Brainwallets and Why You Shouldn’t.

One of the most complicated aspects of Bitcoin and cryptocurrency security is that of maintaining your wallet security. Sadly, there is a lot of conflicting and non-intuitive information out there and it can be difficult to find information about what to do and how to remain safe.

One way of handling wallet security is through a method called brainwallets. In short, these are wallets that use a memorized word, phrase, or sentence to generate a secure key for an address.

Unfortunately, it’s not as easy as just coming up with a good phrase. To understand why, you need to understand a bit about wallets, addresses, and keys. Don’t worry, it won’t be very complex, and I’ll write a more extensive article later on deeper details.

Wallet and Key Primer

The first thing you need to know is that a wallet, in cryptocurrency terminology, is more like a collection of addresses than a store of money. It is the addresses that store the coins, not the wallet. The wallet is really little more than a list of the private keys for those addresses.

Each address is a unique string of characters that is derived from a public key. It is not the public key as such, but rather the result of some mathematical juggling.

At this point, you may be wondering what these private and public keys are, so let me give you a brief overview.

Modern cryptography often utilizes a private and public key pair. Each of these private and public keys in a pair are linked so that a certain public key always corresponds to a certain private key, but in such a way that knowing one part of the pair does not give you the other part.

For example, and very simplified, let’s say you have a public key ABC that corresponds to the private key DEF. You can validate that the key DEF corresponds to ABC and the other way around, but you cannot find DEF simply by looking at ABC.

In fact, you want people to have your public key in many situations. You can share the public key with anyone as long as you keep your private key, well, private. This is essentially what you are doing when you publish your cryptocurrency address, although it’s technically difficult to get from a Bitcoin or Dogecoin address to a public key.

By sharing your public key, or really the address derived from your public key, you accomplish two things. First, you allow people to send coins to your address, which at least in my book is a very compelling goal. Second, you create the ability to sign messages using your private key so that anyone can verify that you control the address. This allows you to send coins as well.

Note: You can even use this in reverse to create encrypted messages that only whoever has the private key can open, but that’s for another article.

Having the the private key part of a public/private key pair means that you can use the key DEF to sign a message, and anyone seeing that message can, knowing the ABC public key verify that it was indeed signed with the corresponding DEF key without knowing what the DEF key really is.

Note: Signing a message is really just creating a unique sequence of numbers or signature as it is usually called, using the private key and the message. Because the private key DEF always corresponds to the public key ABC, anyone who knows the ABC key can verify that it was indeed signed with the DEF key, again without knowing the DEF key.

Cryptocurrencies utilize this key pair method too by creating a unique address derived from the public key ABC. The private key DEF remains in your care, and this is what you need to guard to care for your wallet security. Your wallet essentially contains the private keys for any address (and thus public key) you have added to your wallet.

Anyone can verify that any message, such as a transaction, derived from a public key is indeed signed by the private key that corresponds to the public key. So, as long as you control the private key corresponding to the public key used to generate the coin address, nobody but you can sign a message that sends money elsewhere using that address.

So, with that primer out of the way, let’s look at brainwallets and why they are a bad idea.

Brainwallets: Just Say No!

Every transaction in Bitcoin, Dogecoin, Litecoin, or any cryptocurrency rely on two keys only; the public key, used to generate a coin address, and the private key, used to sign messages to control the coins held by that address.

This is what creates the semi-anonymous nature of cryptocurrencies. Nobody knows who controls the private keys, and whoever controls the private keys control the money. There is no other identifying properties such as address names, usernames, passwords, or anything like that. If you have the private key, you have everything you need.

However, remembering a private key can be very difficult. Here’s an example of a private key:


This key corresponds to the address 1JwSSubhmg6iPtRjtyqhUYYH7bZg3Lfy1T, which is a fairly well-known and quite insecure address used as an example for a brain wallet.

