0

If someone stole recovery seed (24 words) but you would protect it with additional passphrase, is it likely they could brute force your passphrase?

  • How many guesses can there be made per second?
  • Could hacker with the most computer power hackers use brute force passphrase?
  • How strong should passphrase be to protect against it?
  • What if recovery seed would get posted on bit-coin forum and people would try to brute force it, would they be able to do it?
  • 1
    Please do not vandalise your posts. Once you have submitted a post, you have licensed the content to the Information Security community at large (under the CC-by-SA license). If you would like to disassociate this post from your account, see What is the proper route for a disassociation request? – Mithrandir Nov 15 '17 at 10:55
1

it likely they could brute force your passphrase

Depends on the passphrase. "Monkey" would be nano seconds. WelcomeToBoomTown would be significantly longer. BoomTownis100%redonculous would be computationally infeasible to brute force.

How many guesses can there be made per second

  • Online attack scneario: 1,000 / second.
  • Offline (fast) : 100,000,000,000 / second
  • Massive cracking array: 100,000,000,000,000 / second.

Could hacker with the most computer power hackers use brute forc [sic] passphrase

Again, depends on the passphrase. If the passphrase was a GUID, the earth would have long been engulfed by our red giant sun, and the universe reached maximum entropy before you'd get through it with modern day computing power.

If the passphrase was on a common password list, seconds.

How strong should passphrase be to protect against it?

At least 17 characters long.

What if recovery seed would get posted on bitcoin forum and people would try to brute force it, would they be able to do it?

See all answers above.

Also, play with the password haystacks.

  • Password haystacks is one of the worst things to refer people to IMO, as it assumes a true "each character has nothing to do with the other characters" brute force method, when in fact the attacker will be running dictionary and word-combination attacks, and the results given are therefore pretty much lies. – Ben Nov 2 '17 at 17:21
  • Unless the GUID is type 4, it might not actually be too difficult to brute force a GUID password. – Lie Ryan Nov 3 '17 at 3:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.