Quote from: Cypherpunk38 on January 31, 2015, 11:08:58 PM

Quote from: infernusdoleo on January 31, 2015, 10:58:55 PM

As for how you validate it recreated the password - you use it. If it works, it did it right. If it does't, it didn't Wink

How does the Armory client know you typed in the right password?

Right, but that's because Armory has a way to validate it: it can try to decrypt your wallet. Since you're not sending the Armory developers your wallet or your private key, they don't have the ability to test to see if this is the right password and this tool would likely never actually work since they would/could just send you the first password they came up with and if it works it works, if it doesn't it doesn't. Their answer seem to indicate that, given a weak enough password and you remembering enough of it for them to work from, they can send you a password that has a very reasonable chance of working and they might (they haven't said this so I don't know) have the ability to know when the recreation process succeeded or failed.

Don't get me wrong, I'm not trying to be a dick here at all and I certainly understand how brute force works. But what bothers me most is that they can have some certainty that the generation process worked. Unless I am completely misunderstanding how things work (and I may be, so feel free to correct me if I am) they shouldn't be able to do that without testing the password against a private key (which they don't and should not have).

etotheipi has an idea for that purpose, which was something like keeping an entry in each wallet for a public challenge you can roll against password candidates, so that others can offer to brute force your password for you without getting your wallet, just the challenge, while proving proof they find the password to the user. That idea was to create a way for the community to offer computing power to users who forgot a lot of their password and have no backup, most likely against a monetary incentive.

I think we still plan on implementing that feature in the new wallets, but for this current case, infernusdoleo would have have to give his password AND wallet, and trust we don't rob him.

Quote from: infernusdoleo on January 31, 2015, 10:58:55 PM

The only reason I'm asking for this tool is Armory does not have an RPC interface or anything similar - if this were my bitcoin-qt wallet for which I effed up the password, I'd simply just brute force against the RPC with a perl script.

That's not true. If you aren't afraid to get your hands a little dirty with Python, the script is available in our repo, at ./extras/findpass.py. I think you'll have to build the C++ library for the crypto, but I'm not sure. Ask CircusPeanut, he built this script. Otherwise we can run it for you.