Instead of trying to remember the private key, or having to keep it secret and possibly losing the medium used to store it, a brainwallet instead uses a phrase or sentence that is much easier for people to remember.

The above example is the brainwallet key for the phrase “correct horse battery staple” which is from a well-known XKCD comic that explains an aspect of passphrase security called entropy.

A brainwallet uses similar cryptographic number crunching to turn that phrase into a private key for a cryptocurrency address. Seems genius, right? You don’t need to memorize any cryptic strings and you don’t even need to store your wallet or private keys anywhere. Simply remember the passphrase and you’re golden; you can always recreate the private key from the passphrase.

But there’s a problem.

A Brilliant Idea Tainted

Because the only thing you need to get access to funds is the private key, and the passphrase can be used to recreate the private key, you end up with a situation in which anyone who uses the same passphrase as you will get the same private key.

The above example, using “correct horse battery staple” is an example of this. It is a common phrase that, while easy to remember, is also known to everyone and also fairly easy to guess.

In short, you end up with a security solution that relies solely on a passphrase that must be globally unique and extremely difficult to guess to have any meaning.

The XKCD comic is still right, but not in the case of cryptocurrency and wallet security. In a website login, a passphrase may work fine because you can add a bit of difficulty by having to combine the username and the passphrase, but also because you cannot simply brute force a billion attempts every second to try to log in using every conceivable combination of words. The server would either overload or there would likely be some kind of lockout after a few failed attempts.

With cryptocurrencies, however, you can try combinations of words as many times as you want. You don’t log in anywhere; you simply create a private key from the combination of words.

To create a secure brainwallet, then, you need to have a passphrase that is guaranteed to be unique and very difficult to guess.

You may think you can outsmart the system by using something that is unique to you. For example, add your spouse’s middle name to your phrase to create something like “correct horse denise battery staple”. However, you’d fail on the ‘difficult to guess’ part, and you’d fail in the globally unique part because, well, other people have spouses named Denise too.

You may use a longer passphrase but again, with the power available to modern computers these days, trying billions of combinations take seconds at most and if the attacker knows even basic information about you, such as the languages you use, your family names, your birthdates, and so on, it wouldn’t take very long to outsmart you by simple brute force.

Even if you managed to find a unique and difficult to guess pass phrase, you’re still stuck with a couple of problems.

One such problem is that you also need to remember the passphrase. The longer the passphrase, the more difficulty you’ll have remembering it.

Note: Writing it down is… not good.

“Great, “ you think, “I’ll use the first paragraph of the national anthem” and you’d fail in the difficult to guess and globally unique aspects again. “So, what about the combined names of all my kids, my parents, and my own, in random order?” For a password, it would be great, but for a brainwallet, it is not sufficient.

But let’s give you the benefit of the doubt and hope you remember your 28 word passphrase perfectly, and that it is both difficult to guess and globally unique.

Now you need to remember such a passphrase for every unique address you control. in cryptocurrencies, new addresses are cheap and used extensively. I’ve had hundreds if not thousands of unique addresses in just the year or so I’ve been involved with cryptocurrencies and remembering a passphrase for even a fraction of these would be impossible. And I do have great memory.

So, Any Good News?

You may think that based on what you’ve read so far, brainwallets have no use at all. That’s not entirely true, but like any tool, you need to know in which situation it makes sense to use it, and not try to force the situation to fit the tool you want to use.

For example, in cold wallet strategies, having a brainwallet may work great. Rather than storing the private keys in clear text, you can store a passphrase as part of something else. For example, you can put a book in a safe, and remember that the passphrase is the second paragraph on page 238. Whoever breaks into the safe won’t know the secret to finding the passphrase, and you just need to remember a few items of data. It isn’t practical for every day use, but then again, the purpose of cold wallets is to be long-term storage, not day-to-day payments.

