Post
Topic
Board Development & Technical Discussion
Re: Brain Wallet for BIP39
by
miky55
on 05/05/2020, 11:56:36 UTC
A collision is not someone being able to guess whatever it was you have hashed... a collision is two different values that will generate the same hash result. ie. SHA256(X) == SHA256(Y) would be a collision.
Thank you, but I know what a collision is.

Given some of the stories that have been floating around (ie: https://www.reddit.com/r/Bitcoin/comments/1ptuf3/brain_wallet_disaster/ and https://www.reddit.com/r/Bitcoin/comments/1zti1p/17956_hacked_brainwallet_passwords/) There have been (and there probably currently are) a lot of people running all sorts of scripts and bots that generate/monitor various Bitcoin addresses that are generated from brainwallets (essentially SHA256(passphrase)).

Therefore, it is not out of the realms of possibility, that some users have also considered using something similar to generate BIP39 seeds the same way... after all, you thought of it!

Of course I know those stories but imo the cases are from weak passphrases, or some quote of poems, movies lyrics... And how many other stories of people loosing there keys/mnemonics???

"At christmas 2002 my oncle Joe came drunk for the dinner. My first girlfriend did not like french fries"
It is interesting to note that the fact that you are using 'proper' English sentence structure and grammar is already reducing the entropy... as there is a relationship and pattern to the words.

Compared with something like: "extra card place track tower violin slim window soul identify tray galaxy" where they are in no way related to each other and there is no defined structure.

Of course again, the grammatical structure of a phrase make it easier to guess for a well done bruteforce tool that will mix with a language AI construction. but this is the compromise of total randomness and the probability I will forget it someday... I belive evrybody have some intimate memories which are very personal and he won't forget ever. that's why my example passphrase was a mix of 2 sentences not related at all to each other. I strongly beleive that even it is in correct in english that is not the kind of passphrase that may be hacked one day.

Anyway for my real passphrase I plan to use much more intimate souvenirs and mix my 2 natives languages (how you can guess are not english)

Thanks for your answer!