What's the worse that could happen with custom seeds?

[Mia Chloe]

So lately I've been brainstorming on safer ways to store our seeds and custom words seem very viable. First let's look back at BIP39 and ELECTRUM seed because most of the things I find as an advantage are actually from ELECTRUM seeds. Basically I was considering is it even possible to rely on just a word or two while paying less attention to the main 12 words?

Basically would it be really wise to trust the safety of a particular wallet solely based on the custom words you added?  Plus does someone having the 12 words really posse any major risks to you wallet in general? What I'm looking for here is more of a brainstorm if possible more like to access the risks and the advantages. Plus I've checked SLIP39 so I don't really need it in this discussion per say.

[hmbdofficial]

Basically would it be really wise to trust the safety of a particular wallet solely based on the custom words you added?  

well, the reason why i will consider it to be unwise to trust the wallet's safety solely on the custom words is the silent wrong wallet issue it might poses, this can be like a possible typo, or capitalization of some words, or sometimes the auto correct from the keyboard also can actually create an entirely different valid wallet with No funds in it. and you will not get error message when it happen, you will probably think the funds are lost but they are just on the correct passphrase version. this is how funds can be lost permanently and that's why i don't consider solely trusting the custom word alone.  

[hosemary]

If your passphrase provides enough entropy, no one will be able to access your funds, even if they have access to your seed phrase. But this doesn't mean it's wise to rely solely on your passphrase and not protect your seed phrase.
To make your passphrase have high entropy, you have to make it complex, which may introduce some other risks such as writing it down incorrectly. So, I would prefer to have a secure seed phrase, and if I want to have a passphrase, I wouldn't need to make it too complex.

[Mia Chloe]

well, the reason why i will consider it to be unwise to trust the wallet's safety solely on the custom words is the silent wrong wallet issue it might poses, this can be like a possible typo, or capitalization of some words, or sometimes the auto correct from the keyboard also can actually create an entirely different valid wallet with No funds in it.

Hmm I do get your point but what if the words were properly written and the user has a clear image of what he wrote? I think that should mitigate the problem you are trying to explain. Plus I have tested it few times and it seems it is also case sensitive too but I'll do more research.

If your passphrase provides enough entropy, no one will be able to access your funds, even if they have access to your seed phrase. But this doesn't mean it's wise to rely solely on your passphrase and not protect your seed phrase.
To make your passphrase have high entropy, you have to make it complex, which may introduce some other risks such as writing it down incorrectly. So, I would prefer to have a secure seed phrase, and if I want to have a passphrase, I wouldn't need to make it too complex.

I see.... What if a standard Electrum seed is used and then just a word or two added nothing too complex but simply  words unique to the user actually that should cover this issue right?

[Zaguru12]

Basically I was considering is it even possible to rely on just a word or two while paying less attention to the main 12 words?

Basically would it be really wise to trust the safety of a particular wallet solely based on the custom words you added?  Plus does someone having the 12 words really posse any major risks to you wallet in general?

At first read I was thinking you meant selecting custom words as your seed phrase which is possible in electrum wallet but not advisable due to the fact that human are not capable to create that great randomization

For passphrase which most know as seed extension, yes it’s actually not possible that someone will actually get to recover your wallet without the passphrase (seed extension) but to me I think there is a risk if they get access to the 12 words. Having access to the 12 word means that the extended word must be good enough not to be guessable.

For attention to two words only and not paying attention to the other words is actually something I won’t recommend because what if you actually leave the 12 words vulnerable or you forget where it is actually backed up, you cannot also recover a wallet with just the pass phrase alone

[Mia Chloe]

~snip

Of course I'm not referring to fully custom seeds I already understand the risks based on randomisation what I'm looking to see really is to try brainstorming the risks with having extra passphrase after the regular 12 words. I'm still) doing some reading plus I'm open to more ideas probably a possibility of getting control over a wallet with the 12 words maybe via any flaws that come from custom words or extra passphrases.

For attention to two words only and not paying attention to the other words is actually something I won’t recommend because what if you actually leave the 12 words vulnerable or you forget where it is actually backed up, you cannot also recover a wallet with just the pass phrase alone

The idea is not to totally ignore the existing 12 words it's to have backups that even if they for some reason become vulnerable you'll still be near 100% safe because you have the custom passphrase.

[Charles-Tim]

I see.... What if a standard Electrum seed is used and then just a word or two added nothing too complex but simply  words unique to the user actually that should cover this issue right?

No, two words added as a passphrase is very weak.

Space is a character in passphrase, they are all a single word.

Two simple words will be easily brute forced within a minute or in less than a day with the right equipment. If you want it to be only words, at least let the characters be 20 letters or more.

[Zaguru12]

No, two words added as a passphrase is very weak.

Space is a character in passphrase, they are all a single word.

Two simple words will be easily brute forced within a minute or in less than a day with the right equipment. If you want it to be only words, at least let the characters be 20 letters or more.

I think the word will depend on the number of character and how the characters were mixed, for example; bstqlines2qutin3ag can this be recorded as a single word in a passphrase? If then I think two words might be ok but the character of the word will actually either make it easily brute force or not.

I think this is what MiaChloe meant by two words actually

[nc50lc]

Basically I was considering is it even possible to rely on just a word or two while paying less attention to the main 12 words?

Just think of the passphrase as a password that has no attempt limit to bruteforce when the seed phrase is available to the attacker.

In that regard, if you mean that two common words are enough to be safe: it's not.
It can be bruteforced easily using dictionary attack no matter how long it is.

On the other hand, one long non-existing word preferably with numerals and a symbol(s) should be better than it.

-snip- First let's look back at BIP39 and ELECTRUM seed because most of the things I find as an advantage are actually from ELECTRUM seeds.

Do you mean it has advantages over BIP39 when it comes with the custom words?

Because BIP39 and Electrum's use of passphrase aka "seed extension" are basically the same, Electrum just labeled it differently.
The calculation of the "seed" from the "seed phrase" and passphrase use the same algorithm except for the default salt:
electrum+your_passphrase for Electrum & mnemonic+your_passphrase for BIP39.

[Ambatman]

Hmm I do get your point but what if the words were properly written and the user has a clear image of what he wrote?

The human mind could be unreliable
If you barely make use of the passphrase your brain might start mixing it up with other normal passwords
And might not recall capitalization or symbols properly.
This is why memorising seedphrase without proper backup isn't really advised.

it's to have backups that even if they for some reason become vulnerable you'll still be near 100% safe because you have the custom passphrase.

Not foolproof
But a dummy wallet could help
One gotten from just the seedphrase with little balance
But at the end of the day
A passphrase with low entropy would barely help if the attacker knows about the passphrase.