Bitcoin Forum
May 06, 2024, 03:10:11 AM *
News: Latest Bitcoin Core release: 27.0 [Torrent]
 
   Home   Help Search Login Register More  
Pages: « 1 [2]  All
  Print  
Author Topic: Two person having the same seed phrase  (Read 295 times)
Saint-loup
Legendary
*
Offline Offline

Activity: 2604
Merit: 2353



View Profile
July 18, 2022, 06:38:10 PM
Last edit: July 18, 2022, 06:49:57 PM by Saint-loup
Merited by vapourminer (3)
 #21

It's not bug on PRNG itself, but rather bug on how blockchain.com wallet obtain random number.
It's a bug from the PRNG process of blockchain.com wallet which lead to the loss of the funds of several users. 34BTC at least have been lost or stolen thanks to the bug, according to this article.
https://arstechnica.com/information-technology/2015/05/crypto-flaws-in-blockchain-android-app-sent-bitcoins-to-the-wrong-address/
I don't think it's your intention, but we should be careful to avoid to minimize this kind of incidents by saying it's not really serious, it's just...

A seed phrase is basically a 128 bit number. Nobody is going to get someone else's seed if they use proper random numbers.
The problem is that it is very difficult to know if the process of generating a number (seed) is in fact random. In other words, it is difficult to test that a procedure generates a random number.

Popular random number source such as /dev/urandom and Android SecureRandom has been audited many times though. All that left is to check which source your wallet use.
A couple of years before another bug related to the PRNG process, of Android OS itself this time has affected several wallets.

Quote
There appears to be a flaw in Google’s Android operating system, making it impossible for the OS to generate “secure random numbers,” which are needed to encrypt Bitcoin transactions.. This affects those who use Bitcoin wallet apps like Bitcoin Wallet, Blockchain.info, BitcoinSpinner, and Mycelium Wallet. Some apps, like Coinbase and Mt Gox are still secure because they don’t rely on the Android OS to generate their numbers.
[...]
Alex Klyubin, a Google Security Engineer on the Android team has acknowledged that this is a legitimate flaw in Android. The problem, as often seems to be the case, is Java.”Java Cryptography Architecture (JCA) for key generation, signing, or random number generation may not receive cryptographically strong values on Android devices due to improper initialization of the underlying PRNG,” said Klyubin. Translated out of geek speak, that means that Android is, as we thought, not generating random numbers correctly.
https://www.digitaltrends.com/mobile/how-to-fix-bitcoin-android-bug/

██
██
██
██
██
██
██
██
██
██
██
██
██
... LIVECASINO.io    Play Live Games with up to 20% cashback!...██
██
██
██
██
██
██
██
██
██
██
██
██
Pages: « 1 [2]  All
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!