Hacker News Reader

Comment by gonehome | Hacker News Reader

This does fit with what I think is the most interesting use case of bitcoin that I'd read about: A Ukrainian living in the Russian controlled portion of the country getting out with his wealth intact.

The border was controlled by corrupt Russian guards that would steal things of value. You could pass the border occasionally to visit family on the other side, but it was risky to take anything.

He put all his wealth into bitcoin, memorized his wallet seed words like his life depended on it, crossed the border with nothing, and then regenerated his wallet on the other side (and then presumably transferred the money back into a usable fiat currency/bank account).

I thought that was pretty cool.

It'd be interesting if the community put a guide together to make it easy for people that need to escape hostile countries with their wealth intact to do so, something I might try to do if I find some time to write it up.

View on HN

Sounds like a fake propaganda story (oh look, those corrupt Russian siloviks! every single one of them!). There is A TON of Ukrainian workers (zarobitchane) in Russia who not always work legally and they trivially wire funds back to their relatives. (Fun fact: currently foreign workers is one of the most important income sources of foreign currency for the Ukrainian state) Even if we assume that Crimean border guards were indeed so corrupt, it's trivial to go from Crimea (I assume you talk about it) to the Russian mainland, since there are virtually no checks between them, and then back to Ukraine.

One possibility which could make this story more trustworthy is that those funds were illegal (e.g. bribes accumulated during Ukraninan rule), so the person would want to transfer them as discretely as possible. I think Bitcoin is widely used for similar purposes in China, as it's (was?) one of the best ways to move abroad illegally acquired funds.

I found where I think I had originally read it: https://www.forbes.com/sites/tatianakoffman/2020/06/13/why-b...

It sounded plausible enough to me.

Relevant quote is below:

"""

Bitcoin is a protest against corruption.

Naval Ravikant, founder of Angelist once tweeted: "Bitcoin is a tool for freeing humanity from oligarchs and tyrants, dressed up as a get-rich-quick scheme."

With this perspective in mind, it’s no surprise that Bitcoin has a much higher rate of adoption in countries that have a history of government oppression - Germany, China, Venezuela - and a lower rate of adoption in the U.S. Americans are much more likely to have faith in their U.S. Dollar than a new cryptocurrency.

One story was shared with me anonymously by a Ukranian software engineer - let’s call him Greg. In 2014, what began as a peaceful protest in Ukraine quickly grew into a civil war, riddling the country with violence and unrest. As expected, due to political instability, the local currency was devalued by 70%. Greg lost his job and was looking for a way to escape the rebellion.

“There was nothing left for me there, I was surrounded by death and destruction. I started plotting an escape.”

Airports and roads were guarded by soldiers to prevent people from fleeing - temporary visits to family, however, were permitted by car. It was well known that many of the officials charged with guarding the borders were corrupt and would confiscate money and valuables at checkpoints. And so Greg, having kept most of his savings in USD, decided to trade it all for Bitcoin. He memorized the 12 words from his seed phrase like “his life depended on it” and ran, with nothing but a small backpack on his person, managing to escape with all of his wealth intact.

[For anyone new to Bitcoin, you can access a Bitcoin wallet from anywhere on the internet as long as you know your seed phrase.]

There are countless stories like Greg’s. Tales of people fleeing persecution in Eastern Europe, South America and Africa, using Bitcoin as a means to carry value with them. For many, Bitcoin is what saved their wealth and, by extension, their life.

Skeptics often use the argument that Bitcoin “isn’t backed by anything.” But this is an inherently privileged North American view. Bitcoin is backed by a demand for financial freedom, for an asset outside the control of governments, and one that cannot be confiscated easily.

"""

You wrote "in the Russian controlled portion of the country" and "corrupt Russian guards", while the cited paper does not even contain word "Russia" in it and instead it rightfully mentions a "civil war". And as far as gossips go, when you pass between LNR/DNR controlled territory and Ukrainian controlled one shakedown can easily happen on both sides (and it was especially true in chaotic 2014).

And it looks a bit strange for this "anonymous software engineer" to keep all his savings in USD cache. Usually you get paid via bank transfers and don't bother with retrieving cache from ATMs, so his funds would be automatically accessible on Ukraninan side. And even if he does not trust his domestic banking system (which arguably a good decision), then it's fairly easy to open an account in an EU bank (e.g. in Estonia). Also he would have to find those willing to trade cache USD for Bitcoins in the midst of a developing military conflict (which is in itself a very risky transaction).

