Aaaaand once again my brain expanded a little because I listened to you. Thank you for remaining a class act in a sector that seems to grow more phonies everyday.
Thank you! I've been trying to understand how a passphrase added extra security as many videos alluded to it being wallet centric. Understanding that is used in the generation of the private key now has the pieces falling into place.
🇨🇱 I understand that the security level, or entropy, is mainly given by the exponent, or hash lenght. So half of a phrase lenght is a bit less secure, but not half as secure ⁉️🤔
Thank you for this. Question: if you are forced to open your ledger live, won't an attacker be able to see all your regular account's transactions and won't they display the movement of the bulk of your funds somewhere else (in this case, the passphrase account)?
Would you consider using the same passphrase to create various seeds in different wallets a good practice? How about using your full name as passphrase. This is just a substitute for the amnomic word and makes your seeds a bit different from all others generated right ?
Thank you Andreas, what if you have your 24 seed and added the passphrase but may have mistyped on the small trezor. I wrote down my passphrase and it is not working. So sad about this. Because I believe in the tech and have somehow messed up. From what I have gathered from this video if I have some of the words in my passphrase is there a tech (what is it called) to maybe run different combos of a space or a letter that was mistyped? I can see the funds but can not access them by typing in the passphrase or trying to send or receive using the passphrase. Thank you inadvanced.
i can see the coins on the trezor bitcoin scanner using the receive adress but cant see on my trezor, im supposed to have a standard wallet but a different one shows up...
Does the past phrase only protect if they physically have the wallet? Or if somebody does find my seed phrase do they still have to decrypt the passphrase in order to access my bitcoin on the Blockchain??? I've watched 1 million videos and I haven't been able to figure that out I think that's what you were saying here but I'm still not 100% sure
Hi Everyone and as mentioned by Andreas, NEVER EVER Publish your seed and passphrase online. When you generate your seed, you should also do it, offline and do not share this seed with anyone. It should only be shared with people you trust (i.e.: the people you intend to pass on your Crypto, such as your next of Kin, etc) and it should be done with caution and indirectly (i.e.: using security strategies to gain the information when you have gone in the after-world).
Can you tell me lets say I keep my 24 word key secure and add a word for my passphrase. How secure would that second wallet be? Assuming they don't assume a 25th passphase and they dont have the 24 word seed?
So does this mean that using the 12 word seed with the trezor model-t is significantly less secure than a Trezor one with a 24-word seed? The model-t only allows for generating a 12 word seed (via GUI) so it would seem trezor’s new product is bad purchase unless you have an existing 24-word seed you can input? If I have a ledger nano s should I just generate the seed on there and then input that into the trezor model-t or is that not advisable Incase ledger has an unknown vulnerability which would essentially make it like putting all your eggs in one basket?
A 12-word recovery seed contains 128 bits of entropy, which is more than sufficient for security of your private keys. For comparison, Bitcoin utilizes 256-bit private keys, but the security of the elliptic curve is around half of the used bits, so 128 bits for the secp256k1 curve used. The TREZOR One uses a long, 24-word recovery seed to increase the strength of obfuscation by mixing up the order during recovery, giving you 24! (6.4 × 10 ²³) possible orderings for each seed. The Model T no longer needs a long recovery seed, as all sensitive operations, including the restoration of your recovery seed into the Model T, are done via the device touchscreen. Therefore, the Model T only needs to generate 12 words.
@@carpettunnel8837 Way less secure, yes. But still relatively secure against many levels of attack. This is where Andreas is wrong. He assumes all attackers are highly sophisticated attackers with resources. He fails to consider that most thieves would have NO idea what to do with a seed, much less half of one. If John Q Burglar finds half a seed...you think he even would understand wtf 10^35 even is, much less being able to crack it? But he could very easily import a FULL seed into any easily downloaded app. (If he even knew this much. But in time, most people will know what a seed is and what it looks like....similar to how most people know what a credit card looks like.) But I am with Andreas in one respect. Do NOT store in the cloud. Do not, do not, do not. Do not store digitally. Do not, do not, do NOT!
It is less safe versus 24 of course but for now it's still safe enough. That may change in a few years so definitely just stick to 24 from the beginning.
I appreciate your efforts! 🙏 I wanted to ask something unrelated: 🤔 I only have these words 🤔. (behave today finger ski upon boy assault summer exhaust beauty stereo over). What is this? 🤔
What would be considered a very strong complex passphrase? Is it a string of characters x-digits long, or does it also have to be like a "sentence" with several "words"?
