Bruteforced attacked Instawallet

[MooC Tals]

http://bitbin.it/paste.php?id=0cWM1t7K

I'm new to the bitcoin thingy and as I was waiting for my equipment to be shipped I have been doing the freebitcoin facet thing.

I been using an instawallet service to stash my mBTC lolz and came across this website after typing in the google search [instawallet.org btc]

Then I been hearing about the gpu's being taken in by private pool hash services. However they are offering money for hash power OTHER than BTC hashing and got me thinking.

What if the rogue hashing processors are being pooled to attack websites such as installets or other services. Look I really don't understand much of this but is that link for real?

I guess instawallets are just temporary in nature but what about accounts in large exchanges? Are they safe?

[1714827057]

1714827057

[1714827057]

1714827057

[1714827057]

1714827057

[1714827057]

1714827057

[lile]

None of those instawallet "accounts" (as far as I can see) has or ever had any bitcoins on them. Instawallet account identifiers have too high entropy for brute forcing them being profitable.

Instawallet is as safe as any other "shared wallet" out there.

[Stephen Gornick]

Instawallet account identifiers have too high entropy for brute forcing them being profitable.

If those in that pastebin were actual funded Instawallet accounts, the URLs weren't discovered through brute force cracking.

And that is quantified here:

16 bytes of random data is 128 bits, which means there are 2^128 = 340282366920938463463374607431768211456 possible Instawallet URLs. Let's say there are 10000 Instawallets in use (in reality the number is nowhere this large, but let's be optimistic and assume that Instawallet will grow). So you have a chance of 10000 to 2^128 to find a wallet with coins if you just guess once.

[Stephen Gornick]

If those in that pastebin were actual funded Instawallet accounts, the URLs weren't discovered through brute force cracking.

Now if those URLs were sent by Instawallet users via e-mail (which transmits in clear-text) or in SMS/text messaging (which transmits in clear-text on telecom networks), or on corporate networks with packet inspection or on compromised Windows systems, etc., then certainly like any bearer instrument, these URLs are vulnerable to being hijacked by a thief.   That's one reason why the FAQ reads

do not recommend to store significant amounts of Bitcoins here.

 - https://instawallet.org/static/faq

[sharky112065]

Ug. I would advise against using any wallet service to store your Bitcoins. Spend just a few minutes reading the threads on this forum and you will see the bad things that have happened so far. Use either bitcoind or Bitcoin QT (Graphical version of Bitcoin) to store and spend your Bitcoins.

[kangasbros]

Even if instawallet had just 64-bit wallets or something, still finding a wallet would be pretty hard, since they probably have some kind of DDOS protection which limits the amount of wallets you can try. But they have 128-bit wallets, which means that even if you brute force 100000 wallets/second, you won't find a valid wallet in a year.

[Stephen Gornick]

Ug. I would advise against using any wallet service to store your Bitcoins. Spend just a few minutes reading the threads on this forum and you will see the bad things that have happened so far. Use either bitcoind or Bitcoin QT (Graphical version of Bitcoin) to store and spend your Bitcoins.

There are many instances where a hosted (shared) EWallet like Paytunia, Instawallet, EasyWallet, or an exchange's EWallet even work very well due to EWallets being convenient and nearly always accessible.

Instawallet and EasyWallet are special case EWallets, where there is no username / password, just a URL.  They are referred to as "low security wallets" and are suitable for low amounts.

They don't make great places for storing wealth, but for someone who simply needs an address to receive $5 worth of coins, it works just fine.

[sharky112065]

Ug. I would advise against using any wallet service to store your Bitcoins. Spend just a few minutes reading the threads on this forum and you will see the bad things that have happened so far. Use either bitcoind or Bitcoin QT (Graphical version of Bitcoin) to store and spend your Bitcoins.

There are many instances where a hosted (shared) EWallet like Paytunia, Instawallet, EasyWallet, or an exchange's EWallet even work very well due to EWallets being convenient and nearly always accessible.

Instawallet and EasyWallet are special case EWallets, where there is no username / password, just a URL.  They are referred to as "low security wallets" and are suitable for low amounts.

They don't make great places for storing wealth, but for someone who simply needs an address to receive $5 worth of coins, it works just fine.

I would not trust them even to hold $1 worth of Bitcoin.

So you would have no problem handing your real wallet to someone on the bus or subway and asking them to hold it for you?

There is no insurance backing those services up. They can take your money and other peoples money and run with it as some have done in the past.

Fool me once, shame on you. Fool me twice, shame on me...

[SgtSpike]

Buteforced?  How do you say that?  "Butt-forced"?  In that case, it's drawing up nasty imagery in my head.

[AndrewBUD]

Buteforced?  How do you say that?  "Butt-forced"?  In that case, it's drawing up nasty imagery in my head.

haha that's what I came up with when I read the title. Butt Forced wallet..... mmmmmm

[dree12]

Ug. I would advise against using any wallet service to store your Bitcoins. Spend just a few minutes reading the threads on this forum and you will see the bad things that have happened so far. Use either bitcoind or Bitcoin QT (Graphical version of Bitcoin) to store and spend your Bitcoins.

