đź“… Original date posted:2018-01-18
📝 Original message:> so it’s less obvious that it’s a bitcoin seed when found by a malicious
third party
1. The same words are used for wallets of all kinds of coins, so it's not
obvious it's for bitcoin.
2. Anyone recognising the word "satoshi" as related to cryptocurrency in
general, would also recognise any mnemonic.
3. You could elect to skip a mnemonic that includes the word if it was a
personal concern (but I would discourage selecting a mnemonic base on
personal preference, as could get dangerously close to being a brain wallet
in effect).
4. You could choose to record just the first 4 characters of each word,
"sato" is enough.
5. Where do we stop? the words "coin", "cash", "rich" are in there too.
6. About automated data-recovery, if you are storing mnemonics on HDDs or
other digial media, then you have larger security concerns than it just
being found during HDD recycling.
But most of all:
7. Removing a word or changing a list *is impossible* as verification of an
existing mnemonic requires the list. To change one word, you would need to
provide an alternative to BIP0039 to cope with alternative words, or change
all the words to a completely new set of 2048 English words so that it is
clear which wordlist is in use.
Regards,
Alan
On Thu, Jan 18, 2018 at 2:55 AM, Jonathan Sterling via bitcoin-dev <
bitcoin-dev at lists.linuxfoundation.org> wrote:
> All the more reason to only use the most common words that meet the other
> criteria: https://github.com/bitcoin/bips/blob/master/bip-
> 0039.mediawiki#Wordlist
>
> I agree - keeping "satoshi" in there is an unnecessary security risk.
>
> Kind Regards,
>
> Jonathan Sterling
>
> On Thu, Jan 18, 2018 at 8:14 AM, CryptAxe via bitcoin-dev <
> bitcoin-dev at lists.linuxfoundation.org> wrote:
>
>> Why wouldn't they just test the frequency of words from the wordlist in
>> entirety?
>>
>> On Jan 17, 2018 5:10 PM, "Weiwu Zhang via bitcoin-dev" <
>> bitcoin-dev at lists.linuxfoundation.org> wrote:
>>
>>> 2018-01-09 19:20 GMT+08:00 Ronald van der Meer via bitcoin-dev
>>> <bitcoin-dev at lists.linuxfoundation.org>:
>>> > After reviewing some bitcoin improvement proposals, I noticed that one
>>> of the words that can be found on the BIP39 English wordlist is “satoshi”.
>>> > I suggest removing this word from the list so it’s less obvious that
>>> it’s a bitcoin seed when found by a malicious third party.
>>>
>>> If a malicious third party discovers a word list that look like a
>>> seed, they would try using it as Bitcoin seed first anyway, with or
>>> without finding the word 'satoshi' in it. The security threat is that
>>> a malicious third party may index what they found and test every
>>> occurrence of 'satoshi' for a lead to a seed.
>>>
>>> For example, a hard-disk recycling service would add this word to
>>> their salvage tools. Any successfully hacked gmail account will be
>>> 'satoshi' tested too.
>>>
>>> So I see this as a reasonable improvement:)
>>> _______________________________________________
>>> bitcoin-dev mailing list
>>> bitcoin-dev at lists.linuxfoundation.org
>>> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>>>
>>
>> _______________________________________________
>> bitcoin-dev mailing list
>> bitcoin-dev at lists.linuxfoundation.org
>> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>>
>>
>
>
> --
> Kind Regards,
>
> Jonathan Sterling
> +44 (0)7415 512691 <+44%207415%20512691>
>
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev at lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20180118/418a49c6/attachment-0001.html>;
Alan Evans [ARCHIVE] /
npub15s…htj94
2023-06-07 18:09:36
in reply to nevent1q…kx2n
Author Public Key
npub15s37yxwtrf7cd83sujzneprwsjtvhjjxcygutpqk5f966093utms6htj94Published at
2023-06-07 18:09:36Event JSON
{
"id": "3a7d24abeea6f06fcb024f335565e24778a6bf0eac0b0b2aa8286e96f9359181",
"pubkey": "a423e219cb1a7d869e30e4853c846e8496cbca46c111c58416a24bad3cb1e2f7",
"created_at": 1686161376,
"kind": 1,
"tags": [
[
"e",
"af95054b4a9851c4be8011ad5ba948392ace95a3f2a3e739e6cb49fac5454419",
"",
"root"
],
[
"e",
"5d145566aef22891627016e295b7ac6b783a3fc91881d46572baa8a62d42af71",
"",
"reply"
],
[
"p",
"da834f90279288b5194077dbb18213ee35fdefcd64c2ddf8865b53b6d13d8f8d"
]
],