Note: I’ll write about cold wallets and cold wallet strategies in a later article

For most normal uses, however, brainwallets aren’t as cool as they initially sound, and you need to be very careful before you rely on them for your security. With the knowledge you’ve gained here, though, you may be better able to determine when to avoid them and how they may be used as part of an overall security strategy.



Donate Bitcoins



MtGox Bankruptcy: The Bad and the Good News





That’s the “why you should worry” part of this.








And you’ve learned.


Understanding Bitcoin Malleability




















Give the Gift of Bitcoin Mining This Season

If you want to give a gift that is both a useful, educational, and benefits society, why not give someone Bitcoin mining as a gift? Here’s the idea.

CEX.IO, and I’ve written a couple of articles about them earlier (and links in this article are affiliate links; check the end for direct links), have the ability to generate vouchers that you, or someone else, can redeem for cloud mining power at CEX.IO. You buy the hashes for your own account and then create the voucher to give away some or all of that mining power to someone. Those that receive it can simply register and redeem the hash power and start watching their Bitcoin income grow.

I think this would be an awesome gift to someone who is interested in learning about mining and Bitcoin and are some reasons why.

Bitcoins are often difficult to get

One major obstacle to wide-spread Bitcoin adoption is that right now, getting traditional currencies into the system is a major hassle. By giving mining as a gift to someone, they get Bitcoins without the hassle and risk of sending money through wire transfers or buying in person.

Learning about mining is fun and exciting

For a lot of people, Bitcoin mining seems almost magical. However, it can be fun and exciting to follow and learning how it works is a great first step towards gaining a better understanding of Bitcoin.

Bitcoin mining at CEX.IO is redeemable instantly

Mining can be an exciting and educational, but some may not want to keep doing it for any number of reasons. That’s fine, at CEX.IO they can sell their cloud mining power any time they want and withdraw the Bitcoin to a normal account.

Investing in Bitcoin mining can be risky

Buying a Bitcoin miner means a lot of maintenance, electricity cost, and the risk of hardware failure. Of course, there’s also the risk that the miner won’t work at all or that the vendor doesn’t deliver or simply runs away with your money.

With CEX.IO, there’s little risk of hardware failure because CEX.IO is responsible for keeping the miners operational and replaces faulty hardware for free. They also take care of electricity and setup for you.

Getting a miner takes time

Buying a Bitcoin miner yourself will at best take a long time because miners are usually sold out way in advance of general availability. By the time you get your hardware, difficulty may have shot through the roof. Additionally, almost every vendor has been delayed with deliveries.

CEX.IO allows you to get Bitcoin mining power immediately; you can buy now and have your mining power start generating Bitcoin in a matter of minutes.

Physical Bitcoin miners are expensive

Getting a Bitcoin miner can often mean investing thousands of dollars. That’s a huge amount of money to give as a gift. Of course, you can’t just give parts of one either.

However, CEX.IO allows you to buy Bitcoin mining power for exactly the amount you want, whether it is $100, $1000, $1, or even $0.10 worth of hashing.

Note: You do pay in Bitcoin, though, so perhaps it is better to say 0.1, 1, 0.01, or 0.001 BTC.

Now that prices of Bitcoin has fallen, at least at the time of this writing, buying a few GHs of Bitcoin mining power isn’t half bad anymore, and it would make a great gift to introduce someone to the wonderful world of cryptocurrencies.

Please note: The links in this article are affiliate links, which means I get a small reward if you use those to sign up and make purchases. If you prefer to not use an affiliate link, just go directly to


Why Altcoins Show the Future of Cryptocurrencies

I have previously written about how I think alternative coins like Litecoin, Namecoin, and Primecoin are important to the cryptocurrency community and to Bitcoin itself. My argument is that evolution is awesome and we should embrace it. A multitude of coins can keep cryptocurrencies from falling prey to the single point of failure.

Don’t get me wrong; Bitcoin is awesome on its own. For serving its purpose, it is almost perfect and there is no realistic alternative right now. If all we wanted to do with Bitcoin is what we currently do, alternative coins are a waste of time.

