Post
Topic
Board Service Announcements
Re: [ANN] bitaddress.org Safe JavaScript Bitcoin address/private key [BOUNTY 0.1BTC]
by
pointbiz
on 15/09/2011, 23:29:29 UTC
Hi pointbiz,

I noticed that there are a lot of people that think about virtual wallet that no data needed to save in local or other server. The best way to do this is to specify a memorizable but not easy to guess string by the end user and the string can be used to generate private/public key pair.  When the user want to know his/her private/public key pair, he/she can generate them again with the same string.

Can you consider about that function in your website?

I'll say maybe. I'm trying to keep the interface simple, maybe an advanced tab or something would work for that.

At the moment I'm not convinced Deterministic Wallets are the way to go. People think alike and therefore the algorithms and patterns used to make Deterministic Wallets can be gamed en mass.

Consider these two possible wallet decisions:
1) using a 5-character password to create a Deterministic Wallet using some tool.
2) create a truly random private key and copy/paste it into a text file in an encrypted true crypt drive, that is protected with a 5-character password, that you back up in several locations online and offline.

In scenario #1 someone can turn their GPU farm to silently create a bunch of Deterministic Wallets and check them against the blockchain. Only 1 person has to have an easy password for this attack to work and it's more likely to be a profitable attack.

In scenario #2 someone has to personally hack you then make childs play of your password. Much less likely to happen and more expensive for an attacker. Your 5-character password is much safer on your computer or on dropbox then in the blockchain for anyone to brute force. Maybe I could enforce a minimum password size and minimum complexity.

All that being said thank you for the suggestion, I see there will probably be demand for this type of feature. It's definitely a complimentary feature that would make sense on bitaddress so I'll consider it in the future.