Just as a warning to people that might want to try this, a lot of work has gone into monitoring the addresses tied to private keys created from potential words.

For example, if you use a word in the (infamous) rockyou wordlist as your private key & send money to the corresponding public key, it will not be your money for long.

If it were me, I think I'd be sneaking out an SD card in a condom in my prison wallet.

You could also store your private key on an RFID tag implanted under your skin (also MRI safe).

Security through obscurity is best here. Just shift all the digits of your key by some secret (but very simple) algorithm and store in google drive.

WTF, do not do this.

You can use real encryption, like GPG in symmetric mode with a memorized passphrase that gets properly key-stretched. Then store the resulting uniform random-looking blob in image metadata or whatever.

Obscurity is to prevent them from asking you what's in an obviously encrypted file like "bitcoin_wallet.dat.gpg," it's not for actual protection if they do happen to focus on you.

> Then store the resulting uniform random-looking blob in image metadata or whatever.

Steganography is still security through obscurity. I don't see how it's any more secure than storing a manipulated key in plain text, especially if you are competent. If it were me I would just xor my address with a key of the same length (correcthorsebatterystaple-esque) and then xor it back out on the other side.

How would you even know it was a bitcoin wallet address vs. something else?

Or even write a letter to someone, where the second letter of the first word of every paragraph form the wallet address.

>How would you even know it was a bitcoin wallet address vs. something else?

The fact you talk about doing that sort of thing would be a big clue.

The benefit of using proper symmetric encryption (like GPG, or even better, age[0]) is that even if you talk about or even fully explain your process, then it's still secure as long as you don't post your key.

[0] https://age-encryption.org/

If you use "proper symmetric encryption" you have the same problem as before: how to smuggle the key over the border assuming they will search your person and online accounts ...?

Oh sorry, I think I'd lost that bit of context. This scenario of hiding a password during inspection is probably the main place where "security through obscurity" has validity.

A big benefit of encrypting your cryptocurrency private key with a password and then hiding/obscuring that password instead of the raw private key itself is that good encryption will apply key-stretching to the password, making it harder to brute-force. If an attacker finds a random-looking value in your stuff, and believes that the value might be your bitcoin private key XORed by a short string, they it's very cheap for them to check whether each result is a valid bitcoin private key. There might even be structure in the bitcoin private key format that helps gives away the XOR key. But if they know your bitcoin private key (or something else) is encrypted by Age, and they find a random-looking value that might be your password XORed by a short string, then because Age uses scrypt on the password, then it will take longer for them to verify each attempt against the ciphertext.

It's not difficult to memorize one reasonably good passphrase, and there are well-known key-stretching algorithms that are understood to provide however many bits you need of actual security from this passphrase.

> Just shift all the digits of your key by some secret (but very simple) algorithm

You are basically suggesting that people roll their own crypto here. Or pseudo-crypto, or stego, or whatever you want to call it.

Don't tell people to "Just do X" when the ambiguity in the methods that you describe leave >90% odds that the result of their work won't even pass a statistical uniformity test. This leaks the key. Once your adversary realizes that you made some sort of mistake here, they can write software to make their attack orders of magnitude easier than it would otherwise be.

> Once your adversary realizes that you made some sort of mistake here, they can write software to

"Writing software" takes time, and by then all the money in the wallet would be gone

While you're in a gulag?

I don't understand why you're doubling down on this. There's an easy, correct way to do this that doesn't have the same vulnerabilities as the method you're describing. The tools to do this already exist. Don't XOR your fucking key bits into a jpeg... it's more work, and the probability of doing it wrong is super high. You're just asking for trouble here.

> While you're in a gulag?

Well if you are in a gulag, your Bitcoins should be the least of your concerns.

> There's an easy, correct way to do this that doesn't have the same vulnerabilities as the method you're describing

Sorry, but I don't believe you. What is this "easy, correct" way of smuggling your bitcoins over the border that a) won't raise suspicion and get you thrown into a gulag b) doesn't require you to memorize the entire private key?

Do whatever you want, you have to add obscurity layer(s) to the scheme at some point. It doesn't matter if you are using perfect crypto if said crypto draws attention to you at the border.

