Quote from: pointbiz on September 15, 2011, 11:29:29 PM

Quote from: peak on September 15, 2011, 09:26:27 AM

Hi pointbiz,

I noticed that there are a lot of people that think about virtual wallet that no data needed to save in local or other server. The best way to do this is to specify a memorizable but not easy to guess string by the end user and the string can be used to generate private/public key pair. When the user want to know his/her private/public key pair, he/she can generate them again with the same string.

Can you consider about that function in your website?

I'll say maybe. I'm trying to keep the interface simple, maybe an advanced tab or something would work for that.

At the moment I'm not convinced Deterministic Wallets are the way to go. People think alike and therefore the algorithms and patterns used to make Deterministic Wallets can be gamed en mass.

Consider these two possible wallet decisions:
1) using a 5-character password to create a Deterministic Wallet using some tool.
2) create a truly random private key and copy/paste it into a text file in an encrypted true crypt drive, that is protected with a 5-character password, that you back up in several locations online and offline.

In scenario #1 someone can turn their GPU farm to silently create a bunch of Deterministic Wallets and check them against the blockchain. Only 1 person has to have an easy password for this attack to work and it's more likely to be a profitable attack.

In scenario #2 someone has to personally hack you then make childs play of your password. Much less likely to happen and more expensive for an attacker. Your 5-character password is much safer on your computer or on dropbox then in the blockchain for anyone to brute force. Maybe I could enforce a minimum password size and minimum complexity.

All that being said thank you for the suggestion, I see there will probably be demand for this type of feature. It's definitely a complimentary feature that would make sense on bitaddress so I'll consider it in the future.

Hi pointbiz,

Thanks for reply.
It's true that deterministic wallet is not as secure as truly random private key. But for most common people who do not take care their bitcoin every day, I would say that current wallet is not a good idea. I have convinced 3 of my friends to get some bitcoins, only the one who meet me everyday have his coins now, the other two both lost their wallets. I think the lost of wallet is a very common issue for not deepin users.

5-character password is too easy to guess out. May be you can add some suggestions on you website, like 8+ characters, do not use alphabet only string... A support of utf-8 character would also be a good idea, it is easy to make a exhaustive key search of 5 characters combination from 128 ASCIIs but it is impossible to look through 5 characters combination of utf-8 set.

peak

Posts

Merits