy. Was not disappointed.

ausbit
Legendary
*
Offline Offline

Activity: 1330
Merit: 1019



View Profile
April 20, 2015, 04:19:20 AM
 #9

Thats cool, 143 billion years it will take to crack my password, now i better not forget it!
ObscureBean
Legendary
*
Offline Offline

Activity: 1148
Merit: 1000


View Profile WWW
April 20, 2015, 05:45:08 AM
 #10

you can try this, to see how strong your password is

http://www.tomshardware.com/reviews/nvidia-geforce-gtx-980-970-maxwell,3941-12.html

usually something with 10-12 is good enough, just change the combination for every site

I have a feeling that's not the right link lol.

This might be of better use: https://howsecureismypassword.net/

How secure is this website though, doesn't look all that professional, I'd be uncomfortable using a password I've tested on there.

I'd say a strong password is simply one that strays as far as possible from convention. Don't use words that are actual words, a mix of 20 letters, numbers and special characters should be enough to provide a reasonably strong password for at least the next 5 years (until computing power reaches new heights). The question then is how/where to store your password, I personally wouldn't trust any online storage service for this, a local storage device that cannot connect to the internet would be better. You can memorize just one super strong password (of course if you can memorize each individual password it would be even better) that leads to all your other passwords.
randy8777
Legendary
*
Offline Offline

Activity: 896
Merit: 1000


View Profile
April 20, 2015, 08:43:28 AM
 #11

longer passwords are stronger for obvious reasons but it mostly depends on what site or service it is for. for a bitcoin wallet i suggest 20 characters. letters, symbols, numbers. don't use words, mix everything.
Amph
Legendary
*
Offline Offline

Activity: 2254
Merit: 1003



View Profile
April 20, 2015, 08:49:04 AM
 #12

you can try this, to see how strong your password is

http://www.tomshardware.com/reviews/nvidia-geforce-gtx-980-970-maxwell,3941-12.html

usually something with 10-12 is good enough, just change the combination for every site

I have a feeling that's not the right link lol.

This might be of better use: https://howsecureismypassword.net/

How secure is this website though, doesn't look all that professional, I'd be uncomfortable using a password I've tested on there.


they said it specifically, to not use passwords that you would then use for your normal activity, use a similar one just for testing
Bizmark13
Sr. Member
****
Offline Offline

Activity: 448
Merit: 250


WikiScams.org - Information about Bitcoin Scams


View Profile
April 20, 2015, 10:40:29 AM
Last edit: April 20, 2015, 10:55:21 AM by Bizmark13
 #13

Other responses have been pretty accurate so far. The only other thing I'd like to mention is that the passphrase or password that OP describes should not be confused with a NXT passphrase or a Bitcoin brainwallet passphrase. For the latter two, a far higher level of security is required since you are dealing with not just a single attacker but dozens and possibly hundreds of attackers distributed all over the world using precomputed rainbow tables which can crack wallets in a manner that is not computationally expensive.

For the typical wallet password you might use to unlock a Qt or Electrum wallet, 12-20 random characters with a combination of uppercase and lowercase letters, numbers, and symbols is usually considered to be sufficient for the short to medium-term future. Keep in mind that Moore's law* states that computing power will double every 18 or so months so a password that is considered sufficient today might not be sufficient 20 years from now.

For a NXT passphrase or Bitcoin brainwallet passphrase, you really don't want anything under 30-35 characters in length and 50+ character passphrases are usually recommended. Mine, for instance, is 560 characters in length with uppercase and lowercase letters, numbers, and symbols.

*Yes, I'm aware that some predictions show that Moore's law is slowing down and will cease to remain true in the future but that's just hypothetical at this stage and beyond the scope of this thread.

EDIT: And for those who say that you shouldn't use words, this is mostly true. However, a sufficiently long and randomly generated list of words from a large enough pool should be uncrackable by any brute force method. Some people might find a list of English words to be more memorable compared to traditional passwords. Electrum uses this method, and so does NXT. And while these programs use 12-13 words to generate their passphrases, a lower number (e.g. 10 words) might be sufficient for encrypting a wallet.dat file.