But half a seed representing 128 bits is still more than enough, isn't it? You just said, seeds are 12 to 24 words. So half of a 24 word should still be plenty secure? It's curious because at Honeybadger 2018 the Trezor dev said the same thing so you are probably correct. But why?
Are all of the combinations of the first 12 words of a 24 word seed, valid 12 word seeds? If not then it might be easier to brute force because it would eliminate some of the possible combinations.
Andreas, the standard is a piece of art in cryptography, unfortunately it includes some unfortunate wording... Today 90% of software wallets don't support the BIP39 passphrase, when developers read "optional" BIP39 passphrase, they think it is optional to implement into their software. Please, please pretty please, remove the word "optional" in the definition, just write "you can use empty string if you want" and that should be enough to prevent them skipping this very important feature, most fail to understand the value of it.
My question would be if BIP39 is a standard isn't it subjected to the standardized attack vector. So a hacker only needs to break BIP39 and has the ablity to attack all wallets in existance.
"Only" in this case means computing 10^37 unique combinations of BIP 39 phrases and that's if you're only using 12 words. That would take approx 1 trillion years with $1 billion worth of computing equipment using today's benchmarks.
11:55 Andreas' rules are as below, which I'm sticking with🙂: book: not written from this mnemonic list (seed phrase): not from this movie: not from this. phrase: no search engines: not from this spaces: no words: 6-8 English Although I might be wrong that I'm using a passphrase which is a mnemonic that helps me remember some tough abbreviations. E.g. Trying to learn/remember the abbreviation DNA: DeoxyriboNucleicAcid (but something with 6-8 words).
I use Ledger and there is an option for passphrase, you can put any letter up to 100 characters including special letters. Also you can set up the secondary PIN which is connected with passphrase. That means you don need to enter passphrase every time you want to get access - you just need to enter the secondary PIN.
Assuming your 24 word seed is very secure, is it ok to use simple (weak) phase phrases as a savings/filing system? Making your hardware wallet have different “savings accounts” separated by phase phrases? For example: 24words+ “House” 24words + “car” 24words +”kids”
11:55 Andreas' rules are as below, which I'm sticking with🙂: book: not written from this mnemonic list (seed phrase): not from this movie: not from this. phrase: no search engines: not from this spaces: no words: 6-8 English Although I might be wrong that I'm using a passphrase which is a mnemonic that helps me remember some tough abbreviations. E.g. Trying to learn/remember the abbreviation DNA: DeoxyriboNucleicAcid (but something with 6-8 words).
@@Tom-bn5zd As long as your seed words are secure (hidden, locked away and never entered into a potentially compromised computer), then I'd say yes, although it's a trade-off. It is less secure than not storing it in Last Pass but you're probably less likely to lose it, especially if you also have it written down in a secure location as a backup. If anything happened to you also make sure your loved ones know exactly what to do.
Hi Andreas! Can you please cover the current bug report: bitcoincore.org/en/2018/09/20/notice/ Its hard to understand what this actually means today. Does this bug mean that today some malicious miner that didn't update can print new bitcoin? secondly, If someone does create additional bitcoin than is suppose to be made... is there a way to tell that its in the system?
Because of Bitcoin 4 years ago I created Time Priced Art & in Description I have a Counter. Counter Keeps track of money Times the Minutes = $1 per Minute . Painting Price go's Up $1 Per Minute Forever. Sold all my Crypto .
Hi Andreas, would it be safe to mix 6 random words (that you have memorized) into your 24 seed words, and then make it public (so you will never lose it)?
oh, that is still quite risky. The chances of your mind altering a small detail over time and then memorizing the mistake is definitely very plausible. Sure, sounds strange right now, but happens a million times. You do not have to memorize your seed in order for it to never have been online, just saying. there are way easier, more comfortable and more secure ways. obviously, a hardware wallet is always a great idea.
The mnemonic phrase that I learned is from a hardware wallet 😉 I also have them written somewhere. but In case of a fire or something, I still have a backup 😉
@@krishnayogi can you give me tips on where to save the passphrase? Is in lastpass enough? And are 6 words passphrase the sweet spot for most people? Thanks in advance.
It's ok, Andreas, I devised my own infallible scheme! I'll post my passphrase, _and_ my mnemonic seed online, but I'll post each one with different account. The seed with jondoe07, and the passphrase with jondoe08. Then no one will be the wiser! 👌 👌 👌
We need clones of Andreas to replace a lot of the other so called crypto "experts" You are a much needed voice in this space, Thank you Andreas.
why not just 'donate to them' :-) www.patreon.com/aantonop
We must make it EASIER for common folks to understand and use
Aaaaand once again my brain expanded a little because I listened to you. Thank you for remaining a class act in a sector that seems to grow more phonies everyday.
