This is a 2007 study on web password habits. In it, they reveal the fact that fewer than 1% of passwords have bitstrength >= 90 bits: http://i.imgur.com/8vSrx2E.png
Achieving 128 bits of protection with a user selectable and memorable password is statistically unlikely (to put it mildly).
The fact that a brainwallet password is memorable means a computer can bruteforce it in far fewer operations, too. I.e. the bitstrength is mostly meaningless. Just ask the guy who runs http://www.cloudcracker.com
A memorable user-selectable password is incredibly unlikely to be as strong as 128 random bits.
Brainwallets shouldn't be casually recommended without appropriate warnings, but they certainly can be secure.
Passphrases aren't limited by length, and your brainwallet can be derived from your memory and publicly available information, so you can construct very strong memorable passphrases, e.x. the 3rd sentence of the 8th chapter of your favorite book concatenated with a moderately strong but memorable password.
Key stretching with PBKDF or scrypt helps a lot as well. Do you care if it takes 1 minute to compute your keys from the passphrase? Probably not, and it will make cracking much more difficult.
Comments
To crack a brainwallet, given only the public key and sufficient bits in the password, is actually harder than directly attacking the private key.
It's incredible to see such misinformation on HN. I suggest you read this: https://dl.dropboxusercontent.com/u/315/articles/A%20Large-S...
This is a 2007 study on web password habits. In it, they reveal the fact that fewer than 1% of passwords have bitstrength >= 90 bits: http://i.imgur.com/8vSrx2E.png
Achieving 128 bits of protection with a user selectable and memorable password is statistically unlikely (to put it mildly).
The fact that a brainwallet password is memorable means a computer can bruteforce it in far fewer operations, too. I.e. the bitstrength is mostly meaningless. Just ask the guy who runs http://www.cloudcracker.com
A memorable user-selectable password is incredibly unlikely to be as strong as 128 random bits.
Brainwallets shouldn't be casually recommended without appropriate warnings, but they certainly can be secure.
Passphrases aren't limited by length, and your brainwallet can be derived from your memory and publicly available information, so you can construct very strong memorable passphrases, e.x. the 3rd sentence of the 8th chapter of your favorite book concatenated with a moderately strong but memorable password.
Key stretching with PBKDF or scrypt helps a lot as well. Do you care if it takes 1 minute to compute your keys from the passphrase? Probably not, and it will make cracking much more difficult.
Even extending to a 1-second computation would make it completely infeasible to crack. 1 minute would be way overkill.
Well, whether it's overkill depends on how weak your passphrase is.