Long passwords may be seen as "strong passwords" but they might not be.
For instance;
if you use english letters only 10 char password; there're 26^10 different possibilities.
260.000.000.000
if you use alphanumerical 10 char password; there're 36^10 different possibilities
360.000.000.000
if you use alphanumerical + special chars (let's say there's 20 different special char like /,*-?=_ etc) total 8 char password; there're  56^6 different possibilities
~1.736.000.000.000

Also check this;


1,000 guesses per second isn't a good assumption given that a.) the comic assumes that you're target is a web service, and b.) modern computers are capable of better speeds than this anyway. I think an ordinary computer is capable of 50,000 guesses per second.
btchris
Hero Member
*****
Offline Offline

Activity: 672
Merit: 501

a.k.a. gurnec on GitHub


View Profile WWW
April 20, 2015, 04:48:19 PM
 #14

I think an ordinary computer is capable of 50,000 guesses per second.

Aside: Great post, Bizmark13!

How fast an "ordinary" computer can try passwords varies greatly depending on the wallet software and the brute-forcing software. Here's a spreadsheet which has some comparisons of several popular wallets & two open source brute-forcers running on a mid-range quad-core desktop machine:

https://onedrive.live.com/redir?resid=584f122ba17116ee%21295

Guess rates vary between 20 per second (Armory, CPU only) all the way up to 4,000,000 per second (older blockchain.info wallets, GPU accelerated). Some wallets would be even faster (Electrum, MultiBit Classic) if an open source GPU accelerated version were available.

For Bitcoin Core, guess rates vary between roughly 40 and 2,000 per second depending on whether or not GPU acceleration is used (and of course depending on the CPUs and GPUs).
Bizmark13
Sr. Member
****
Offline Offline

Activity: 448
Merit: 250


WikiScams.org - Information about Bitcoin Scams


View Profile
April 21, 2015, 04:29:28 AM
 #15

What if the wallet is than also backed up online which is known as a bad practice. What are the implications of that?

I would think that an encrypted wallet with a strong enough password should still be secure even when stored on the cloud although obviously it's not as secure as keeping it completely offline. Even if an employee from the hosting company found your wallet and attempted to crack it, your coins should still be safe if your password is strong enough.

you can try this, to see how strong your password is

https://howsecureismypassword.net/

usually something with 10-12 is good enough, just change the combination for every site

I don't think that link accommodates dictionary attacks though. Putting "hello my name is" shows that it would take 2 billion years to crack it and "good morning" gives a result of 546 years. Obviously, neither of these are true.

12 letter is enough, if you combine both upper & lower case, numbers and special characters.
See my wifi password below:
U>u^ZT[jehlNz
this password might take years to brute force (even with super computers).
But the thing is you've to remember you password.
And change your password frequently.


~Rude Boy

Wifi passwords are notoriously easy to crack. I believe even WPA2 can be cracked in a few days. The underlying AES encryption standard is pretty secure but there are workarounds and vulnerabilities which can reduce the effort required to crack these passwords significantly.

I think an ordinary computer is capable of 50,000 guesses per second.

Aside: Great post, Bizmark13!

How fast an "ordinary" computer can try passwords varies greatly depending on the wallet software and the brute-forcing software. Here's a spreadsheet which has some comparisons of several popular wallets & two open source brute-forcers running on a mid-range quad-core desktop machine:

https://onedrive.live.com/redir?resid=584f122ba17116ee%21295

Guess rates vary between 20 per second (Armory, CPU only) all the way up to 4,000,000 per second (older blockchain.info wallets, GPU accelerated). Some wallets would be even faster (Electrum, MultiBit Classic) if an open source GPU accelerated version were available.

For Bitcoin Core, guess rates vary between roughly 40 and 2,000 per second depending on whether or not GPU acceleration is used (and of course depending on the CPUs and GPUs).

