MIME-Version: 1.0
References: <68330522-7e7c-c3b4-99a9-1c68ddb56f23@gmail.com>
	<f2d73a92-e1c5-9072-e255-fa012a9f9d1b@satoshilabs.com>
	<db184306-7ec0-322e-5637-7889b51f50bf@gmail.com>
	<CAH+Axy6dKDOkE6cQYZUusTUxxOSwWchOWxYh6ZkhnOgXuELaYg@mail.gmail.com>
	<743fb106-977e-1f34-47af-9fb3b8621e72@gmail.com>
	<CAH+Axy7v=26P8=CJPUqymKOcromGz+zYZ2cb2KaASgXNPpE2tQ@mail.gmail.com>
	<c91cd61b-3ec5-6c7a-c7e3-7ceb48539625@gmail.com>
	<CALPhJawf98+uqZXQRGH3Tjo1CnZJfE+CMw9J2ZqiHHmwDSdugQ@mail.gmail.com>
In-Reply-To: <CALPhJawf98+uqZXQRGH3Tjo1CnZJfE+CMw9J2ZqiHHmwDSdugQ@mail.gmail.com>
From: James MacWhyte <macwhyte@gmail.com>
Date: Wed, 2 Jan 2019 18:06:08 +0000
Message-ID: <CAH+Axy72BTi8+yiUnbrr_Fd8XDf0g6eygOT-6OHRZ8En7W3qbA@mail.gmail.com>
To: thealanevans@gmail.com, 
	Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: multipart/alternative; boundary="000000000000aecebe057e7d812e"
Subject: Re: [bitcoin-dev] BIP39 seeds
Precedence: list

--000000000000aecebe057e7d812e
Content-Type: text/plain; charset="UTF-8"

On Wed, Jan 2, 2019 at 3:40 AM Alan Evans via bitcoin-dev <
bitcoin-dev@lists.linuxfoundation.org> wrote:

>
> I think any method that doesn't use real entropy, but some fake source of
> randomness, such as a book is asking to be hacked and so is not a
> reasonable idea.
>
> If an algorithm for book text to BIP39 sentence ever became well used,
> common books will be systematically searched for accounts. People will also
> choose their favourite passages, so I would expect to see collisions.
>
>
I tend to have this conversation a lot ;) I'm not sure what Aymeric has in
mind, but my suggestions are for use by the small few who properly
understand how these things work. I am not suggesting blockchain.info
require every user to choose a book passage to use as their backup phrase!

There are so many small things that could be done to make a text input
unique. Choose the X number of words from the start of the Nth sentence.
Replace all punctuation with exclamation points. Combine two sentences from
different pages. It would be nigh impossible to brute force any of these,
and would require hints/instructions from the owner to recover.

But I admit if this is not intended for standardization, discussing it on
this mailing list is probably unwarranted.

--000000000000aecebe057e7d812e
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_quote"><div dir=3D"ltr">On Wed, Jan 2,=
 2019 at 3:40 AM Alan Evans via bitcoin-dev &lt;<a href=3D"mailto:bitcoin-d=
ev@lists.linuxfoundation.org">bitcoin-dev@lists.linuxfoundation.org</a>&gt;=
 wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px =
0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir=
=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div><br></div><div>I think any =
method that doesn&#39;t use real entropy, but some fake source of randomnes=
s, such as a book is asking to be hacked and so is not a reasonable idea.</=
div><div><br></div><div>If an algorithm for book text to BIP39 sentence=C2=
=A0ever became well used, common books will be systematically searched for =
accounts. People will also choose their favourite passages, so I would expe=
ct to see collisions.</div><div><br></div></div></div></div></blockquote><d=
iv><br></div><div>I tend to have this conversation a lot ;) I&#39;m not sur=
e what Aymeric has in mind, but my suggestions are for use by the small few=
 who properly understand how these things work. I am not suggesting <a href=
=3D"http://blockchain.info">blockchain.info</a> require every user to choos=
e a book passage to use as their backup phrase!</div><div><br></div><div>Th=
ere are so many small things that could be done to make a text input unique=
. Choose the X number of words from the start of the Nth sentence. Replace =
all punctuation with exclamation points. Combine two sentences from differe=
nt pages. It would be nigh impossible to brute force any of these, and woul=
d require hints/instructions from the owner to recover.</div><div><br></div=
><div>But I admit if this is not intended for standardization, discussing i=
t on this mailing list is probably unwarranted.</div></div></div>

--000000000000aecebe057e7d812e--