What are my chances of being caught if I (for example) encode the private key into several emails using a scheme only I know? Zero. I'm not saying this will work at scale for everyone, but it is 100% guaranteed to work for me.

Nobody in this thread is arguing that you shouldn't use obscurity. We're arguing that you shouldn't use obscurity ON THE KEY.

MEMORIZE the key. Obscure the ciphertext.

You cannot hide a key effectively using steganography. It's not strong enough. The probability of intercept is way higher than the probability of successfully brute-forcing the key or the memorized passphrase used to generate the key when using a strong key-stretching algorithm (not chains-of-hashes).

But there's also no reason to hide the key, because key-stretching allows you to memorize a passphrase instead.

> What are my chances of being caught if I (for example) encode the private key into several emails using a scheme only I know? Zero.

A cryptographer would actually work out a number here. It's a small number, but it isn't zero. Given the insane degree of protection that strong cryptography can provide, it's quite possible that that low number is still orders of magnitude higher than it would be if you just memorized the damn passphrase.

> 100% guaranteed to work for me.

That's not how cryptography works. It's provably correct, or it's broken.

Even provably correct cryptography is easily broken with a waterboard (or worse), so again... when dealing with dystopian authoritarian regimes, obscurity (not getting caught) is 10x more important than the cryptography part.

But you can have both! Why are we even arguing about this?

Nothing is preventing you from having both strong cryptography AND obscurity, except for your insistence that hiding the key is a reasonable thing to do. It isn't reasonable. You should never attempt to hide a key using steganography when you can memorize a passphrase instead.

Hiding the key needlessly breaks the "strong cryptography" part. But you don't even need to hide the key. You can still have all the obscurity you want by hiding the ciphertext and memorizing the key.

If you do it this way, you'll still have your obscurity, but you'll also get strong cryptographic guarantees for free.

I think we may be talking about different keys. The key I'm talking about is the bitcoin wallet private key. That needs to be hidden, preferably in encrypted form.

Steganography is for hiding the fact that you're hiding something, it's not for protecting the thing that you're hiding. You still need real cryptography to do that. You can encode a real cryptographic key in a relatively short passphrase that's easy to memorize using key-stretching. You can then use this passphrase to strongly encrypt as much data as you want.

The only thing you should be hiding are the encrypted blocks. If they manage to find these blocks (which they absolutely might! steganography is nowhere near perfect), they should still be encrypted, and they should still look like uniform random noise.

You're not supposed to hide the key!

Sure, I can agree with that. I probably wouldn't choose image-based steganography though because for all I know the country has a great firewall that scrubs all outgoing image metadata

> I don't see how it's any more secure than storing a manipulated key in plain text

You don't see how not storing the key is more secure than storing the key? I'm suggesting you memorize the key, and only store the ciphertext.

> I would just xor my address with a key of the same length (correcthorsebatterystaple-esque) and then xor it back out on the other side

This would fail a statistical uniformity test, and your adversary would be able to figure out that something was hiding there, and might even be able to extract parts of your key. In order to do this safely, you'd need to whiten your "correcthorsebatterystaple-esque" key first.

Or better yet, you shoud not even consider doing this and use a key-stretcher instead. Because there are a thousand other mistakes that you won't even know you're making that are completely avoidable.

> You don't see how not storing the key is more secure than storing the key? I'm suggesting you memorize the key, and only store the ciphertext.

And when the border police see encrypted files and demand the key so they can examine further?

> This would fail a statistical uniformity test, and your adversary would be able to figure out that something was hiding there, and might even be able to extract parts of your key. In order to do this safely, you'd need to whiten your "correcthorsebatterystaple-esque" key first.

I'm telling you, I could invent an obscure security scheme that NSA couldn't crack in a million years because they wouldn't even know where to start. Heck, I could do it with a 1 character password

1. select 1 character password p

2. Take sha256(sha1(md5(p))) 1 million times

3. xor result with bitcoin wallet private key

Bam, easy to remember, impossible to crack (unless you know the secret formula, which you won't)

However, all this is moot if the border police demand a key upon seeing encrypted files. So actually I think the best approach is to hide the (encrypted) private key as innocuous words in emails.

