<p>As a rule of thumb, don't give an attacker any more information than you have to. I would say that you should use your normal username; put the effort of remembering an odd username into remembering a better password.</p>

<blockquote>
  <p>How are the wallet name and passphrase even used in the system? Will someone give me his Wallet name, so I will be able to transfer money to him?</p>
</blockquote>

<p>Nope. The username + password is used to look up a wallet file from something called a <a href="https://github.com/rippleFoundation/Blob-Vault" rel="nofollow">'blob vault'</a>. That blob vault contains your private key and your addressbook.</p>

CC BY-SA 3.0
2013-06-01T08:43:17.530Z
More specifically the blob vault never sees either your username or your passphrase but only a cryptographic hash of them combined. This has been discussed a bunch on the [Ripple forums](https://ripple.com/forum).
dchapes
CC BY-SA 3.0
2013-06-01T09:11:35.027Z
@dchapes Ah. So if making your username 5 times harder to guess is as difficult as making your password 5 times harder to guess, then it doesn't matter which one you do?
Nick ODell
CC BY-SA 3.0
2013-06-01T21:28:23.850Z
The only concern would be if I had a wallet named "dchapes" and you knew that then you could attempt to guess my pass phrase by generating the hash(username+passphrase) locally and querying the blob vault repeatedly. Using something like "dchapes.blah" would make it marginally harder; but yeah, just use a strong passphrase and it shouldn't matter.
dchapes
CC BY-SA 3.0
2013-06-01T08:04:59.163Z
2013-06-01T08:04:59.163Z
Nick ODell
<p>If I'm reading the website right, it's saying that both Wallet passphrase <em>and</em> name should be kept private.</p>

<p>I now have a conundrum of which name to choose. Should I put my default username (public, well-known by those who know me), or should I put something that is hard to guess (like a password)?</p>

<p>How are the wallet name and passphrase even used in the system? Will someone give me his Wallet name, so I will be able to transfer money to him?</p>

<ripple>
Ripple wallet name?
Howie
# Ripple wallet name?

(Asked by: username_0 on 2013-06-01)

If I'm reading the website right, it's saying that both Wallet passphrase *and* name should be kept private.

I now have a conundrum of which name to choose. Should I put my default username (public, well-known by those who know me), or should I put something that is hard to guess (like a password)?

How are the wallet name and passphrase even used in the system? Will someone give me his Wallet name, so I will be able to transfer money to him?

**Tags:** ripple


---

## 1 answers

### Answer by username_1 on 2013-06-01. Score: 3 | Accepted answer

As a rule of thumb, don't give an attacker any more information than you have to. I would say that you should use your normal username; put the effort of remembering an odd username into remembering a better password.

> How are the wallet name and passphrase even used in the system? Will someone give me his Wallet name, so I will be able to transfer money to him?

Nope. The username + password is used to look up a wallet file from something called a ['blob vault'](https://github.com/rippleFoundation/Blob-Vault). That blob vault contains your private key and your addressbook.

> **Comments:**
> **username_2**: More specifically the blob vault never sees either your username or your passphrase but only a cryptographic hash of them combined. This has been discussed a bunch on the [Ripple forums](https://ripple.com/forum).  
> **username_1**: @username_2 Ah. So if making your username 5 times harder to guess is as difficult as making your password 5 times harder to guess, then it doesn't matter which one you do?  
> **username_2**: The only concern would be if I had a wallet named "username_2" and you knew that then you could attempt to guess my pass phrase by generating the hash(username+passphrase) locally and querying the blob vault repeatedly. Using something like "username_2.blah" would make it marginally harder; but yeah, just use a strong passphrase and it shouldn't matter.  

---

