I don't think so. Brainwallets are generated as a hash. So if the input is secure, the output is secure. It's not possible to generate the input from the output. And frankly the connection between password -> private key and private key -> public key is very similar in brainwallets. To crack a brainwallet, given only the public key and sufficient bits in the password, is actually harder than directly attacking the private key.
Plus you have to balance "my own fuckup" risk against "someone attacked me" risk, right. Wallets depend on your backup habits, and you backup provider's security. Going through the fora, I'd say "oops. I lot my wallet.dat" is a much more serious threat to your bitcoins, on average, than someone got a hold of your password. Both of those, for most people (including me) are ... lacking. Brainwallets depend on my memory for passwords. A hardware brainwallet would guarantee you're 100% not exposed.
As for ECSDA attacks. It's true that the algorithm itself is near-unhackable. However, make one single transaction on a computer which chooses a non-random k value, and you're exposed. So the risks don't end just because
This is a 2007 study on web password habits. In it, they reveal the fact that fewer than 1% of passwords have bitstrength >= 90 bits: http://i.imgur.com/8vSrx2E.png
Achieving 128 bits of protection with a user selectable and memorable password is statistically unlikely (to put it mildly).
The fact that a brainwallet password is memorable means a computer can bruteforce it in far fewer operations, too. I.e. the bitstrength is mostly meaningless. Just ask the guy who runs http://www.cloudcracker.com
A memorable user-selectable password is incredibly unlikely to be as strong as 128 random bits.
Brainwallets shouldn't be casually recommended without appropriate warnings, but they certainly can be secure.
Passphrases aren't limited by length, and your brainwallet can be derived from your memory and publicly available information, so you can construct very strong memorable passphrases, e.x. the 3rd sentence of the 8th chapter of your favorite book concatenated with a moderately strong but memorable password.
Key stretching with PBKDF or scrypt helps a lot as well. Do you care if it takes 1 minute to compute your keys from the passphrase? Probably not, and it will make cracking much more difficult.
You missed my point. You can't attack the cryptographic function or the keyspace, but you can attack the original passphrase that is hashed, via typical hash cracking methods (rainbow tables, bruteforcing, dictionary attacks, etc.). All you need to know is the hash function; most brainwallets use a single round of SHA256.
Comments
I don't think so. Brainwallets are generated as a hash. So if the input is secure, the output is secure. It's not possible to generate the input from the output. And frankly the connection between password -> private key and private key -> public key is very similar in brainwallets. To crack a brainwallet, given only the public key and sufficient bits in the password, is actually harder than directly attacking the private key.
Plus you have to balance "my own fuckup" risk against "someone attacked me" risk, right. Wallets depend on your backup habits, and you backup provider's security. Going through the fora, I'd say "oops. I lot my wallet.dat" is a much more serious threat to your bitcoins, on average, than someone got a hold of your password. Both of those, for most people (including me) are ... lacking. Brainwallets depend on my memory for passwords. A hardware brainwallet would guarantee you're 100% not exposed.
As for ECSDA attacks. It's true that the algorithm itself is near-unhackable. However, make one single transaction on a computer which chooses a non-random k value, and you're exposed. So the risks don't end just because
To crack a brainwallet, given only the public key and sufficient bits in the password, is actually harder than directly attacking the private key.
It's incredible to see such misinformation on HN. I suggest you read this: https://dl.dropboxusercontent.com/u/315/articles/A%20Large-S...
This is a 2007 study on web password habits. In it, they reveal the fact that fewer than 1% of passwords have bitstrength >= 90 bits: http://i.imgur.com/8vSrx2E.png
Achieving 128 bits of protection with a user selectable and memorable password is statistically unlikely (to put it mildly).
The fact that a brainwallet password is memorable means a computer can bruteforce it in far fewer operations, too. I.e. the bitstrength is mostly meaningless. Just ask the guy who runs http://www.cloudcracker.com
A memorable user-selectable password is incredibly unlikely to be as strong as 128 random bits.
Brainwallets shouldn't be casually recommended without appropriate warnings, but they certainly can be secure.
Passphrases aren't limited by length, and your brainwallet can be derived from your memory and publicly available information, so you can construct very strong memorable passphrases, e.x. the 3rd sentence of the 8th chapter of your favorite book concatenated with a moderately strong but memorable password.
Key stretching with PBKDF or scrypt helps a lot as well. Do you care if it takes 1 minute to compute your keys from the passphrase? Probably not, and it will make cracking much more difficult.
Even extending to a 1-second computation would make it completely infeasible to crack. 1 minute would be way overkill.
Well, whether it's overkill depends on how weak your passphrase is.
You missed my point. You can't attack the cryptographic function or the keyspace, but you can attack the original passphrase that is hashed, via typical hash cracking methods (rainbow tables, bruteforcing, dictionary attacks, etc.). All you need to know is the hash function; most brainwallets use a single round of SHA256.