How Jason Bourne Stores His Bitcoin

http://maxtaco.github.io/bitcoin/2014/01/16/how-jason-bourne-stores-his-bitcoin/

by sillysaurus2 • 13 years ago

107 49 13 years ago

maxtaco.github.io

ing33k• 13 years ago

victim of homokov's cookie attack.

Zr40• 13 years ago

The cookie attack is an attack against browsers, not against sites. The effect is that the server refuses your request.

meowface• 13 years ago

Sounds to me like it'd be better to encourage people to pick longer passphrases (8 - 10 words instead of 4), in addition to using scrypt.

vbuterin3• 13 years ago

All you really need is to always prepend your username to your password. If people all did that, then 99.9%+ of these brainwallet thefts would already not have happened. Slow KDFs are just icing on the cake.

panic• 13 years ago

You could also train yourself (using e.g. http://en.wikipedia.org/wiki/Mnemonic_major_system) to memorize a completely random private key.

fsiefken• 13 years ago

What if you suffer from memoryloss? Forgetfullness, traumatic experiences, dementia, headtrauma?

vinceguidry• 13 years ago

Also you need to change passwords every so often, you're inviting disaster of the "holy holy holy fucking shit" variety if you start doing this and change every six months.

matdes• 13 years ago

https://xkcd.com/538/

oleganza3• 13 years ago

Except you can lock your bitcoins in 5-of-9 multisignature transaction among 9 of your friends in San Francisco, London, Paris and Moscow with an agreement to not sign the transaction unless you are safe and can talk directly to them.

reinhardt• 13 years ago

Because obviously everyone considering bitcoins has a dozen cryptogeek friends spread out in half a dozen countries.

kaoD2• 13 years ago

Too bad the Bitcoin protocol is hard-wired to accept at most m-of-3 transactions. More than 3 signatures is considered non-standard and rejected by peers/miners.

qbrass2• 13 years ago

Those 9 friends are most likely other bitcoin filled pinatas. So the expense of tracking them down will lead to more paydays.

Crito• 13 years ago

I feel like Jason Bourne stores it in a sub-dermal implant.

aspensmonster2• 13 years ago

In his head, of course.

lowglow• 13 years ago

You're talking about Johnny Mnemonic. :P

alan_cx• 13 years ago

Hip.

Just sayin.

DrStalker• 13 years ago

I read the book. The first two thirds is all about him trying to withdraw money from a bank using 80s technology and processes; really painful to read and nothing that would come close to working today.

AlexanderDhoore• 13 years ago

I'm creating the JSON Bourne Shell btw. Totally got dibs on that name!

ye• 13 years ago

The private key storage part is bad. What if you have a house fire and your laptop and all your clues burn?

Just save your private key into something like KeePass with a long ass password and a couple of million of hashing rounds. Email the KeePass database to yourself, your family, put it on your server, all your computers, your cell phone, etc.

altrego99• 13 years ago

Why can't I just store it in a password protected 7Zip file. What will happen?

maxtaco4• 13 years ago

You still need to remember a good password, but now you have to worry about keeping track of the file. If you lose either, you lose your coin. Plus 7Zip uses a PBKDF2-like key stretcher, but you're probably better off with scrypt, and you're certainly better off with a composition of PBKDF2 and scrypt.

lhgaghl2• 13 years ago

Am I missing something, or is it easier to just come up with a password that's not in a wordlist/rainbowtable than to trust (audit) this 13K lines of code HTML file?

Also, I find this laughable:

Leave little cryptic notes around your house and office to remind you of what your passphrase is in case you ever forget.

maxtaco4• 13 years ago

It's likely the password you come up with will be better than the the unbroken 10 BTC WarpWallet challenge, so you have that assurance. Also, we implemented the protocol twice, using two different software stacks, and checked we came up with the same answer. You can probably convince yourself that WarpWallet works as advertised with about 10 lines of Python. We did something like that when building it.

Because we encourage running this thing on an airgapped machine, you mainly need to convince yourself that we're generating keys as advertised (and not from a small known pool). The airgap would prevent this page from sending data back to a server, even if there was logic to do so (which there isn't).

lhgaghl2• 13 years ago

You can probably convince yourself that WarpWallet works as advertised with about 10 lines of Python.

If only life were that simple.

jcalvinowens• 13 years ago

Warpwallet in C:

https://github.com/jcalvinowens/miscellaneous/tree/master/fu...

skorgu• 13 years ago

Copy the HTML to your AGM using a USB-stick.

Good enough for the Iranians, good enough for you.

maxtaco4• 13 years ago

Seriously, the centrifuges connected to your 2008-era Lenovo netbook might be totally rooted after this transfer.

lukev2• 13 years ago

I like the idea of bitcoin, but way too many people (like this article) are just being stupid about it. It's baffling and depressing. Your retirement, really?

At worst bitcoin is a speculative balloon. At best it is a novel, useful way to conduct online transactions. In no conceivable future is it a good place for a long-term investment of the majority of your assets!

maxtaco4• 13 years ago

Sorry, that was a little joke. I don't think anyone should hold more than a small portion of their total assets in cryptocurrencies.

ericb• 13 years ago

Interesting that we are now to the point where that wasn't obviously a joke.

patrickaljord2• 13 years ago

Really? You took that obvious joke seriously?

lukev2• 13 years ago

Head over to /r/bitcoin sometime... Full of people figuring out how to buy bitcoins with a credit card, etc. Something about it drives people crazy.

vbuterin3• 13 years ago

If you are under 25 and so easily have enough time to start from scratch if you lost all your money, Bitcoin is perfectly fine for the majority of your assets. If you're 50, then you should think of Bitcoin as a startup investment, as a small purchase so you have enough on hand to use for what you want, or as financial collapse insurance - all of which might only require a few percent of your money. It's all about context.

counterbalance• 13 years ago

Honestly, it's about time you guys talking your book start disclosing your total Bitcoin position. Some of the top voices have 100,000+ BTC to their name: cough evoorhees trace mayer. Dunno about vbuterin, but this is just something to think about.

I know bitcoin is a major innovation, but having a bunch of them is an insanely powerful motivator and it becomes virtually impossible not to mix fact with fiction when your entire net worth is riding on it.

fharper1961• 13 years ago

What is the recovery procedure if you lose access to the AGM?

If I've understood correctly it is just to reinstall WarpWallet on another machine using the same passphrase.

But what if we also can no longer access WarpWallet? What then?

Gnewt• 13 years ago

Luckily, WarpWallet's algorithm is public and therefore can be reimplemented even in the case of their disappearance.

pippy• 13 years ago

Sometimes simple is good. Why not print off a few QR codes, and hide them around your house?

How Jason Bourne Stores His Bitcoin

Related Stories