Popular science: what is the password account

Article title: science: what is a password account
Source: bitpieteam

What is a password account?

With the popularity of mnemonic wallets, almost everyone knows that mnemonics are the only way to control their assets. Mnemonic account we are very familiar with, then what is the password account?

Password account is an extension of mnemonic account in application.

In common mnemonic accounts,
We all know that if your 12 mnemonics accidentally leak out. They can simply recover your assets and transfer them away.

And in the password account,
Even if your mnemonic accidentally leaked, if the other party can't get your custom password, he still can't restore your real account, and there's nothing you can do about your assets.

In the mnemonic account, 12 mnemonics = control assets
In a password account, 12 mnemonics + custom password = control assets

For example, I have an account with a mnemonic:

Fruit blanket abuse detail 

The pattern dinosaur monkey loop 

Group the abstract tortoise blind

(false demonstration, do not imitate, mnemonic must be kept in private)

If this is a normal mnemonic account, and you get these 12 words, you can transfer all the assets from this account.

But hey, hey, hey, hey, hey, hey, hey, hey, hey, hey, hey!

This is of course because (I have no money) I opened the password account.

If you don't know my custom password, there's nothing you can do about it.

Unless, of course, you know the mnemonic above and managed to get my custom password out of my mouth: piepiezuishuai

Then you have access to the account's assets.


*BITHD password account function

What is the technical principle of the password account?

First, let's introduce the principle of common mnemonic account in vernacular Chinese. Twelve mnemonic words are also called seeds. We can calculate the private key and address of different currencies by hash operation and adjusting the parameters of different currencies according to the BIP protocol.

The password account works almost exactly like the mnemonic account, with the only change being to treat the 12 words + custom password as a seed and complete the calculation.

Another way to think about it, a common mnemonic account can actually be viewed as a "custom password account with an empty password."

Attach a piece of code, novice can ignore directly

Seed = 'one two three four five six seven eight nine ten eleven twelve'

M = BIP32Key fromEntropy (Mnemonic to_seed (seed))
Master_xprv = m.E xtendedKey (private = True, encoded = True)

M = m. hildKey(44 + BIP32_HARDEN)
M = m. hildKey(0 + BIP32_HARDEN)
M = m. hildKey(0 + BIP32_HARDEN)

M0 = m.C hildKey (0)
For x in xrange (20) :
T = m0. ChildKey (x)
Print 'Address: + t.A ddress ()
Print 'Private Key:' + t.WalletImportFormat()

(this is a few lines of Python code we wrote a few years ago when we were doing a science project. Anyone with a code base can understand it at a glance.)


How secure is a password account?

Password accounts are especially important in an age when you can't help but lose 12 unfamiliar words in your wallet.

Although all wallet dealers, industry kols are constantly carrying out science popularization: mnemonic must be offline storage, there will still be a lot of ignorant users, will be mnemonic accidentally saved on cloud disk, mailbox. The hacker can easily transfer the mnemonic assets after gaining access to his cloud disk email account. However, if you use a password account at this time, the hacker recovers your account and finds that there is no asset, you will have avoided a block.

Another example is if your mnemonic is copied out of a notebook and stored offline. But one day, when you not at home, Lao wang next door to my home (is simple mnemonic word to see you, you don't want to), he quietly and take away your mnemonic word pictures, after use wallet restoring mnemonic word, found no assets to the account, in addition to his may scold you off you will not have any () on the assets loss.

There is also a little skill, you after you enable password account, also can be in 12 mnemonic word corresponds to the ordinary account deposit a mnemonic word DiuDiuDe COINS, it can be disguised as "general account", but in fact it is for you to monitor the sentinel account ", if which day found above the ordinary account currency lost, then your mnemonic word leaked, you can change a mnemonic word, and then turn the large amount of assets in the account password to the new password in the account, foolproof. In this scheme, the sentry account can serve as an early warning of mnemonic security.

Enabled password after account, the ordinary word mnemonic account without password you can think of it as a "sentry account", that is to say, save a little money in it, if which day finds the money lost, then your mnemonic word leaked, you can change a mnemonic word, and then turn the password large assets in the account to a new account, to ensure safety. In this scheme, the sentry account can serve as an early warning of mnemonic security.

In short, silently save a good password, password account sling all garish attacks.

How to open a password account?

Connect the BITHD hardware wallet to BITHD APP and start the password account in BITHD Settings.

2. Never backup the mnemonic and password of your password account.

3, password account support 6-53 bits of password (Numbers, upper and lower case letters, some special characters) password Settings must not be too simple, of course, too complex may forget, this measure, I prefer to use piepiezuishuai this is easy to remember and can not forget the password.

4, at present, except for BITHD some wallet, such as Trezor support account password recovery behind us the entrance will be added in than high recovery and will open the mnemonic word + custom password account password into a common word mnemonic 】 tool, so all in special circumstances can faster recovery password of assets in the account.

5. Be sure to use the password account function in the open source wallet. BITHD is great. After understanding the principle of the account password, you should be able to understand why we always emphasize the "open source" is a precondition for hardware purse, because there are often some traditional manufacturers association to promote the concept of "security chip", but actually the password account has to be able to get a perfect physical attacks (that is, word mnemonic stolen), just for this instead of open source this premise, for hardware architecture wallet logically is said is not the past.

Source:weixin.qq.com

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia