Quote from: ffe on August 29, 2013, 07:23:03 PM

Quote from: Jan on August 29, 2013, 07:17:03 AM

Quote from: ffe on August 29, 2013, 12:53:46 AM

Quote from: Jan on August 28, 2013, 10:58:45 AM

The thing is that many people think that their password is safe as they use something of similar size/complexity on web-sites. However, on a web-site the attacker cannot really brute force it until he has access to the encrypted password file or a hash of the password (maybe with some seed). Without this the hacker is left with a few attempts a second (through the web-page login), with the risk of locking the account he tries to gain access to. With brainwallets the attacker can start brute forcing with trillions of attempts a second just by looking at the blockchain. (or in the case of a paper backup, once he has access to the encrypted private key).
I really want Mycelium users to use safe and verifiable mechanisms that do not lure them into using something that they think is safe while it is not.

So how about if we convert the attack on the blockchain into an attack on a website instead. We can do it by adding a protocol to the client to save the strong key, encrypted with the human password, on S3 Amazon cloud or Dropbox or something.

Only the strong key shows up on the blockchain and an attacker would have to dig up the user Dropbox account before conducting a dictionary attack.

The unencrypted strong key never leaves Mycelium.

If I get you right you suggest that the private key is encrypted with a human generated (potentially weak) password. The encrypted private key is stored on dropbox. Access to dropbox is with a different human generated (potentially weak, or the same) password.
This would make you vulnerable to an insider attack at dropbox, or one of their historical hacks.

Yes, you got me right. Of course it's a ton better than putting a human password on the blockchain subject to mass dictionary attack sweeps. I thought that was the point of the snippet of yours that I quoted.

I know you feel security should be only hard keys on paper never seeing the network. However, there are many people who just want the same level of security one gets with bank accounts with a few hundred dollars allowing online payments.

It's just too hard today to get my friends to use clients with locked in keys that can only be extracted unsafely or with elaborate precautions.

We are trying to make export as safe as possible, but you are right: Who would jump through a lot of hoops to secure a small sum for spending?
There are currently several backup strategies:
1. No backup - It is like a pair of pants, if you wash them the money is gone
2. Export as QR-code - The QR code is displayed, you take a picture with a secondary camera. This is very easy and as safe as your camera.
3. Export private key to clipboard - From there you can put it anywhere you like. You have to trust any other apps on your phone not to grab it, or use a dedicated device.
4. Export to SD card - This allows you to print it out directly from a SD card enabled printer with no computer in between. You have to trust any other apps on your phone not to grab it, or use a dedicated device.

I would use 1 if I had just a few dollars, and 2 if I only used it for small sums, and didn't want to bother with a dedicated device. Option 3 and 4 I would use for large sums and with a dedicated device.
Maybe option 2 would be suitable for your friends.
Personally I use option 4.