Quote from: aerobatic on February 13, 2016, 06:52:03 PM

Quote from: marbu1022 on February 13, 2016, 06:26:24 PM

I found this interesting article about the vulnerability of brain wallets that left me asking some questions. I personally think the author of the article deserves a sharp pain below the waist line. He actually attacks and insults brain wallet users, provides very vague information, and it appears, the article is written to make you worry about your brain wallet, or any type of wallet for that matter. Please read article below.

http://www.fastcompany.com/3056651/researchers-find-a-crack-that-drains-supposedly-secure-bitcoin-wallets

1> What I would like to know is, if when I generated my wallet, a seed was created for me to be able to restore my wallet at a later point in time, when I want to bring the wallet online again, how could my seed, and therefore my key be attacked??? There is nothing in the blockchain since there has never been any transactions. I don't understand what the author is really talking about? And even if I have conducted transactions to the wallet addresses, how could the presence of those public addresses in the blockchain be used to attack my wallet?

2> Is my above example a brain wallet, or is it something different??

Marbu -

never ever use a Brainwallet. theyre not safe. The big flaw is that they are human generated passwords - the worst kind. And the reward for cracking them is cold hard cash, so every hacker and thief has an incentive to crack them.

it can happen to anyone - including me - when i first started in bitcoin, i used a brain wallet along with regular wallets. i didnt have much in there because a cryptographer friend had already warned me they were unsafe but i i wasnt so sure as i had picked a very complex and long password and i thought that my one would be safe.

So instead of emptying my brain wallet, i left it with some funds but de-risked it and removed most of my coins - i had probably left just a couple in there. awhile later (a few months), i checked back and all my funds had of course been drained ages earlier. this was a very long (40+ characters) password. It had several real words inside it, but it also had numbers and punctuation marks and was longer and more complex than anything in the best dictionary. didnt take them long to crack it and steal my (albeit, small) reward. A month earlier and it wouldve been a lot more.

In short, there's nothing the human brain could think of that a brute force password cracking software in the cloud couldnt find, given a bit of time.

Bottom line: Dont do it. there's no sane reason to use a brain wallet. And if you do, expect to lose your funds. The hackers have infinite time to keep retrying your password. nothing stops them. they can do millions of tries a second and keep going for months til they crack it. Why let them!?

I don't see how it's possible to crack such a sophisticated password as what you say you used. You are talking about a 256 bit + password. This password cannot be cracked in any practical amount of time.