Let us make fixes on https://bitcoin.org/en/faq#what-are-the-advantages-of-bitcoin

What are the advantages of Bitcoin?

Payment freedom - It is possible to send and receive any amount of money instantly anywhere in the world at any time. No bank holidays. No borders. No imposed limits. Bitcoin allows its users to be in full control of their money.

Very low fees - Bitcoin payments are currently processed with either no fees or extremely small fees. Users may include fees with transactions to receive priority processing, which results in faster confirmation of transactions by the network. Additionally, merchant processors exist to assist merchants in processing transactions, converting bitcoins to fiat currency and depositing funds directly into merchants' bank accounts daily. As these services are based on Bitcoin, they can be offered for much lower fees than with PayPal or credit card networks.

Fewer risks for merchants - Bitcoin transactions are secure, irreversible, and do not contain customers’ sensitive or personal information. This protects merchants from losses caused by fraud or fraudulent chargebacks, and there is no need for PCI compliance. Merchants can easily expand to new markets where either credit cards are not available or fraud rates are unacceptably high. The net results are lower fees, larger markets, and fewer administrative costs.

Security and control - Bitcoin users are in full control of their transactions; it is impossible for merchants to force unwanted or unnoticed charges as can happen with other payment methods. Bitcoin payments can be made without personal information tied to the transaction. This offers strong protection against identity theft. Bitcoin users can also protect their money with backup and encryption.

Transparent and neutral - All information concerning the Bitcoin money supply itself is readily available on the block chain for anybody to verify and use in real-time. No individual or organization can control or manipulate the Bitcoin protocol because it is cryptographically secure. This allows the core of Bitcoin to be trusted for being completely neutral, transparent and predictable.

Exactly.  Blockchain.info != bitcoin.

@amaclin the problem that I see with all companies providing bitcoin services is that they introduce almost systemic risks in the bitcoin ecosystem. I mean, even when this is not a systemic issue, it is big enough to be an *almost* systemic issue. That is not good, sadly.

I do not understand. Sorry. I do not have expirience with js and different browsers.
What brunch do we use? 'Real Rand' case or Math.random? Why key.length is 0 and how does "% key.length" works? Division by zero?

This is brainfuck.

That's correct. Even though by specification NaN is Not-a-Number, that memory location (key[i % 0]) still holds some unknown value. So when modulo 256 ((key[1 % 0]) & 255) , it should return some number less than 256.

I just extracted the important parts from the javascript file.  I understood from zootreeves's the comment in the github that all this initialization/Math.rand stuff was unimportant as the missing initialization would prevent the rng_pool to be filled properly.  All I had to simulate was the prng (which is more or less the standard rc4 stream cipher).  So I first tried to get the numbers from the prng initialized with zeros.  When this didn't work out (actually I would have found some values using this code, but I only looked for one particular value), I tried variations of this, initializing it with an array of length 1.

I just looked in the stream produced by the prng for one particular k value that I broke earlier and that occurred several times on the block chain.  When this was successful I knew I had the right solution.

There were still some unknowns, e.g., there are two candidates for k.  First, I didn't check the JavaScript code if it really takes the bytes from the stream to build numbers, whether it is big or little-endian and so forth.  When the first try didn't succeed, I read most of the relevant JavaScript code to check my assumptions.  It took some time until I realized that I had to play with the initialization of the prng.

You misunderstand.  I didn't test it in a browser, I copied the JavaScript code and changed it into a Java program so that it would go through my Java compiler.  But JavaScript is standardized; the particular behavior with NaN and undefined should be handled by all compliant browser in the same way.

The k values are actually computed by my program that breaks keys with reused R values in signatures (also written in Java).  Computing the k value is an important step to get the private key.  It is only possible if R is reused, but I had enough reused R values that I knew at least some of the k values.  And I knew that the k value must haven been produced by the random number generator directly.

That there are two possible k values is because of the way ECDSA works.  They compute the point k*G, and take its x coordinate. This is the r value (Personally, I usually use R to denote k*G but when I say R value in this thread I refer to the x coordinate of R).   There are two points on the curve with the same x coordinate, namely  k*G and -k*G.  So there is no way to know the sign of k.

I used emacs The prng code is 30 lines.  It was trivial to resolve the few syntactic differences by hand.

Okay, I hope everybody closed the browser tab with the blockchain.info wallet that he opened 10 days ago. Because now everyone following this topic will implement his own rng cracker.

But a C++ program is a C program encrypted with a very strong encryption method.