I completely agree with you. Cheers from EU ☺️
Thank you! I've been trying to understand how a passphrase added extra security as many videos alluded to it being wallet centric. Understanding that is used in the generation of the private key now has the pieces falling into place.
Andreas, I like the laid back camera angle. Nice
Thank you Andreas for these amazing explanations.
If splitting 24 seed words in two is not secure, does this mean a wallet with only 12 seed word is not secure?
Yeah, seems illogical. No one can answer?
It's my understanding that 12 words is 128 bit entropy but I'm not an expert. 🤷🏻♂️
🇨🇱 I understand that the security level, or entropy, is mainly given by the exponent, or hash lenght.
So half of a phrase lenght is a bit less secure, but not half as secure ⁉️🤔
Thank you for this.
Question: if you are forced to open your ledger live, won't an attacker be able to see all your regular account's transactions and won't they display the movement of the bulk of your funds somewhere else (in this case, the passphrase account)?
Love the foreground and background. Much nicer to watch.
Would you consider using the same passphrase to create various seeds in different wallets a good practice?
How about using your full name as passphrase. This is just a substitute for the amnomic word and makes your seeds a bit different from all others generated right ?
Thank you Andreas, what if you have your 24 seed and added the passphrase but may have mistyped on the small trezor. I wrote down my passphrase and it is not working. So sad about this. Because I believe in the tech and have somehow messed up. From what I have gathered from this video if I have some of the words in my passphrase is there a tech (what is it called) to maybe run different combos of a space or a letter that was mistyped? I can see the funds but can not access them by typing in the passphrase or trying to send or receive using the passphrase.
Thank you inadvanced.
i can see the coins on the trezor bitcoin scanner using the receive adress but cant see on my trezor, im supposed to have a standard wallet but a different one shows up...
Does the past phrase only protect if they physically have the wallet? Or if somebody does find my seed phrase do they still have to decrypt the passphrase in order to access my bitcoin on the Blockchain??? I've watched 1 million videos and I haven't been able to figure that out I think that's what you were saying here but I'm still not 100% sure
Hi, does the generators of seed phrases know of the existing seed phrases already created? so as not to generate the same one?
It doesn’t know but the combination of words is so large it’s almost impossible
Hi Everyone and as mentioned by Andreas, NEVER EVER Publish your seed and passphrase online. When you generate your seed, you should also do it, offline and do not share this seed with anyone. It should only be shared with people you trust (i.e.: the people you intend to pass on your Crypto, such as your next of Kin, etc) and it should be done with caution and indirectly (i.e.: using security strategies to gain the information when you have gone in the after-world).
Can you tell me lets say I keep my 24 word key secure and add a word for my passphrase. How secure would that second wallet be? Assuming they don't assume a 25th passphase and they dont have the 24 word seed?
Basically it's secure enough for you to never need to worry about anything.
Trezor safe 3 only allows 12 words seed phrase, ist it not good enough?😢
So does this mean that using the 12 word seed with the trezor model-t is significantly less secure than a Trezor one with a 24-word seed? The model-t only allows for generating a 12 word seed (via GUI) so it would seem trezor’s new product is bad purchase unless you have an existing 24-word seed you can input? If I have a ledger nano s should I just generate the seed on there and then input that into the trezor model-t or is that not advisable Incase ledger has an unknown vulnerability which would essentially make it like putting all your eggs in one basket?
A 12-word recovery seed contains 128 bits of entropy, which is more than sufficient for security of your private keys. For comparison, Bitcoin utilizes 256-bit private keys, but the security of the elliptic curve is around half of the used bits, so 128 bits for the secp256k1 curve used.
The TREZOR One uses a long, 24-word recovery seed to increase the strength of obfuscation by mixing up the order during recovery, giving you 24! (6.4 × 10 ²³) possible orderings for each seed. The Model T no longer needs a long recovery seed, as all sensitive operations, including the restoration of your recovery seed into the Model T, are done via the device touchscreen.
Therefore, the Model T only needs to generate 12 words.
Không Tên So then if someone gets ½ of your 24 word seed does it become any less secure than a 12 word seed?
@@carpettunnel8837 Way less secure, yes. But still relatively secure against many levels of attack.
