Bitcoin Brainwallet
forbes.com
forbes.com
It's really easy to keep your keys secure and off disk and still be able to use great entropy - they're called smart cards.
The point is that one could store in his brain all the information needed to pay and receive any amount of money, without needing any extra storage device.
Because this money is Bitcoins, and because they are not stored anywhere, it technically means that all your money, all your wealth, resides in your brain - hence the title "Brainwallet".
This is a fascinating thought experiment, but not an assessment of the most secure way to store money.
Better use this only for the equivalent of todays's purse with as much cash as you feel you need for the next few days.
See also http://news.ycombinator.com/item?id=2551397 for how to mitigate such risks.
Also note that most people following similarly given instructions would actually construct a pass phrase in the form of "subject adverb verb predicate" or "subject verb adjective predicate" or a few other constructions, dramatically reducing the implied entropy of the phrase.
In crypto (especially when there's money involved) it's typical to imagine attackers with lead pipes and your knees in the mix; it's nice to imagine you could 'crack' and give up your stash, except it's not really your stash, it's just a little stash.
There are a bunch of other security factors at work here, though. Consider that you need to have a computer you KNOW does not have a keylogger on it, for instance.
The loss vectors for Bitcoin historically have been
a) Client bugs b) System password attacks c) 'errors' or theft by plausibly denying operators
These actually can all be mitigated, but not well with current systems. The master generator password is a good addition to the toolkit, but it's not going to be sufficient. So, let's not forget that cool crypto is as strong as its weakest link.
I've been considering how you'd safely allow frequent $1mm+ transactions with Bitcoins recently, and my list involves an unplugged from the net computer, a faraday cage and a professional auditor from one of the big four.
In fact, this is such a patently obvious insight that someone else must have thought of it already.
I'm not sure if they're legal in the US.
No they don't! Probability does not work that way!
If you want to brute force your way through, sure, there's no difference in the example sentences given. Brute force is a totally ridiculous proposition given the length of the secret involved [2], though, so you're banking on people preserving language structure to aid in memorization to constrict your search space. Otherwise you're basically screwed (not that you aren't basically screwed anyway if the sentence is really not derived from literature and 10 words long).
[1] For more, this is what you're looking for: http://cm.bell-labs.com/cm/ms/what/shannonday/shannon1948.pd...
People commonly think they are being random when they modify their passwords, but in point of fact, they are doing the same thing as everyone else. You cannot ever trust yourself to be random; the only things you can trust to be random come out of random number generators.
That is why I say probability does not work that way. In order for a modification to make a password or phrase meaningfully secure, it must come from a genuinely random source with a large number of live outcome possibilities. Mutating a phrase in a clever, original way that everyone else uses is pointless. It does not make the passphrase "very hard to predict". It makes it "slightly less hard to predict than it was, which was not very hard in the first place."
Fundamentally, "probability does not work that way" in the sense that just because the outcome looks random and the process feels random, that doesn't mean it is.
For single-word passwords it can be approximated this way. However, for anything longer, especially a natural language sentence, misspellings makes a big difference.
The OED documents 171,146 words in active use. Assume that every word has at least two simple mispellings. Suddenly your dictionary becomes 513,438 words big. This is a linear expansion, but it's in the exponent since you're taking permutations. That's a big deal. Some mispellings may be much more common than others, so you can bias your dataset accordingly, but it's still a huge expansion.
> You cannot ever trust yourself to be random; the only things you can trust to be random come out of random number generators.
This is true, but neither really here nor there. The entropy of the passphrase is already so great, and then is expanded exponentially with the addition of misspellings and substitutions, even if the distribution of those is biased.
The question to ask is, how big a difference? Put another way, how many bits of entropy do your misspellings generate?
In your above example, where each word has 2 common misspellings, each misspelling gets you ~1.5 bits of entropy. For comparison, adding another randomly selected OED word gets you just over 17 bits of entropy. If we're talking about making meaningfully stronger passwords, making a grammatically correct phrase and then adding misspellings (what the article calls "seemingly random modifications") is a less effective strategy than simply using a series of actually-random words from the OED.
It's better to add entropy 17 bits at a time (whole words) than trying to add entropy piecemeal, 2 bits here and 3 bits there (misspellings, punctuation).