warpwallet https://keybase.io/warp/

Uses scrypt to hash the passphrase first.

The obvious solution to this problem (which applies to any password, not only one that protects bitcoins) it to pick a text that they cannot find.

While that is true, attackers do not have unlimited resources and there are some situations where people really like brain wallets.  I wouldn't say it is appropriate for many use cases, but I'd say it is for some.

You've got me wrong, I'm all against brainwallets. Just tried to help the beginner who asked "Is there a denomination for 'Entropy'?" to get some basic ideas without directing him to Wikipedia article which is overwhelming for the most people.

Someone has took them
19aREH3jaDba1xt14zhaUvzyAhzphdAwJN

http://1209k.com/brainv2/

I agree about the electrum seed, and it also has key stretching.

I don't even think you can say it's impossible to create your
secure phrase.  maybe not provably secure...but you can
easily create weirdness and entropy using mental techniques,
and add additional entropy with nonsense words, misspellings, and throw in a few
numbers in there....it will be fine if you know what you are
doing (don't try this at home) and dont do something stupid
like use movie phrases.

pitfalls, yes. impossible, no.

Granted, I would rather use electrum because it's more easily memorized.

IMO, wallets that use memorized seeds should do something like this instead:
- Ask the user for some impossible-to-forget information such as their full name to use as salt.
- Generate random words to use as a passphrase. The number of words can be user-configurable, but 5 or 6 should be OK on fast computers.
- Depending on the number of words, apply enough key stretching to make attacks infeasible.

Then you only have to memorize ~6 words instead of a full ~12-word seed mnemonic, which is a lot easier. And there's still no risk of users choosing bad passphrases, since the wallet does it for them.

(The rough passphrase utility I made a while ago works a bit like this, though it doesn't generate passphrases.)

You absolutely can. First: whats hackable to _you_ is not whats hackable to some guy with powerful statistical analysis and a fpga cracking farm who, with one unit of effort, simultaneously attacks all users. Secondly, what I was more expressing was an OR case,  that frequently you secrets are either crackable OR they are likely to be lost.  Both of those possible outcomes result in you losing your funds.

A challenge there is that it may be quite hard to get users to understand that your collection of personal information there isn't to send it off to some server or put it someplace public... in querying around I got the impression that lots of people would put random things in those fields, defeating the protection.  It would probably be better than what people are actually doing.

There is another weird consequence is that you lose denyablity when using such a scheme. E.g. if someone does obtain your secrets then your address is effectively a cryptographic commitment to that personal info, it's harder to say "those transactions weren't mine". Thats a little bit into the realm of movie plot threats, but at least some of the people working on encrypted wallets have insisted on "denyability" as a feature, and people have used it as selling point for "brainwallets" (and also as an argument against writing down the key, which is probably the most prudent think you should do— considering the forgetting risk).

The problem jonald is determining the level of entropy.  Also humans are very good at convincing themselves they are random when they aren't.  A common homework experiment of entropy is to ask 100 people to pick a random number between 1 and 10.  Usually 30%+ will pick "7" and significantly less than the expected 10% will pick either 1 or 10.   Picking 1 in the range 1 to 10 doesn't seem random to most people so at a subconcious level, most will reject it from even being a candidate.

It isn't impossible for a human to generate a passphrase with sufficient entropy however the three major problems remain:
a) Most will fail at the process, and when they fail they will have funds stolen so any method which encourages that is unethical.

b) It is very difficult to quantitatively state how much entropy your human chosen passphrase actually has.  So you pick a passphrase and your funds aren't stolen yet.  Is it because the passphrase is secure and it will never be stolen or is it just because a hacker hasn't gotten to it yet and they will steal it in the future.

c) The sheer number of inputs necessary to have a high confidence that there is sufficient entropy is high enough that a significant number of users will lose access to their funds.   Another way to look at it is if you need to memorize 25 words you chose to have the same security as 6 random words is there any benefit to advocating the former?


Then use diceware and random words (or some similar system). Using diceware and truly random selections (i.e. roll some dice), 10 simple words gets you >128 bits of entropy.  This is very similar to the concept that electrum uses for the seed words.  The seed is random    

You probably can be very secure using less random words combined with key stretching.  Key stretching is very effective when used with truly random values with lower (but still useful) levels of entropy.   For example 5 diceware words is only 64 bits of entropy*. If your key is the hash of the diceware words [ key=H(set of diceware words) and your attacker can make 1 trillion hashes per second well the 50% solution time is ~100 years.   Still that may be close too close to comfort and that work requirement can be increased by key stretching.  For something like a cold storage wallet you don't need sub millisecond access; so use a KDF timed to take a little over a second to complete.  Even in unoptimized javascript that should mean tens of thousands of iterations.  Lets say 10,000.  Now the attacker can't attempt 1 trillion passwords per second.  With the same hardware they can still complete 1 trillion hashes per second but each password attempt takes 10,000 hashes so their throughput has dropped to a mere 100 million passwords per second and correspondingly the 50% solution time has been increased to one million years.

It is important to understand that key stretching can't "fix" passwords with very poor entropy.  For example if your password is on a list of 1 million known compromised passwords then the attacker would find it in a fraction of a second (assuming it isn't precomputed).  Using key stretching is still ineffective as using this hypothetical machine above even with key hardening the attacker can attack 100 million hardened passwords per second.  So the solution time is increased by 10,000x however it is increased from microseconds to a fraction of a second.


If you wrote down a large list and then randomly selected from it then it would be random.  Of course by randomly selecting I don't mean the equivalent of "pick a number from 1 to 10" as we already know the results will not be random.  You could number the words on the list and then roll dice to pick the words.  Of course you would want a large library of words.  Larger library means less words selected for the same entropy.  You would also want to avoid words which may be confused for other words or are hard to remember.  You would also want to make sure your numbers system has a uniform distribution (each word has an equal chance of being picked). You would also need to safely store multiple copies of this system and it would be a good idea for it to be widely adopted.  This means it would be both peer reviewed and there is an increased chance you can find the word list in the future. Of course if you spent countless hours doing all that ... well you just reinvented diceware.  It has been around since 1996 and is rather robust.  Maybe someday I need to make a brainwallet site using diceware so people can stop losing coins.

http://world.std.com/~reinhold/diceware.html

* D&T warning.  You can only use a reduced entropy password if you are sure the level of key stretching.  For open source software you can inspect the code and preferably any system would make this clear and visible to the end user.  Opaque websites (i.e. your login for BCT) are a different story.  You have no idea how much key stretching (if any) the site is doing.  Thus you should always assume that no key stretching is being performed.  Although the topic is about brain wallets I don't want someone using 5 (or less) diceware words for their exchange account and when they get hacked saying D&T said it was secure.  Honestly since websites are so bad at security I would recommend using diceware as a master password for a tool like lastpass and generating a random 20 digit password for each website.