This is where Andreas is wrong. He assumes all attackers are highly sophisticated attackers with resources. He fails to consider that most thieves would have NO idea what to do with a seed, much less half of one. If John Q Burglar finds half a seed...you think he even would understand wtf 10^35 even is, much less being able to crack it?
But he could very easily import a FULL seed into any easily downloaded app. (If he even knew this much. But in time, most people will know what a seed is and what it looks like....similar to how most people know what a credit card looks like.)
But I am with Andreas in one respect.
Do NOT store in the cloud. Do not, do not, do not. Do not store digitally. Do not, do not, do NOT!
TIL! thank you very much :)
Andreas, at 12:00 you suggest “us a 6-8 word passphrase “, apologies for being confused, passphrase for what? I thought it’s a 24 word passphrase...
I'm referring to an additional passphrase to secure the 24 words.
Is there a tool (I can use it offline) that allow me to convert a mnemonic phrase to a mnemonic phrase plus passphrase?
Is the 12 word seed on Trezor T less secure than the 24 word seed on Ledger Nano S? If so, is it safe enough?
It is less safe versus 24 of course but for now it's still safe enough. That may change in a few years so definitely just stick to 24 from the beginning.
@@ananamusly what's the sweet spot for passphrase? 6 words?
I appreciate your efforts! 🙏 I wanted to ask something unrelated: 🤔 I only have these words 🤔. (behave today finger ski upon boy assault summer exhaust beauty stereo over). What is this? 🤔
Should you use space between the words or put something in between?
Dont believe u do, its one long password made from different words a passphrase because longer phrases are more secure then short weird ones.
So far no trolling the new set up. 👏🏼
What would be considered a very strong complex passphrase? Is it a string of characters x-digits long, or does it also have to be like a "sentence" with several "words"?
The longer the better, just like any password...
But half a seed representing 128 bits is still more than enough, isn't it?
You just said, seeds are 12 to 24 words. So half of a 24 word should still be plenty secure?
It's curious because at Honeybadger 2018 the Trezor dev said the same thing so you are probably correct. But why?
Are all of the combinations of the first 12 words of a 24 word seed, valid 12 word seeds? If not then it might be easier to brute force because it would eliminate some of the possible combinations.
Andreas, the standard is a piece of art in cryptography, unfortunately it includes some unfortunate wording... Today 90% of software wallets don't support the BIP39 passphrase, when developers read "optional" BIP39 passphrase, they think it is optional to implement into their software. Please, please pretty please, remove the word "optional" in the definition, just write "you can use empty string if you want" and that should be enough to prevent them skipping this very important feature, most fail to understand the value of it.
My question would be if BIP39 is a standard isn't it subjected to the standardized attack vector. So a hacker only needs to break BIP39 and has the ablity to attack all wallets in existance.
"Only" in this case means computing 10^37 unique combinations of BIP 39 phrases and that's if you're only using 12 words. That would take approx 1 trillion years with $1 billion worth of computing equipment using today's benchmarks.
Perfectly Balanced like all things should be
Can a passphrase consist of some figure more than 12 words but less than 24?
100 symbols? I think 15 words would be ideal
Is there any hot wallet that support passphrase
can someone explain the 'attached to pin' and 'temporary pin'
I need help. I had a recovery with my 12words and I can only see my xrp coins and money my other coins is still 0$ help pls
How many rounds of key stretching hardware wallets use?
Hi there! Does the passphrase have to contain words only in English or can it be in other languages as well? Thanks
11:55 Andreas' rules are as below, which I'm sticking with🙂:
book: not written from this
mnemonic list (seed phrase): not from this
movie: not from this.
phrase: no
search engines: not from this
spaces: no
words: 6-8 English
Although I might be wrong that I'm using a passphrase which is a mnemonic that helps me remember some tough abbreviations. E.g. Trying to learn/remember the abbreviation DNA: DeoxyriboNucleicAcid (but something with 6-8 words).
I use Ledger and there is an option for passphrase, you can put any letter up to 100 characters including special letters. Also you can set up the secondary PIN which is connected with passphrase. That means you don need to enter passphrase every time you want to get access - you just need to enter the secondary PIN.
Oh lovely, some fresh content. Big things happening in crypto over here in Liechtenstein, let me know if you want to visit!
I want to visit ☺️
Thanks for the video!
Assuming your 24 word seed is very secure, is it ok to use simple (weak) phase phrases as a savings/filing system? Making your hardware wallet have different “savings accounts” separated by phase phrases?