However, alternative cryptocoins, or altcoins as they are often called, have completely different uses too, and uses that Bitcoin cannot possibly expect to cover. In fact, although these uses  are incredibly useful (and I start to realize the overuse of the word use), adopting them into Bitcoin would be a huge mistake.

Let me show you some examples.


The biggest altcoin by far, Litecoin has been argued as being nothing but Bitcoin with a few minor changes and thus not adding anything of value. In fact, where some coins actually have useful features, the argument goes, Litecoin is simply Bitcoin with a slightly different algorithm. Faster transaction times isn’t really required and it isn’t really that much more secure, if at all. Nothing new to see here, move on.

However, look at what’s happening with the community. Over the previous few months, the Litecoin developers have given Bitcoin a completely new wallet program. The Bitcoin developers probably couldn’t have done this without inciting confusion, but Litecoin has been experimenting with this for a while and gave the result to Bitcoin for use as it sees fit.

In fact, being so close to Bitcoin in terms of features allow Litecoin to be the perfect test bed for new features for Bitcoin. Not only that, but other coins can also learn a lot from what Litecoin does, which may in turn yield even better alternatives than this current more-or-less replica.

Still, Litecoin is probably the coin that is easiest to just write off as a nice idea but not really required. Let’s move on, though.


Believe it or not, but a big problem today is the control that the US has over the domain name system. By court order, the US government can shut down or take over a .com domain, and because .com is operated by a US entity, that is a concern for those most paranoid about privacy and liberty.

It doesn’t even affect .com domains either; pretty much any country in the world has similar laws that allow someone to take over the operation of their domain names. This is one reason why you see a lot of ‘weird’ domain extensions; it is often an attempt of someone to gain some kind of protection from the scrutiny of governments.

Namecoin proposes to change all that by decentralizing the distribution of domain name management.

It has failed so far, but the potential to completely revolutionize and democratize the internet is there. Namecoin may be the first version of something that will eventually take domain names out of the control of government or ‘big corporations’ to democratize the process of managing domain names.


If you’ve read my articles on understanding Bitcoin mining difficulty, you may know that what Bitcoin and Litecoin miners generate is essentially thrown out the window. You may say that they are turning electricity into money, but for absolutely no other benefit beyond heating the room.

Primecoin is another example of how cryptocurrencies can have real life impact. If you don’t know, Primecoin is an attempt to turn the power generated by mining into something useful. In the case of Primecoin, it is generating chains of prime numbers, which is way beyond what I currently understand about math, but is potentially useful.

So far, Primecoin is only potentially useful, though, but it shows how cryptocurrencies can have the potential to yield real scientific benefit. Distributed computing, like the Folding at Home or SETI at Home projects, could be completely revolutionized by efforts like Primecoin.

Bitmessage, Colored Coins, and Mastercoin

Don’t like alternative coins at all? Fine, Bitcoin itself can also be utilized for other purposes than just as a store of value.

Three examples are Bitmessage, Colored Coins, and Mastercoin. Bitmessage is, or was, an attempt at building a messaging framework on top of Bitcoin. Colored coins can be used to make special Bitcoins that represent a different value like stock in a company, a car loan, or other valuables. Mastercoin can potentially allow anyone to create their own currency that is propagated through the Bitcoin block chain.

Bitmessage failed, or at least haven’t succeeded yet, because it simply doesn’t scale well, but imagine a messaging system where all messages are seen by everyone but encrypted so that only the intended recipient can decode the message. It may not replace email, but it could serve as a public verification and records of things like contracts, bids, agreements, and so on; an open and free notary public if you will.

Colored coins hasn’t been implemented by anyone yet, but imagine a system where a special Bitcoin could represent the shares in a company. Suddenly, you have an ability to trade that coin, or fractions of that coin, just like you trade shares in a company at a stock exchange today, except it would be open and transparent and not controlled by anyone.