> I'm telling you, I could invent an obscure security scheme that NSA couldn't crack in a million years because they wouldn't even know where to start.

Oh, boy.

First of all, you didn't. You invented a broken scheme, and then when I pointed this out, you invented a new one without stopping to think about why your first scheme was broken, or why you didn't catch your mistake the first time.

> easy to remember, impossible to crack (unless you know the secret formula, which you won't)

That's not at all how this works.

You're assuming that your "secret formula" automatically provides an arbitrary amount of secrecy. It doesn't. Every operation that you choose to apply can provide a certain number of equivalent bits of secrecy (it's fewer bits than you think), or, if chosen poorly, can completely wipe away any secrecy you've built up thus far.

Unless you can provide a proof that your method is sound, it isn't. Based on comments you've made elsewhere, I have next to zero confidence in your ability to build a construct like this correctly, save for sheer dumb luck. All you've done is inform everybody here that you've not a cryptographer.

> However, all this is moot if the border police demand a key upon seeing encrypted files. So actually I think the best approach is to hide the (encrypted) private key as innocuous words in emails.

The whole point of this discussion was to point out that you can hide strongly encrypted ciphertext using weak steganographic techniques so that the police aren't going to see encrypted files, and aren't likely to suspect a hidden message.

The point of using strong cryptography is so that even if they do manage to suspect a hidden message:

1) You're not making their job needlessly easy by also giving them the key by mistakenly thinking that you can hide it effectively. You can't.

2) You can get a strong key out of a passphrase that you can easily memorize, so hiding the key isn't even necessary in the first place.

> And when the border police see encrypted files and demand the key so they can examine further?

They're not going to see encrypted files.

Hide ONLY the ciphertext. Memorize the key.

It's simpler, provides more bits of secrecy, and is easier to validate than some harebrained secret-chained-hash scheme.

> You're assuming that your "secret formula" automatically provides an arbitrary amount of secrecy. It doesn't

I disagree. My assumption is that sha256 digests are uniformly random. Thus, xor-ing a sha256 digest with something of the same length is equivalent to a one time pad, which is uncrackable. And since I'm only crossing the border once, it works perfectly. Now, I only need to hide the ciphertext and protect the input to the sha256 digest, which I do by selecting an algorithm with sufficient entropy that it will never be guessed.

> Unless you can provide a proof that your method is sound, it isn't.

My method is sound because it's a one time pad[0] which is sound.

> It's simpler, provides more bits of secrecy, and is easier to validate than some harebrained secret-chained-hash scheme.

I disagree that it is simpler. I know how to xor two things together. Downloading openssl CLI or kali linux or whatever I need to do it "the right way" would take hours of research to make sure I got it right. I know I can get xor right.

Don't let perfect be the enemy of good. If this is a one time border crossing... why invest countless hours researching the perfect solution when hiding the key in the words of email using something like black magic[1] works just as well, stays just as hidden, and doesn't break if your country decides to implement stenography purging techniques on files (zeroing out padding bits/metadata on common formats used for steganography).

[0] https://en.wikipedia.org/wiki/One-time_pad

[1] https://www.wikihow.com/Play-Black-Magic

Are you aware that the "my homebrew crypto system is functionally equivalent to a one-time pad, and is therefore perfect" argument is so overused by cranks that it's considered a cliche among actual cryptographers?

[1] https://twitter.com/mattblaze/status/580823914340880384

[2] https://www.schneier.com/crypto-gram/archives/1999/0215.html... (#6)

[3] https://freedom-to-tinker.com/2015/03/25/be-wary-of-one-time...

[4] http://maldr0id.blogspot.com/2015/05/crystalline-cipher-and-...

I don't even know how to respond anymore. You must be trolling.

Key-stretching algorithms are better than your chain-of-hashes because each iteration of a key-stretcher is deliberately CPU and memory intensive, whereas hashes are designed to be fast and efficient. So whatever clever scheme you think you've come up with to turn a single letter into an adequate key using secret combinations of chained hashes -- congratulations... you're doing what a key-stretcher does, but badly, because your scheme is much easier to brute-force.