For example:
24words+ “House”
24words + “car”
24words +”kids”
11:55 Andreas' rules are as below, which I'm sticking with🙂:
book: not written from this
mnemonic list (seed phrase): not from this
movie: not from this.
phrase: no
search engines: not from this
spaces: no
words: 6-8 English
Although I might be wrong that I'm using a passphrase which is a mnemonic that helps me remember some tough abbreviations. E.g. Trying to learn/remember the abbreviation DNA: DeoxyriboNucleicAcid (but something with 6-8 words).
Any thoughts on BC VAULT wallet? Thx👍
So you’re saying use 24 words not 12?
A passphrase is not just a brain wallet if you use a random source to generate the words, which of course you should be doing.
And can I save the passphrase on lastpass?
@@Tom-bn5zd As long as your seed words are secure (hidden, locked away and never entered into a potentially compromised computer), then I'd say yes, although it's a trade-off. It is less secure than not storing it in Last Pass but you're probably less likely to lose it, especially if you also have it written down in a secure location as a backup. If anything happened to you also make sure your loved ones know exactly what to do.
Спасибо! Было крайне полезно.
11:40 how to
I used Shamirs Secret Sharing to cut my seed into a 3 of 5 that is distributed in different locations. What is your opinion on that?
bad idea
Andreas are there any hardware wallets you would recommend?
He uses a Trezor. I lke that one too because its software is also open source.
In other words, just do some work, get your wallet as secure as possible, and don't worry about it unless you become an ultra millionaire
this goes straight over my head, you are a genius but this is too hectic, lol
Thank you Andreas.....
12:50 password different from seed
Hi Andreas! Can you please cover the current bug report:
bitcoincore.org/en/2018/09/20/notice/
Its hard to understand what this actually means today.
Does this bug mean that today some malicious miner that didn't update can print new bitcoin?
secondly, If someone does create additional bitcoin than is suppose to be made... is there a way to tell that its in the system?
2:13 mentions PBKDF2
the trim on your window is so wrong
where i can submit questions?
Questions are submitted by patrons on Andreas' patreon page. The link is above if you'd like to check it out. 🙂
why cant i become a patreon with bitcoin bummer i dont have any credit on my credit now
panagiotis agelakis. Lol. Yeh that would be ideal. :-))
Can you steelman Bitcoin Cash then explain why it's either: a scam, an attack or otherwise illegitimate or inferior to Bitcoin?
The channel named Crypo's Price Forecast mirrors your content and monetizes it by selling adds.
What about BitFi wallet ? how to storage or protect funds that are needed to be used regularly for trading, etc.!?
awesome info.. thank you!
thanks for great content.
You’re the man, thank you ❤️
❤❤❤❤
Because of Bitcoin 4 years ago I created Time Priced Art & in Description I have a Counter.
Counter Keeps track of money Times the Minutes = $1 per Minute .
Painting Price go's Up $1 Per Minute Forever.
Sold all my Crypto .
Hi Andreas, would it be safe to mix 6 random words (that you have memorized) into your 24 seed words, and then make it public (so you will never lose it)?
Not safe.
Smashed the like
smashed the like for you for all those times you smashed for Andreas.
10:55 "erased it from the web" ha ha ha ha ha ha ha!
Eres la daga Andreas
🧡
Ledgers do not have passphrases...hmmm...
v4freedom the nano s does
Wrong
Using quantum grammar in your titles,!? Nice touch A,😉
0:00
I memorize my words with a story. (memory hack) my phrase was never online 😉
oh, that is still quite risky. The chances of your mind altering a small detail over time and then memorizing the mistake is definitely very plausible. Sure, sounds strange right now, but happens a million times.
You do not have to memorize your seed in order for it to never have been online, just saying. there are way easier, more comfortable and more secure ways. obviously, a hardware wallet is always a great idea.
The mnemonic phrase that I learned is from a hardware wallet 😉
I also have them written somewhere. but In case of a fire or something, I still have a backup 😉
You can be hypnotized by some one to extract it .. that's not good buddy plus you might forget it easily too ya
@@krishnayogi can you give me tips on where to save the passphrase? Is in lastpass enough? And are 6 words passphrase the sweet spot for most people? Thanks in advance.
OCT. 1 IS COMING!! Q4= FRESH MONEY FOR BTC!!
It's ok, Andreas, I devised my own infallible scheme! I'll post my passphrase, _and_ my mnemonic seed online, but I'll post each one with different account. The seed with jondoe07, and the passphrase with jondoe08. Then no one will be the wiser! 👌 👌 👌
brilliant!
how to make something simple sound complicated 👎
Are 6 words random passphrase from the dice the sweet spot for most people?