Hacker News Reader

Comment by slavik81 | Hacker News Reader

> the hack happened because of a weak passphrase [...] Levy [expected] his private key would still be needed to access the wallet. But the wallet generation tool Levy used, developed by ethereum creator Vitalik Buterin, had a critical flaw in that others could access the wallet just with the passphrase.

Neither gpg nor ssh keys work that way. Why would Vitalik design the etherium wallet key like that? The passphrase is the last line of defense against people who have managed to access to your system, it's not the first and only defense against remote attackers.

View on HN

> Why would Vitalik design the etherium wallet key like that?

Because he may be very clever at having come up with this whole ethereum system, but that doesn't mean he's wise and experienced. It's a rookie mistake, made by a rookie. It happens. He seems the type to learn from it at least.

No, the tool works like a brainwallet. The seed phrase determines the ethereum public and private keys. That way there is nothing else to save, no file backup is necessary. Knowledge of the seed phrase is sufficient. That's a feature, not a bug.

It is not like gpg where the private key is independent, stored on disk and encrypted by the passphrase.

The user messed up in that he didn't understand that he needed to use a strong passphrase or it was possible for anyone in the world to guess it.

>No, the tool works like a brainwallet.

Are you saying that is a good thing? It's well known that brainwallet is a footgun.

https://en.bitcoin.it/wiki/Brainwallet

>An early old-style brainwallet was created by by memorization of a passphrase and converting it a private key with a hashing or key derivation algorithm (example: SHA256). That private key is then used to compute a Bitcoin address. This method was found to be very insecure and should not be used. Humans are not a good source of entropy.

Any tool that allows that mistake to be made is badly broken.

Because he is not all that bright. Eth is a shit show of scammers and used for little else

Are you sure you understand what happened?

A master password system is common. For example, choose a weak password for 1Password.app and someone can see all of your passwords.

Reply on news.ycombinator.com