Post
Topic
Board Development & Technical Discussion
Re: Isn't the output of SHA256 *slightly* too big to use for a private key?
by
gmaxwell
on 15/10/2013, 07:05:46 UTC
I did read a very interesting thread before, where it was shown brainwallets with common passphrases like "password" and "love" had transactions sweeped out of them quickly.
"brainwallets" far more elaborate than those (e.g. ones with 60+ character inputs) have been compromised. Humans are not an acceptable source of randomness.

Quote
Using a salt definitely would make the security better.
If the salt is large enough to provide adequate security you can just use the password to encrypt the salt instead, and then you don't have the key management nightmare of a password which can never really be changed.