ryanatdistrust

7 ms·

1.
by ryanatdistrust 3y ago
Nanoseconds since epoch, which means eventually it does loop around, so at the very least it's not possible to generate a specific wallet by knowing when it was first used.
2.
by ryanatdistrust 3y ago
That is correct, time is the only entropy for the command, and the function they use to generate random numbers is also flawed in that it can only produce 2^32 possible outputs.
3.
by ryanatdistrust 3y ago
As discussed elsethread, it used the lower bits of the time value, so while there is is a fraction of the 2^32 space due to precision loss in the OS time calculations, it is not as simple as "between when this software was released and
4.
by ryanatdistrust 3y ago
2^32 is still incredibly small for crypto and is inexcusable.
5.
by ryanatdistrust 3y ago
As long as people can write code, bugs will exist.
6.
by ryanatdistrust 3y ago
My numbers are very rough estimates and not good enough to do work on. More accurate information may be made public later.
7.
by ryanatdistrust 3y ago
I was not involved in that specific aspect, so I can't provide accurate information. We may release more information later in the future.
8.
by ryanatdistrust 3y ago
It looks neat, I'll pass this along to the team and take a deeper look at it later.
9.
by ryanatdistrust 3y ago
That is correct, you still have 2^32 permutations of possible values.
10.
by ryanatdistrust 3y ago
We used the broken algorithm from `bx` in a custom Rust program to brute force this.
11.
by ryanatdistrust 3y ago
we had so much fun trying to figure out the icon!
12.
by ryanatdistrust 3y ago
It actually uses the most precise 32 bits of the date, so it's any, like, nanosecond between 0 and some other small amount of seconds. You can't brute force a wallet by knowing approximately when it was made, but you can brute
13.
by ryanatdistrust 3y ago
The difference between 32 bits and 64 bits is the amount of people on Earth compared to (EDIT) the amount of grains of sand on Earth. 32 bits is nothing when it comes to entropy, and it can take a security researcher (like us) only $100 t
14.
by ryanatdistrust 3y ago
To verify, this is something anyone can attack, as was proven by our brute force lookup service: https://lookup.milksad.info .