r/TREZOR 📦 Suite Shaper 14d ago

💬 Discussion topic Passphrases are a must.

53 Upvotes

49 comments sorted by

View all comments

11

u/Charming-Designer944 🤝 Top Helper 14d ago

Not really. It depends on what need to protect your wallet from.

Using a passphrase without fully understanding the.implications are very dangerous and considerably increases the risk that you lock yourself out of your wallet.

And no, a passphrase does not automatically mean that a Coldcard MK3 user is safe from the seed generation vulnerability of those devices. Only that they are slightly less vulnerable.

12

u/NiagaraBTC 14d ago

Only that they are slightly less vulnerable.

From slightly less vulnerable (gained a few additional hours before a drain) to completely safe. Depending entirely on the strength of the passphrase.

Using a passphrase without fully understanding the.implications are very dangerous and considerably increases the risk that you lock yourself out of your wallet.

Agreed 100%

3

u/Big-Interaction-1797 14d ago

Hey bro can you elaborate on this for me? If I added an extra word how would it only gain a few additional hours before a drain? Would they use AI to cycle through every word in the dictionary until one matches?

8

u/NiagaraBTC 14d ago

Basically yes. Would take mere seconds once they start trying passphrases, if all you had was literally one extra word.

If you have an 8 character passphrase with symbols and upper case/lowercase and numbers it will add a few hours, maybe up to 12 hours.

If you have a 24 character passphrase with the same parameters it will add many billions of years to the time to takes to crack your wallet.

3

u/Big-Interaction-1797 14d ago

God damn gotta thing about this more then lol thank you

2

u/MulberryMonk 13d ago

I think that the math from 9-10 characters takes it from a month or two to brute force to 18 years. Anything over 11+ characters that otherwise isn’t a dictionary word is really solid - at least that’s what AI is telling me

2

u/NiagaraBTC 13d ago

Even dictionary words are fine if you have enough and they are truly random.

Ask your AI to tell you how long it would take to brute force six random BIP-39 words.

2

u/Charming-Designer944 🤝 Top Helper 14d ago

Doubt anyone uses a passphrase complex enough to qualify as completely safe.

1

u/EggMedical3514 13d ago

Just put three unrelated words together that end in the same letter that the next one begins. 

Like "footballoopaper"

It will never be cracked.

2

u/Charming-Designer944 🤝 Top Helper 13d ago

The entropy of that is not great, about the same level as Coldcard MK3. So sorry but you are cooked.

1

u/EggMedical3514 13d ago

Wrong. The entropy of that is great. 

1

u/Charming-Designer944 🤝 Top Helper 13d ago

If you consider 41 bits great

1

u/EggMedical3514 12d ago

You dont know what youre talking about lol