Don't use WarpWallet, the manual key management is a nightmare, and it uses uncompressed addresses. Just memorize a random 12 word seed phrase.

I am the the author of Brainflayer. Please be aware that this poster is violating my copyright, and any software they offer (if it exists at all) may include malware.

Brainflayer is not free (as in speech) software. Distributing modified versions of it (with the sole exception of forked repositories on github) is illegal. Distributing precompiled binaries is illegal without exception.

As gmaxwell pointed out, a lot of what was posted by btc-room101 is "technobable nonsense".

I wrote up the algorithm here last month: https://rya.nc/bitfi-wallet.html

Highly overconfident, as the wallet is utter garbage security wise. It's like they *tried* to make it insecure.

I think "screech" is a good description of their social media "strategy".

Bitfi's hardware wallet was confirmed to be a brain wallet variant.

I reversed it and published the algorithm. These addresses can be cracked without any access to the device.

https://rya.nc/bitfi-wallet.html

They're currently trying to throw shade on me, claiming I'm out to get them due to some perceived personal slight.

This is false - I engaged on a very similar crusade when the now defunct ether.camp site was offering brain wallets without explaining what they were.

The siren call of brain wallets is strong, but we must fight back.

I'm the author of Brainflayer. This dude is full of shit. It's true that GPU-based software would be faster, however not 100x faster. Also, cracking elliptic curve keys has nothing to do with prime factoring.

The baby-step giant-step attack described can only be used on specific public keys - it does not work on addresses and it does not work on multiple simultaneous keys.

At best this person is selling snake oil. At worst, it's malware that will drain your wallet.

I'm not entirely sure what you're asking here. If you'd like to do a masked search iterating though only specified bits, I would consider adding that feature if you are willing to pay for it. However, my consulting fees are substantial.

Whatever money you're spending on electricity would be better spent on gambling.

I plan to release an update adding support for this "passphrase plus xor" brainwallet variant, so don't go using it.

I'm also getting a bunch of spam with "?bounty=timr" - they've all bee to the email address I'm registered to btc-e with, which got leaked a while back.

I've been trying to experiment with P2SH addresses and non-standard scripts. I've sent some coins on testnet to 2NGDaDjuNuXz1wzHkusqUKCEtvwGr1q3JUc, but I'm having a hard time spending the output.

The redeemScript is

I was able to add it to my wallet using importmulti, but when I do listunspent it is not shown as spendable, and I haven't been able to spend via signrawtransaction. Can anyone point me to a tool that I can use to build the spending transaction?

I tried following along with this example: https://github.com/petertodd/python-bitcoinlib/blob/master/examples/spend-p2sh-txout.py

but when i call VerifyScript(txin.scriptSig, txin_scriptPubKey, tx, 0, (SCRIPT_VERIFY_P2SH,))

I get "P2SH inner scriptPubKey returned false"

Edit: Got it working, needed to use python3

I don't know about arch and suse, but Debian signs their packages with gpg, and a number of the mirrors are https (e.g. mirrors.kernel.org).

I still can't see where it was screwed up, lol.

The link got screwed up somehow. I fixed my previous post.

See also http://coinig.com/?adr=144187999121393192DxViqQKPPrghj9M3&msg=2017-01-26+controlled+by+ryanc&sig=H1t3t0ZE%2B%2FQayD0S7%2F2RfMUvz9Qsh%2F9cFW8obuc4K3VDTkTJF%2B30ZRcW97TrdW3iNfEonx8BfqiSrfYAcYIIeDU%3D

You're referring to 1woukheyeacxfpxtpkxjqxureevdkbywj? I spent about a day and a half on that address with several dozen instances of various sizes.

There are bad ways to create bitcoin private keys besides brainwallets. Broken PRNGs being one of them, and keys people have deliberately made weak being another.

If there's no arguments, or the command is hard coded, there's no security issue with backticks/qx to the best of my knowledge.

Since I'm looking at the code anyway, I notice that there's a bunch of command execution using qx{} which IIRC is equivalent to backticks, and potentially vulnerable to shell injection. This should probably be replaced with `open` or `system`with arguments passed as an array.