Lost Passwords Lock Millionaires Out of Their Bitcoin Fortunes

The New York Times ^ | 12 Jan 2021 | Nathaniel Popper

[Theoria]

Bitcoin owners are getting rich because the cryptocurrency has soared. But what happens when you can’t access that wealth because you forgot the password to your digital wallet?

Stefan Thomas, a German-born programmer living in San Francisco, has two guesses left to figure out a password that is worth, as of this week, about $220 million.

The password will let him unlock a small hard drive, known as an IronKey, which contains the private keys to a digital wallet that holds 7,002 Bitcoin. While the price of Bitcoin dropped sharply on Monday, it is still up more than 50 percent from just a month ago when it passed its previous all-time high around $20,000.

The problem is that Mr. Thomas years ago lost the paper where he wrote down the password for his IronKey, which gives users 10 guesses before it seizes up and encrypts its contents forever. He has since tried eight of his most commonly used password formulations — to no avail.

“I would just lay in bed and think about it,” Mr. Thomas said. “Then I would go to the computer with some new strategy, and it wouldn’t work, and I would be desperate again.”

Bitcoin, which has been on an extraordinary and volatile eight-month run, has made a lot of its holders very rich in a short period of time, even as the coronavirus pandemic has ravaged the world economy.

[E. Pluribus Unum]

Am I the only one who thinks these people are the most brain dead on the planet?

Anything bad you can say about bitcoin also applies to the Federal Reserve.

The Fed is just going to inflate you out of existence.

[Slyfox]

[LouieFisk]

“When there’s that much at stake you just don’t lose or forget the password! Writing it on piece of paper is not enough.”
—
One good and simple way is to take an easily remembered long phrase like “Four score and seven years ago our fathers brought forth on this continent” and use the first letter of each word. If you need to include numbers or other symbols, don’t use ones that now attached to you personally (address, soc sec #, etc). Use something like the last four digits of your childhood friend’s phone number or the channel number of the TV station you used to watch Sat morn cartoons on.

[zeugma]

BTW--I have zero sympathy for him or anyone else who forgets a password.

Me too. I've been doing this computer stuff far too long I guess. I have all of my passwords managed by a password manager, which lets me create really strong passwords. The master password can be generated algorithmically. I have daily backups, and an offsite copy of all of my data that I rotate out quarterly. Hell, even my wifi password is nothing but a huge hexidecimal string.

I'd be making damned sure I could access an account even if it was only worth $100, much less something worth millions as described.

[puppypusher]

I’ll never understand how something intangible like Bitcoin can have any value.

I guy I worked with went out and spent hundreds of dollars on graphics cards to search for Bitcoin.

I told him he would have been better off buying gold or copper instead of wasting money on Bitcoin.

[aMorePerfectUnion]

My what a heartless crowd here!

I offer to adopt the lost bitcoins, and rehome them with the love and care they deserve!

[zeugma]

Q: Your favorite sport? A: Refrigerator.
Q: You best friends first name? A: Refrigerator
This is very easy to remember but extremely hard to guess; or so it appears to me.

Not a bad strategy, but you can't use 'refrigerator' at more than one site. You're still going to have to remember your response for each site. Get a good password manager and use it. Most of them will have a 'notes' area for each site that will let you keep track of your responses.

[HotHunt]

I agree. Another illusion with just another name.

[StAnDeliver]

"Don’t forget the number of people that use a laptop or desktop that has a “keyloger” on it, maybe even 10 years old. Somebody in China is checking his account 5 times a month for 20 accounts and then cashing in whenever they need money. If you get hacked there is no backup plan. It would be interesting to see whether forgetting passwords or hacking causes more lost Bitcoins. I’ve heard of many millionaires getting hacked and when they check their account, the money is gone."

You raise an interesting point -- he's logged into that bit wallet on an internet-connected platform at least once with the correct password. Then it's in P RISM and countless other int'l surveil. LOFL

[Sons of Union Vets]

Twitter CEO Jack Dorsey and his other company known as Square (crypto-wallet) are in a tussle with Steven Mnuchin and FinCEN over Mnuchin's "Know Your Customer" anti-money laundering regulation which would require additional personal data accompanying cryptocurrency transactions in amounts of $3,000.00.

https://seekingalpha.com/news/3648476-jack-dorsey-and-square-against-mnuchins-proposed-new-crypto-rule

_____________________________________

Gee. Now why ever would Dorsey be against an anti-moneylaundering regulation? Hmmmm!