Ah... You're right. Didn't realize it varied so much. The 50,000 figure was from a laptop I had a while ago performing SHA-256 decryption. Although I guess I should have realized it since the no. of encryption iterations and method of encryption used varies between different programs.
Amph
Legendary
*
Offline Offline

Activity: 2254
Merit: 1003



View Profile
April 21, 2015, 07:01:26 AM
 #16

I don't think that link accommodates dictionary attacks though. Putting "hello my name is" shows that it would take 2 billion years to crack it and "good morning" gives a result of 546 years. Obviously, neither of these are true.

yeah it's a bit off, i found one that is much better https://www.my1login.com/content/password-strength-test.php
LewiesMan
Sr. Member
****
Offline Offline

Activity: 385
Merit: 250



View Profile
April 21, 2015, 07:03:47 AM
 #17

If you had a vault full of gold how strong would the password be to unlock it? And if you have $ 100 in your wallet how strong would the password be everytime you want to use your cash?

For your "safe" at home you'll want to use a very strong password and for your phone wallet you can use a weak password.
btchris
Hero Member
*****
Offline Offline

Activity: 672
Merit: 501

a.k.a. gurnec on GitHub


View Profile WWW
April 21, 2015, 03:01:31 PM
 #18

I don't think that link accommodates dictionary attacks though. Putting "hello my name is" shows that it would take 2 billion years to crack it and "good morning" gives a result of 546 years. Obviously, neither of these are true.

yeah it's a bit off, i found one that is much better https://www.my1login.com/content/password-strength-test.php

As long as we're talking about favorite strength checkers, here's mine: https://dl.dropboxusercontent.com/u/209/zxcvbn/test/index.html

It's the open source javascript-only checker used by Dropbox. There's a description of its strengths and weaknesses here: https://blogs.dropbox.com/tech/2012/04/zxcvbn-realistic-password-strength-estimation/
Amph
Legendary
*
Offline Offline

Activity: 2254
Merit: 1003



View Profile
April 21, 2015, 03:19:42 PM
 #19

I don't think that link accommodates dictionary attacks though. Putting "hello my name is" shows that it would take 2 billion years to crack it and "good morning" gives a result of 546 years. Obviously, neither of these are true.

yeah it's a bit off, i found one that is much better https://www.my1login.com/content/password-strength-test.php

As long as we're talking about favorite strength checkers, here's mine: https://dl.dropboxusercontent.com/u/209/zxcvbn/test/index.html

It's the open source javascript-only checker used by Dropbox. There's a description of its strengths and weaknesses here: https://blogs.dropbox.com/tech/2012/04/zxcvbn-realistic-password-strength-estimation/

i don't know who is right, but with "my name is" the first that i posted say 3 hours, instead your say 1 year approximately

also it say crack time 35M seconds which is about 1 year and then crack time display 3 years? are those two not the same thing?
btchris
Hero Member
*****
Offline Offline

Activity: 672
Merit: 501

a.k.a. gurnec on GitHub


View Profile WWW
April 21, 2015, 03:29:43 PM
 #20

What if the wallet is than also backed up online which is known as a bad practice. What are the implications of that?

I would think that an encrypted wallet with a strong enough password should still be secure even when stored on the cloud although obviously it's not as secure as keeping it completely offline.

I agree, however "strong enough password" is a difficult thing to measure. Also, the list of transactions is not password protected for most wallets (there are exceptions).


Wifi passwords are notoriously easy to crack. I believe even WPA2 can be cracked in a few days. The underlying AES encryption standard is pretty secure but there are workarounds and vulnerabilities which can reduce the effort required to crack these passwords significantly.

WEP and Wi-Fi Protected Setup PINs are both completely broken, and have been for a number of years.

WPA1/2-TKIP (uses an RC4 cipher) has a number of weaknesses, including a practical data injection weakness and an almost-practical plaintext recovery weakness.

WPA1/2-CCMP (uses an AES-128 cipher) has no serious weaknesses, however it doesn't use a very good KDF which lends itself to offline brute-forcing attacks when weak passwords are used. This is especially true if a common SSID is also used (because it makes rainbow table based attacks possible).

(The AES cipher is believed to be very secure; there are no known practical attacks against it, although there are some concerns about the key scheduler in AES-192/256 (but not 128) possibly being vulnerable to related-key attacks one day; good news is that only poorly designed software uses related keys).
Pages: [1] 2 »  All
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!