Look, there are a lot of really subtle things that you need to be aware of when designing cryptosystems that even professional cryptographers get wrong sometimes, and exploiting these mistakes in a way that results in a complete break is way easier and more common than most people think. This is why "Don't roll your own crypto" is considered a best practice. Not because it isn't possible to come up with a simpler scheme. But because DIY secrecy is a siren song, and most people who are tempted by it are clever enough to come up with something that looks like it works, but not clever enough to know how to verify it properly.

Your goal shouldn't be simplicity, or trying to map an algorithm to a one-time pad. Your goal should be to use the standard tools in a way that professional cryptographers think is least likely to be subtly broken.

> So whatever clever scheme you think you've come up with to turn a single letter into an adequate key using secret combinations of chained hashes -- congratulations... you're doing what a key-stretcher does, but badly, because your scheme is much easier to brute-force.

Did it get my money across the border without requiring me to get me a master's degree in cyber security? Probably. Will I have to do this smuggling thing a bunch of times? No.

Your attitude is like lambasting someone who writes a quick and dirty python script that gets the job done because it's full of vulnerabilities and wasn't written perfectly in Rust and doesn't scale to 10 million connections. So what.

If I had millions of dollars I was smuggling over the border maybe I'd spend hundreds of hours making sure I got the security perfect using industry standards.

Otherwise, I think just avoiding being the low hanging fruit is "good enough." And yeah, even "crank crypto" is good enough most of the time. You think someone like NSA would spend any significant amount of time/resources trying to crack through imperfect crypto schemes to get at the paltry payouts of individual fortunes?

> requiring me to get me a master's degree in cyber security

No! You should get that degree if you want to design your own scheme like you're trying to do now. If you don't want to bother, then just use the standard algorithms like everybody else!

> Your attitude is like lambasting someone who writes a quick and dirty python script that gets the job done because it's full of vulnerabilities and wasn't written perfectly in Rust and doesn't scale to 10 million connections. So what.

Write all the disposable python you want. "Don't roll your own crypto" only applies to cryptography.

> No! You should get that degree if you want to design your own scheme like you're trying to do now. If you don't want to bother, then just use the standard algorithms like everybody else!

It's not that easy. It's not like there's a universal library that is super easy and safe to use and prevents you from messing up. Crypto algorithms are like Legos or plumbing. All the parts are there, but it's a big scattered mess and it's up to you to glue them together safely, avoid obsolete pieces, etc. And that requires education and experience, many hours of it.

Even in my crank scheme I was doing the same - gluing together different crypto algorithms in a suboptimal way.

That's... Okay, yeah, that's fair. The libraries are pretty awful.

> Steganography is still security through obscurity.

It doesn't have to be. Maybe that's where our misunderstanding is coming from.

The method I'm suggesting is this:

1) Generate a good passphrase and memorize it.

2) Use a strong key-stretching algorithm like pbkdf2 to generate a symmetric encryption key from the passphrase.

3) Use a strong encryption algorithm like aes-256 to encrypt your bitcoin wallet using the key from step 2.

4) Use steganographic techniques to hide the ciphertext from step 3 in an image, email, executable, pdf, etc.

5) Walk across the border carrying the hidden ciphertext on a computer or a disk, and with the passphrase in your brain.

This is not security through obscurity, this is hiding the fact that you're carrying a bitcoin wallet across a border through obscurity.

The actual wallet is still protected using strong cryptography. You'd be perfectly safe publishing the ciphertext from step 3 online, or mailing a copy to the White House, because the protection comes from the computational guarantees provided by strong cryptography, and by your knowledge that nothing derived from key material was ever published or transmitted.

It's safer to rely on strong cryptography as your fallback in case the steganography is discovered than to assume that the NSA can't figure out why you capitalized every third word in your last twenty emails to yourself. If they're going to do that anyway, let them discover your ciphertext, not your key.

> 3) Use a strong encryption algorithm like aes-256 to encrypt your bitcoin wallet using the key from step 2.

bitcoin wallet private key is 256 bits. Why not just sha256 hash a password and xor it with the private key? Seems like a decent one time pad to me and much simpler than your approach.

And before you say how easily sha256 passwords are brute-forced (they aren't if you pick a password longer than, say, 20 characters) the attacker would need to know so many things that it is unreasonable to assume they would even try that. They would need to know a) my bitcoin private key was xored with a OTP b) the OTP was generated using sha256 c) anything else I did

> 4) Use steganographic techniques to hide the ciphertext from step 3 in an image, email, executable, pdf, etc.