Mastercoin is a new undertaking that seeks to build a protocol on top of Bitcoin to create custom currencies. Imagine a chain like Wal-Mart or Trader Joe’s issuing their own currency that you can buy and trade and use in their stores only. Governments could give custom coins for social welfare for use at a certain store only to prevent recipients from using them for drugs or gambling. Parents could give allowance money to kids without fear that they would use them for nefarious purposes. Airlines could give bonuses in terms of tradable currencies rather than ‘points’.

Version 0.1

At this point, cryptocurrencies are in its most basic infancy. We think of Bitcoin as just another form of money, albeit issued through mining rather than by a central bank.

However, this is akin to looking at the web in 1994. It was extremely basic and rudimentary. The ability to submit a form via a web page was considered a major breakthrough. Animating GIFs were considered the multimedia of its day. You could easily wait a minute or two while your browser loaded a web page. Much of the web was just text. It was awkward for most normal people and a niche thing for geeks and crazy people.

Today, we can barely imagine a world without the web. Not just did it pave the way for awesome communication across web pages, but it brought the internet to all those normal people, spawning a range of additional services, like online games, real-time video conferencing, secure communication for the masses, YouTube, and all the other things we now can barely live without.

Imagine, if you will, what the world can look like in a few years, the equivalent of the web in 2000, when cryptocurrencies have been around long enough for the mainstream to adopt them and build awesome services, products, and features.

Embrace the Future.


Use Namecoin (NMC) to Purchase Bitcoin Mining Power












Why I Sold My ASICMiner Shares





Fundamental Investing






ASICMiner Fundamentals
















CEX.IO – A New Way of Investing in Bitcoin Mining










CEX.IO appeals to me for several reasons.














New Bitcoin Client – From the Litecoin Developers

A few months ago, I wrote about why I believe Litecoin has a place in the cryptocurrency community. In short, one of the main reasons is that diversity strengthens a community, and Litecoin certainly offers a contribution to that diversity.

To show this, the Litecoin developers, lead by Warren Togami, just announced they have released a Bitcoin client called Bitcoin OMG. Yup, that’s right, the Litecoin team working for the “enemy”, making Bitcoin a better coin.

The new client introduces several interesting features that are sure to make an impact. For example, the new client allows watch-only addresses. What this means is that you can monitor any address and see it’s account movements as if it were your own address. Obviously you can’t do anything with the money in those remote wallets, but due to Bitcoin transactions being public, you can see what goes on in any address.

Another interesting feature for those managing multiple addresses (like myself) is coin control. If you don’t know how a wallet works, it is essentially a collection of Bitcoin or Litecoin addresses. Although your wallet will show the complete balance for all those addresses (including watch-only addresses with the new client), each address actually was its own balance independent of each other.

Let’s say you have ten addresses where you’ve received 1BTC each. Your wallet balance now shows 10BTC and you want to send 3.5BTC to someone.

The default client will “kinda randomly” chose from which of those 10 addresses funds will come. This may be a problem if you are managing addresses for multiple entities, for example if you have an address for a company, your spouse, or perhaps set aside for a specific purpose.

With coin control, the new Litecoin-based Bitcoin client allows you to control from which addresses you send money so you can keep certain addresses completely out of touch if you like.

A final feature worth mentioning is for miners; you can now disable the wallet functionality completely and use the client as a relaying or mining station only. This reduces RAM usage considerably and makes the impact of running a client much smaller.

There seems to have been a hitch with the first release of Bitcoin OMG, though, so the developers have pulled it for now, but you can follow its progress in the Bitcoin OMG thread over on


Understanding DMS






An Executive Overview

























Well, they do, and here is how it works.











Where’s The Catch?














Why DMS.Mining Will Always Lose












Update August 10, 2013:


If you believe this article, of course, you wouldn’t.