There are many instances where a hosted (shared) EWallet like Paytunia, Instawallet, EasyWallet, or an exchange's EWallet even work very well due to EWallets being convenient and nearly always accessible.

Instawallet and EasyWallet are special case EWallets, where there is no username / password, just a URL.  They are referred to as "low security wallets" and are suitable for low amounts.

They don't make great places for storing wealth, but for someone who simply needs an address to receive $5 worth of coins, it works just fine.

I would not trust them even to hold $1 worth of Bitcoin.

So you would have no problem handing your real wallet to someone on the bus or subway and asking them to hold it for you?

There is no insurance backing those services up. They can take your money and other peoples money and run with it as some have done in the past.

Fool me once, shame on you. Fool me twice, shame on me...

If there are less than $20 in the wallet, then I see no problem with having someone hold it for me, especially if they have held other's wallets without incident in the past.

[DannyHamilton]

I would not trust them even to hold $1 worth of Bitcoin.

So you would have no problem handing your real wallet to someone on the bus or subway and asking them to hold it for you?

I hand my credit card to a complete stranger in a restaurant pretty often.
I've handed my coat over to a coat-check service on occasion.
I've even handed my car keys over to a complete stranger and had them hold on to them for me for a few hours.

I wouldn't just randomly hand money to someone for no reason, but if there was a reasonable reason to have a stranger hold on to a small amount of cash for me, I'd probably be ok with it.

[MooC Tals]

Sorry for the tittle error. I just noticed it now....

I really was not worried about small amounts of money in an instawallet. I was more concerned about those trading sites like BTCe (the only one I know of atm)

[Stephen Gornick]

I was more concerned about those trading sites like BTCe (the only one I know of atm)

Well, there are a number of ways an account at an online service can get compromised.  BTC-e differs from Instawallet in that it used for account protection a username and password.

Obviously, security basics like not re-using your password with more than one service and using a strong password apply.

Because it is hard for many people to maintain secure computers free of malware, several exchanges and EWallets no support multi-factor authentication.  When multi-factor is implemented correctly, the spyware/malware can't perform a replay attack to get access to the funds.

Also, you are trusting that the EWallet operator maintains secure systems.   The track records at the exchanges overall has not been good.

So ideally, if you have to have funds at an exchange, you are only doing that when you are actively trading.  Otherwise withdraw the funds rather than use the EWallet as a savings account.

[Boussac]

Ug. I would advise against using any wallet service to store your Bitcoins. Spend just a few minutes reading the threads on this forum and you will see the bad things that have happened so far. Use either bitcoind or Bitcoin QT (Graphical version of Bitcoin) to store and spend your Bitcoins.

There are many instances where a hosted (shared) EWallet like Paytunia, Instawallet, EasyWallet, or an exchange's EWallet even work very well due to EWallets being convenient and nearly always accessible.

Instawallet and EasyWallet are special case EWallets, where there is no username / password, just a URL.  They are referred to as "low security wallets" and are suitable for low amounts.

They don't make great places for storing wealth, but for someone who simply needs an address to receive $5 worth of coins, it works just fine.

I would not trust them even to hold $1 worth of Bitcoin.

So you would have no problem handing your real wallet to someone on the bus or subway and asking them to hold it for you?

There is no insurance backing those services up. They can take your money and other peoples money and run with it as some have done in the past.

Fool me once, shame on you. Fool me twice, shame on me...

If you think the 3 people owning a registered business like instawallet will "run" with a few thousand euros/USDs to ruin their professionnal and social life for good, think twice. Our identities are public if you care to check. Just so you know 90% of the bitcoins are in cold storage and the redemption of a storage key by a single individual is NOT possible under our redemption process.

Without social trust, there is no efficient economy, period, regardless of the monetary system you are using.

[sharky112065]

Ug. I would advise against using any wallet service to store your Bitcoins. Spend just a few minutes reading the threads on this forum and you will see the bad things that have happened so far. Use either bitcoind or Bitcoin QT (Graphical version of Bitcoin) to store and spend your Bitcoins.

There are many instances where a hosted (shared) EWallet like Paytunia, Instawallet, EasyWallet, or an exchange's EWallet even work very well due to EWallets being convenient and nearly always accessible.

Instawallet and EasyWallet are special case EWallets, where there is no username / password, just a URL.  They are referred to as "low security wallets" and are suitable for low amounts.

They don't make great places for storing wealth, but for someone who simply needs an address to receive $5 worth of coins, it works just fine.

I would not trust them even to hold $1 worth of Bitcoin.

So you would have no problem handing your real wallet to someone on the bus or subway and asking them to hold it for you?

There is no insurance backing those services up. They can take your money and other peoples money and run with it as some have done in the past.

Fool me once, shame on you. Fool me twice, shame on me...

If you think the 3 people owning a registered business like instawallet will "run" with a few thousand euros/USDs to ruin their professionnal and social life for good, think twice. Our identities are public if you care to check. Just so you know 90% of the bitcoins are in cold storage and the redemption of a storage key by a single individual is NOT possible under our redemption process.

Without social trust, there is no efficient economy, period, regardless of the monetary system you are using.

To someone younger it might sound like a good idea, but I have learned that trust without insurance is not a good thing and that you will probably get burned.