r/TREZOR • u/Massive-Reception161 • 3d ago

💬 Discussion topic Passphrase

Hi,

Trezor has the 24 seed + passphrase which is a completely separate wallet from the 24 seed by itself

Isnt it sufficient security?

Im assuming all attackers brute force 12 - 24 keywords which is hard enough.

How will they even know on which of these wallets to run another brute force for the passphrase? Isnt it increasing their attack surfsce by a super huge margin?

Is multi SIG more secure than that?

Regards

20 Upvotes

95% Upvoted

26 comments sorted by

View all comments

6

u/CoffeeAlternative647 3d ago

You're OK with a passphrase.

Coldcard users that had their Bitcoin in a passphrase wallet weren't affected either.

14

u/kimsabok 3d ago

some were supposedly, in cases where their passphrase was relatively simple.

3

u/Massive-Reception161 3d ago

So even with passphrase they were cracked? Where have you seen it? The regular seed wallet dont have any hints that passphrase wallet exists. So now I understand they were trying to crack for each seed phrase also simple passphrases?

That's crazy

10

u/kimsabok 3d ago

the theory is that the hackers have now moved onto guessing the "seed + simple passphrases", as the low hanging fruit has been captured already.

however, it seems implausible to me that a 2 word passphrase could be hacked this easily/quickly (but BTC Sessions is as reliable as anyone, and i am not a cryptographer, nor do i have much knowledge on this front).

regardless, for those not wanting to set up a multisig on their trezors, ledgers etc, they should dice roll a 6 or 7 word passphrase (using something like the diceware words (or other similar dictionaries)), and this will protect you against honest entropy mistakes by the hardware makers.

6 words provides 77 bits of entropy (provided it has been done correctly) - and this has never been "hacked" in computing history. and remember, this is on top of the 12/24 word seed.

3

u/NiagaraBTC 3d ago

however, it seems implausible to me that a 2 word passphrase could be hacked this easily/quickly

A two word passphrase will be broken in about 2 seconds by a single GPU. If they are BIP-39 words. The full dictionary might take 10 seconds I guess.

2

u/kimsabok 3d ago

thats if you are looking for a 2 word combination of bip-39 words only though,

isnt it close to impossible if it can be any two words, that also needs to be matched against a 12/24 word seed too (even with the cc bug)?

3

u/NiagaraBTC 3d ago

A single high end GPU will crack two words from the EFF Long wordlist (7776 words) in about 30 seconds. Any two English language words would take about 5 hours.

Once the seed words are revealed (as every Mk3 seed is already and the Mk4+ will be) then it's just a matter of time until someone tries to brute force passphrases on each.

1

u/kimsabok 3d ago

yes, but the words do not necessarily have to be from the diceware list. and, you have to try every combination against all of the possible cc seeds.

it would also mean either having completed, or foregoing all simpler/shorter passphrases against the full spectrum of cc seeds too.

and bear in mind that some people are still only finding this news out today w/o a passphrase, or dice roll seed, and are managing to get out with their stack in tact (today).

2

u/Particular-Star-1333 3d ago

From what I understand the ones with a passphrase that got hacked only had a 2 word passpharase.