If I were the leader of a totalitarian regime, I would almost certainly make my country's great firewall have extensive anti-steganographic measures. Any common file formats used for smuggling information that pass through the great firewall must first have all of its padding bits zeroed before continuing to its destination. If people start abusing metadata, metadata should be zeroed as well.

> 5) Walk across the border carrying the hidden ciphertext on a computer or a disk, and with the passphrase in your brain

Didn't GP say they take everything of value at the border? That would include computers and disks. "You could pass the border occasionally to visit family on the other side, but it was risky to take anything."

BIP39 (https://github.com/bitcoin/bips/blob/master/bip-0039.mediawi...) mnemonics are the industry standard for deriving keys. If you use enough words (the standard will not let you use less than 12), then you are completely fine.

The problem is if you come up with the words yourself, you are most likely to screw up. So people should be aware that they should use a random number generator.

If you wallet is using the BIP39 standard you just memorize the 12-word phrase. The words come from the key, not vice versa.

Also, you can get by with just memorizing one phrase, because unlimited addresses are tied sequentially to a single phrase.

You are wrong, please remove this comment.

Brainwallets, where you choose the phrase that unlocks the wallet, are a bad idea for this reason. Plenty of people have lost a lot of money from trying clever things like using their favorite line from a piece of media.

However, if you have a seed phrase of 12 randomly-chosen words (that were properly randomly chosen by software, not a person), then that's enough to be safe.

Something about this story is fishy. If he could put his money into bitcoin, I'm assuming he needed to digitize his wealth somehow. At that point, why not just do Paypal or ACH?

Paypal is not really in that many countries... And I think ACH is US only?

Also BTC is exchanged to physical cash since the early days. Nowadays BTC ATM count is in the thousands: https://coinatmradar.com/charts/growth/

Yes, ACH is US-only. Other countries have similar systems but they are on-record and the banking system can withhold or deny transfers... or even tax them on behalf of your government.

US or international banking sanctions on the Russian controlled part of Ukraine might make that impossible.

Services such as localbitcoins, where you can buy btc in person are available basically everywhere.

With BTC that is pretty trivial thing to do... I think I saw guides already 8-9 years ago for that. Haven't really thought about it but I think it still works pretty much the same. Google brainwallet.

Trivial for the average technical person like you and me maybe, but not so trivial for the non-technical person who's trying to escape X authoritarian country.

Even for us the risk of messing up and losing all of your wealth makes it quite scary.

Well, if you really need it there are much more incentives to learn it. I wouldn't really be good at explaining it since I don't have much motivation to even learn it myself, because I don't need it.

I don't think the tendency to make mistakes related on the technical skill level, but to a lot of other factors. For example, those who will forget the passphrases are not those for whom it is important, but more for those for who BTC is more like fun side-bet. They have bought some, forgotten about it, and when they’ll actually see the rising price and try to cash out, they have forgot some password or how did they set up the wallet.

be aware most brainwallets are broken for today as most common passwords have been cracked and there is an upper limit (which clamps the maximum bits)

That cannot be real.

He has access to acquire, and move bitcoin, but not access to move it to an exchange, exchange it and deposit it? What?

This sounds like yet another made-up story about a use case for bitcoin that doesn't actually exist. They like making up stories that are yes technically not impossible, but would be the absolute worst way of doing what they want to accomplish.

Someone told me bitcoin enables negative exchange rates, because they happened to get currency fluctuations while the transaction was pending in bitcoin-intermediary exchange medium. No. That's not what happened. You could just have used CurrencyFair and been equally lucky. And end-to-end (back account to bank account) "old banking" likely would have been faster.

Why not throw the password over the fence? Ie. send it to a known drop or person with encryption.

That's also an option.

The thing that I don't understand is this. If Russia really decides to crack down, can't they just block all bitcoin traffic at the ISP level? Then how do you get BTC for your wealth? If you can't push your decentralized transaction, what do you actually have?

> can't they just block all bitcoin traffic at the ISP level?

Are you serious? That block is trivial to avoid. VPN's are used mostly for porn and that kind of things, but with BTC you have clear financial incentive to work around those blocks.

This is actually why they're launching bitcoin network satellites. https://blockstream.com/satellite/

Reply on news.ycombinator.com