[aqme28]

How safe is this compared to using a brainwallet (https://en.bitcoin.it/wiki/Brainwallet) with sufficiently strong password (say, a hundred secure-randomly generated characters)?

A brainwallet sounds far far simpler to set up, at least.

[GigabyteCoin]

Brainwallets are never a good idea.

See here: https://www.google.com/search?q=brainwallet+(stolen+OR+hacke...

[meowface]

Uh, no.

Brainwallets with weak passphrases are a bad idea. Every case of a brainwallet theft has been due to users coming up with predictable passphrases to generate the key.

Most brainwallet private keys are simply a SHA256 hash of a passphrase, which is fairly easy for a dedicated attacker to crack via bruteforce or dictionary attacks, yes. But if you use, say, a 12-word sentence with completely random words, like SHA256("fire pickle shipment lachrymose deity unwitting pernicious obstacle kitchen tumbleweed mannequin erudite"), and maybe some random letters or numbers at the end, it's infeasible that it'll ever be cracked.

One common problem is that many people will pick song lyrics, book titles, or Bible quotes as their passphrase. Obviously attackers are going to scrape and add those to their dictionaries (which will then also be permutated in many ways), so it's critical that the words are picked arbitrarily and that there are enough of them.

The idea itself isn't inherently insecure, except for the fact that SHA256 was probably a poor hash function to use since it's fast.

I can guarantee that this will always be more secure than trusting any online service to store your wallet instead. The only risk is you forgetting one or more of the words, in which case you're in trouble.

[aianus]

Just wanted to add a note that you can come up with whatever deterministic process you want to generate the keypair.

For example SHA256(MySuperSlowAwesomeLongHash("fire pickle shipment lachrymose deity unwitting pernicious obstacle kitchen tumbleweed mannequin erudite"))

[meowface]

True. Many people appear to use http://brainwallet.org or similar sites though; they don't really understand what hashing functions are, so they trust these sites to securely generate a private key.

Someone should really make an alternative with bcrypt or scrypt.

[gibybo]

100 randomly generated characters (a-z, A-Z, 0-9) would be 595 bits of entropy. You will not be brute forcing it. Although 100 characters is pretty excessive, since a Bitcoin address only has 160 bits of entropy.

[BlackDeath3]

Remember scales - there is a lot more entropy in 160 bits than there is in 100 bits.

[gibybo]

I don't think you read my statement very carefully. The password has 595 bits of entropy, not 100.

[BlackDeath3]

Oh dear... I do that a lot. You're right.