im guessing by wallet your refering to an address genrated but never stored anywhere digital then typed in when needed?

and whats the private public key parts , sorry i know im dense

I would side with you at times on this Shinobi, but then you need to really step back and realize the lack of understanding of most things that people engage with on a daily basis.  You use VISA and pay your bill at the end of every month, but very very very few people understand the mechanics behind credit card transactions, payments via the ACH rails or anything else involved with day to day financial life in 2013.  Yet there are trillions of dollars spent each year by people typing in their passwords to online bank accounts and pull pieces of plastic out of their wallet that is representative of fiat money (which is a whole other rabbit hole altogether). 

I think there is something behind this, otherwise I wouldn't be wasting my time here. What will happen (and you can see it starting slowly) is that VC money, independent development and ingenuity with start to develop tools that will isolate the average end user from the complexity while still giving them the benefit fo the technology.  It has already begun with services like blockchain.info aggregating wallets and providing cloud based services.  It will eventually progress to hardware based tools (similar to the RSA key fob many people used to have at offices) and move on from there.  Long BTC public addresses will be replaced by alias services (how? I'm not sure, but they will) and people will slowly become accustomed to using this a method of money transport.  I could certainly be mistaken but it has attracted enough interest and has engaged enough people's aspirations that even if the current instance of BTC doesn't make it to prime-time, something similar will.

I once read that all it takes is for 10% of the population to be extremely excited about something (whether it be a fashion, technology, fad, etc) and it will become mainstream (given the average persons indifference and apathy).  While I don't think we're at the tipping point yet, the ideals behind this project is resonant enough with a population in turmoil to energize that portion of the population and turn this truly into a movement.

piuk, how are you generating keys for wallets? Is it possible it's not random enough and someone has just been able to find the keys by brute forcing the seed to your RNG? bitaddress.org uses mouse movements to add more randomness and it doesn't seem like you do something like that.

Easiest to implement would be XSS - just about every site seems to be vulnerable these days due to browsers and webapps sucking. I would look for that first.

Java is a giant POS - useless other than as an attack vector - even Macfags got 0wned via Java last year. I have no doubt there are hundreds of zero-days lurking...

If blockchain passwords are only SHA1-hashed, depending on the seed, if somebody got ahold of the DB passwords could be cracked using rainbow tables.

So, interesting development this morning.  I shut down the wallet I had with blockchain.info yesterday after it was potentially compromised and decided to just start with a fresh new wallet hosted there.  Very strong password, different identifier.  Java not installed on my machine and scanned for malware.

Received this this morning -- from blockchain.info notification:

Authorize log-in attempt
An attempt to login to your blockchain.info wallet was made from an unknown browser. Please confirm the following details are correct:
Time: 2013-04-27 07:17:42
IP Address: 77.109.138.42 (Switzerland)
User Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1. Gecko/20051111 Firefox/1.5
If the above details are correct please use the following login link:
https://blockchain.info/wallet/[blocked out for obvious reasons]
If this login attempt was made by you this email can be safely ignored however you may wish to change your wallet alias.

and this...

An attempt to login to your blockchain.info wallet was made from an unknown browser. Please confirm the following details are correct:
Time: 2013-04-27 08:38:09
IP Address: 5.9.121.38 (Germany)
User Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1. Gecko/20051111 Firefox/1.5
If the above details are correct please use the following login link:
https://blockchain.info/wallet/[blocked out for obvious reasons]
If this login attempt was made by you this email can be safely ignored however you may wish to change your wallet alias.

Apparently there is still some sort of malware out there attempting to hack the blockchain.info service.  Machine was clean when I set this new wallet up, only way I think they could've possibly found the address is through scanning potential aliases.  Admittedly, my alias is a plain word so possible they could've just tried brute force finding an alias that would lead them to identifier and tried to log in from there.  Otherwise, can't imagine how they would've gotten it.  Just a lead for PIUK to follow if he's interested in trying to button up security on the site.

that could be quite true. blockchain.info should monitor access/ip patterns to spot such attempts.

more importantly, i stronly suggest to enable two factor authentication. (and if you use email, think about the email security … gmail has 2FA too)

so you seem to think they are getting passwords and usernames and alot of people use the same on diff sites...!

I got this email too:

----
Authorize log-in attempt

An attempt to login to your blockchain.info wallet was made from an unknown browser. Please confirm the following details are correct:

Time: 2013-04-26 22:03:19
IP Address: 46.167.245.50 (Czech Republic)
User Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051111 Firefox/1.5

If the above details are correct please use the following login link:

https://blockchain.info/wallet/<removed>

If this login attempt was made by you this email can be safely ignored however you may wish to change your wallet alias.
----

I don't have any coins there, so good luck with that. However, I used a common word as the wallet identifier, as some other people here apparently did. I am guessing someone is blindly trying weak identifier/password combinations.

that wouldn't be the case with me though Jubalix - I used a unique alias and unique password on blockchain.info - couldn't have pulled it from anywhere else.

Update - after speaking some more with my affected customer I am no longer convinced his password was indeed strong enough.

Maybe passwords were brute-forced after all? silvereagle - just how strong was your password?

Will be happy to hear about any progress in figuring this out.