[2016-02-16] Password cracking attacks on Bitcoin wallets net $103,000

[Sturgeon]

Hackers have siphoned about $103,000 out of Bitcoin accounts that were protected with an alternative security measure, according to research that tracked six years' worth of transactions. Account-holders used easy-to-remember passwords to protect their accounts instead of the long cryptographic keys normally required.

The heists were carried out against almost 900 accounts where the owners used passwords to generate the private encryption keys required to withdraw funds. In many cases, the vulnerable accounts were drained within minutes or seconds of going live. The electronic wallets were popularly known as "brain wallets" because, the thinking went, Bitcoin funds were stored in users' minds through memorization of a password rather than a 64-character private key that had to be written on paper or stored digitally. For years, brain wallets were promoted as a safer and more user-friendly way to secure Bitcoins and other digital currencies, although Gregory Maxwell, Gavin Andresen, and many other Bitcoin experts had long warned that they were a bad idea.

http://arstechnica.com/security/2016/02/password-cracking-attacks-on-bitcoin-wallets-net-103000/

[Blue_Panda73]

Brain wallets are fine if you can remember long sentences and some words cannot be found in dictionary.

[TraderTimm]

Brain Wallets are fine if you don't care about your bitcoins.

Given that it uses a simple hash, no key-stretching techniques, and is easily brute-forced by some rented cluster time on an Amazon EC instance, I'd stay the hell away from them.

An added irony is Ethereum has brainwalllets too, but I guess it isn't valuable enough to try to steal

[Kprawn]

Please change the title, it's confusing... newbies might think, Bitcoin {The protocol} was hacked. The protocol was never compromised ... It is a wallet

service, where people used poor passwords. The service was also compromised because it used poor security measures. If eBay gets hacked, you

cannot blame the currency being stolen. The core technology did not fail, it is simply the service {wallet provider} that failed.