Quote from: TheArchaeologist on September 27, 2018, 05:04:50 PM

Quote from: almightyruler on September 26, 2018, 04:33:25 AM

Bumping this thread as I am also doing something similar, and plan to publish my results to increase awareness of the risk of using sha256 brainwallets.

Thanks for bumping. I kind of felt there was not much interest in this before as I expected to get a lot more responses to the list I published. Publishing the results including proof cost me quite some time. But good to see another person with the same interest

Yes, I can see you've spent some time collecting the data and making a nice interface to present it. Perhaps you should make a way for people to leave comments? For example, to link to a thread discussing that specific brainwallet. I'm thinking about approaching this from another perspective, making a website that displays (well known) passphrases to show how basic some of them are, and how quickly funds sent to those addresses were swept away. May even try sending small amounts to a few of them (like ryanc did live in one of his presentations) to demonstrate that the funds will be stolen within literally seconds.

Obviously, I need to do this in a way that makes it obvious how insecure passphrase brainwallets are, but without making it seem too easy for a would-be thief. (To make it clear: it's NOT easy, and I'd say that in 2018 we'd be beyond the point of diminishing returns.)

Quote from: TheArchaeologist on September 27, 2018, 05:04:50 PM

I think your results share a lot of findings in my set. I am very much interested in the ones you found so I can update my list with the ones I missed. Any chance you can share your findings? (a list of found words/sentences you found would be enough)

Still collecting, but I'll share at a later date. I forgot to mention that I'm also including Litecoin and Dogecoin, so some of those keys would not be for Bitcoin.

Quote from: TheArchaeologist on September 27, 2018, 05:04:50 PM

Quote from: almightyruler on September 26, 2018, 04:33:25 AM

The funds were swept out instantly, which strongly suggests it was a theft by a bot watching that privkey. The passphrase is a song title, wit

Yes, there are a couple of bots active which monitor the mempool (using a modified bitcoind client) for incoming transactions. Each address found is then matched against a very large set of addresses composed on all kinds of brainwallets. In other words: Just because the brainwallet "Jack" hasn't been used yet doesn't mean it is a safe brainwallet. When you would deposit some coins into the attached address you can be sure they will be stolen within the blink of an eye.

Yes, I think that's a point that some people will struggle to grasp, that the very first time they use their new brainwallet phrase the funds could be stolen instantly. And also that brainwallet thieves are not focussing on cracking any specific address; the method of cracking will find ANY insecure wallet. So both these arguments fail:

- I'm the only one who knows my passphrase
- No one cares enough about me to try hacking my wallet

This comment on Hacker News from the owner of 1brain... may provide some insight:

https://news.ycombinator.com/item?id=7368283

(That was the only thing that account posted on HN. No one ever replied to that comment.)