"content": "📅 Original date posted:2018-01-18\n📝 Original message:\u003e so it’s less obvious that it’s a bitcoin seed when found by a malicious\nthird party\n1. The same words are used for wallets of all kinds of coins, so it's not\nobvious it's for bitcoin.\n\n2. Anyone recognising the word \"satoshi\" as related to cryptocurrency in\ngeneral, would also recognise any mnemonic.\n\n3. You could elect to skip a mnemonic that includes the word if it was a\npersonal concern (but I would discourage selecting a mnemonic base on\npersonal preference, as could get dangerously close to being a brain wallet\nin effect).\n\n4. You could choose to record just the first 4 characters of each word,\n\"sato\" is enough.\n\n5. Where do we stop? the words \"coin\", \"cash\", \"rich\" are in there too.\n\n6. About automated data-recovery, if you are storing mnemonics on HDDs or\nother digial media, then you have larger security concerns than it just\nbeing found during HDD recycling.\n\nBut most of all:\n\n7. Removing a word or changing a list *is impossible* as verification of an\nexisting mnemonic requires the list. To change one word, you would need to\nprovide an alternative to BIP0039 to cope with alternative words, or change\nall the words to a completely new set of 2048 English words so that it is\nclear which wordlist is in use.\n\nRegards,\n\nAlan\n\nOn Thu, Jan 18, 2018 at 2:55 AM, Jonathan Sterling via bitcoin-dev \u003c\nbitcoin-dev at lists.linuxfoundation.org\u003e wrote:\n\n\u003e All the more reason to only use the most common words that meet the other\n\u003e criteria: https://github.com/bitcoin/bips/blob/master/bip-\n\u003e 0039.mediawiki#Wordlist\n\u003e\n\u003e I agree - keeping \"satoshi\" in there is an unnecessary security risk.\n\u003e\n\u003e Kind Regards,\n\u003e\n\u003e Jonathan Sterling\n\u003e\n\u003e On Thu, Jan 18, 2018 at 8:14 AM, CryptAxe via bitcoin-dev \u003c\n\u003e bitcoin-dev at lists.linuxfoundation.org\u003e wrote:\n\u003e\n\u003e\u003e Why wouldn't they just test the frequency of words from the wordlist in\n\u003e\u003e entirety?\n\u003e\u003e\n\u003e\u003e On Jan 17, 2018 5:10 PM, \"Weiwu Zhang via bitcoin-dev\" \u003c\n\u003e\u003e bitcoin-dev at lists.linuxfoundation.org\u003e wrote:\n\u003e\u003e\n\u003e\u003e\u003e 2018-01-09 19:20 GMT+08:00 Ronald van der Meer via bitcoin-dev\n\u003e\u003e\u003e \u003cbitcoin-dev at lists.linuxfoundation.org\u003e:\n\u003e\u003e\u003e \u003e After reviewing some bitcoin improvement proposals, I noticed that one\n\u003e\u003e\u003e of the words that can be found on the BIP39 English wordlist is “satoshi”.\n\u003e\u003e\u003e \u003e I suggest removing this word from the list so it’s less obvious that\n\u003e\u003e\u003e it’s a bitcoin seed when found by a malicious third party.\n\u003e\u003e\u003e\n\u003e\u003e\u003e If a malicious third party discovers a word list that look like a\n\u003e\u003e\u003e seed, they would try using it as Bitcoin seed first anyway, with or\n\u003e\u003e\u003e without finding the word 'satoshi' in it. The security threat is that\n\u003e\u003e\u003e a malicious third party may index what they found and test every\n\u003e\u003e\u003e occurrence of 'satoshi' for a lead to a seed.\n\u003e\u003e\u003e\n\u003e\u003e\u003e For example, a hard-disk recycling service would add this word to\n\u003e\u003e\u003e their salvage tools. Any successfully hacked gmail account will be\n\u003e\u003e\u003e 'satoshi' tested too.\n\u003e\u003e\u003e\n\u003e\u003e\u003e So I see this as a reasonable improvement:)\n\u003e\u003e\u003e _______________________________________________\n\u003e\u003e\u003e bitcoin-dev mailing list\n\u003e\u003e\u003e bitcoin-dev at lists.linuxfoundation.org\n\u003e\u003e\u003e https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev\n\u003e\u003e\u003e\n\u003e\u003e\n\u003e\u003e _______________________________________________\n\u003e\u003e bitcoin-dev mailing list\n\u003e\u003e bitcoin-dev at lists.linuxfoundation.org\n\u003e\u003e https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev\n\u003e\u003e\n\u003e\u003e\n\u003e\n\u003e\n\u003e --\n\u003e Kind Regards,\n\u003e\n\u003e Jonathan Sterling\n\u003e +44 (0)7415 512691 \u003c+44%207415%20512691\u003e\n\u003e\n\u003e _______________________________________________\n\u003e bitcoin-dev mailing list\n\u003e bitcoin-dev at lists.linuxfoundation.org\n\u003e https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev\n\u003e\n\u003e\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20180118/418a49c6/attachment-0001.html\u003e",
"sig": "f2c299ff042718983bf229d9fe6262f1d0ddfa9ee26c74852e6d2af306427e59e9662f6f17314def33bb0547f488c24bbffac33a704c1e07fa65ae0f8de322d3"
}