[chuckles]

..."I’ll never understand how something intangible"....

What I think people are missing is the gubmint will eventually have to come after Bitcoin for it's use in money laundering, dope, illegal transactions including murder for hire, and sex trafficking. It has more than doubled in value. How will the IRS get their piece of the pie?

Eventually Bitcoin will have to be banned and every Law Abiding person will have to give it up. Just like banning guns, however, the dope dealers will keep theirs.

[zeugma]

For those of you running Linux, or OSX, here's a little script that will allow you to generate pretty decent passwords. One thing that is nice about this kind of thing is that it is a pretty random string, yet if you know how it is generated, you can recreate the password in question from scratch at will, unless you run it without arguments. The output has dashes in it to make it more easily read. You can keep them or toss them when you enter the password itself.

Here's the script itself, which in this example I've named 'poohbear':

$ cat poohbear 
#!/bin/bash
#
# This script will take any string as input. 
# If you include spaces in your string, you must quote the entire string.
# If no string is specified, the current Epoch time to the millisecond is used.

if [ "$1" = "" ]; then
        STRING=`date +%s%N`
    else
        STRING=$1
fi

echo "Starting with: $STRING"
MYSTRING=`echo $STRING | sha256sum`
echo "Now converted to: $MYSTRING"
echo "Parsing it out a bit more..."
echo "Your password string would be:"
echo ${MYSTRING:10:4}-${MYSTRING:14:4}-${MYSTRING:20:4}-${MYSTRING:24:4}-${MYSTRING:30:4}-${MYSTRING:34:4}-${MYSTRING:40:4}-${MYSTRING:44:4}

Here's the script in operation. In this example, I'm feeding it the name of the website as the initial string.

$ ./poohbear www.foobar.com
Starting with: www.foobar.com
Now converted to: 0114330729fa5ab07ba7ff3dab769a5164468c35c83d27095764572e5b237408  -
Parsing it out a bit more...
Your password string would be:
fa5a-b07b-ff3d-ab76-5164-468c-c83d-2709

Here's the same script with no arguments. The initial string is the unix time to the millisecond.

$ ./poohbear 
Starting with: 1610478451303734951
Now converted to: fab09df74c1275b4611cadaddb6a4e4fdb0298fe086c308f162b2ad7a1b84fd4  -
Parsing it out a bit more...
Your password string would be:
1275-b461-adad-db6a-4fdb-0298-086c-308f

One thing that is cool about using a script like this to generate passwords for you, is that once you have the password, if you want you can further obfuscate things by only taking the 2nd, 4th, 6th, and 8th set. You'd still end up with b461db6a0298308f as your password, which is pretty strong, and hard for someone to recreate unless they knew how you produced it.

[SFConservative]

Q: You best friends first name? A: Refrigerator

Wow, you're best friends with William Perry?

[Axenolith]

At the time people did a lot of this (there’s supposed to be ~7000 on a hard drive in an Irish landfill) btc had negligible value.

[Darnright]

“BTW—I have zero sympathy for him or anyone else who forgets a password.”

At the time, he probably thought he was buying a novelty, and so wasn’t all that careful with his password.

Expensive way to learn a lesson, though.

[Scrambler Bob]

He can claim $200M as an IRS income loss, right?

[Axenolith]

What about all the Freepers that were alive when they didn’t have phones??? (Dodges shower of rotten fruit and vegetables)...🤪

[LouieFisk]

Yeah, there are plenty of people, young and old, conservative and leftwing who are totally lost without a phone in their hand.
As I just mentioned elsewhere, when the SHTF and everything goes down, those of us with basic living skills will rule the world!

[Brooklyn Attitude]

I suggest offering a $1,000,000 prize to anyone who develops a method of accessing a locked IronKey without using the password. Demonstrate it works on other IronKeys before trying to open the one with the Bitcoin.

[StAnDeliver]

"One thing that is nice about this kind of thing is that it is a pretty random string, yet if you know how it is generated, you can recreate the password in question from scratch at will, unless you run it without arguments"

I like it but what is the constant to recreate the original?