Bitcointalk Mobile Browser presented by IRLBTC™

<< >> (p.4)

Author

Topic: Reused R values again (Read 121712 times)

gully

Newbie

Offline

Activity: 43
Merit: 0

Re: Reused R values again

December 08, 2014, 11:31:39 PM

#61

http://www.reddit.com/r/Bitcoin/comments/2oonu2/well_i_was_part_of_the_00002/
This is my thread, I can confirm that and I can confirm that the BTC address is mine also.
Please PM me. I lost $650 that I was saving up for a car. I am only 17 man, I really need this money.
https://blockchain.info/address/1NDmX336zK4ntTLDqbpK9dWk8qNB81z2Q6

itod

Legendary

Offline

Activity: 1988
Merit: 1077

Honey badger just does not care

Re: Reused R values again

December 09, 2014, 12:03:46 AM

#62

Quote from: mizzle on December 08, 2014, 09:53:33 PM

I don't think that he is a good samaritan unless he eventually gives me the coins he stole back. I also sent an email to blockchain so hopefully I can get refunded or something...this is retarded.

Here's the explanation how to sign the message, it's for two wallets but the procedure is pretty much the same for all other wallets:

http://support.bitcoin.cz/Knowledgebase/Article/View/36/0/how-to-sign-a-message-using-a-bitcoin-client

Just sign the message to prove you are not trying to steal somebody else's coins, and PM that signature to johoe, he promised to return the coins to their rightful owners. IMHO it is very honorable thing if he fulfills the promise, if he haven't collected the coins a real thief could have done it and you would never see your coins back.

TheRealSteve

Hero Member

Offline

Activity: 686
Merit: 503

FUN > ROI

Re: Reused R values again

December 09, 2014, 12:06:37 AM

#63

Quote from: itod on December 09, 2014, 12:03:46 AM

Here's the explanation how to sign the message

Just to note:

Quote from: johoe on December 08, 2014, 11:18:08 AM

If you can convince me that they belong to you (signing a message with the address is obviously not enough; the private key is already known), I will send the funds back.

[ StickMiners - Where FUN > ROI ] [ iMiner miner-in-a-USB-stick teardown ]
[ temperature-based throttling of CPU processes ] [ Building cgminer, Win+MinGW ]

Remember remember the 5th of November

Legendary

Offline

Activity: 1862
Merit: 1018

Reverse engineer from time to time

Re: Reused R values again

December 09, 2014, 12:15:04 AM

#64

Quote from: TheRealSteve on December 09, 2014, 12:06:37 AM

Quote from: itod on December 09, 2014, 12:03:46 AM

Here's the explanation how to sign the message

Just to note:

Quote from: johoe on December 08, 2014, 11:18:08 AM

If you can convince me that they belong to you (signing a message with the address is obviously not enough; the private key is already known), I will send the funds back.

Just sign the previous address from which the funds were transferred from(their outputs)

BTC:1AiCRMxgf1ptVQwx6hDuKMu4f7F27QmJC2

itod

Legendary

Offline

Activity: 1988
Merit: 1077

Honey badger just does not care

Re: Reused R values again

December 09, 2014, 12:17:30 AM

#65

Quote from: Remember remember the 5th of November on December 09, 2014, 12:15:04 AM

Quote from: TheRealSteve on December 09, 2014, 12:06:37 AM

Quote from: itod on December 09, 2014, 12:03:46 AM

Here's the explanation how to sign the message

Just to note:

Quote from: johoe on December 08, 2014, 11:18:08 AM

If you can convince me that they belong to you (signing a message with the address is obviously not enough; the private key is already known), I will send the funds back.

Just sign the previous address from which the funds were transferred from(their outputs)

Good idea. This is definitely proof the coins are yours, no question about it.

TheRealSteve

Hero Member

Offline

Activity: 686
Merit: 503

FUN > ROI

Re: Reused R values again

December 09, 2014, 12:28:41 AM

#66

Quote from: Remember remember the 5th of November on December 09, 2014, 12:20:23 AM

The only problem is people who might have sent the original owner these coins might attempt to scam by pretending to be him.

Well, that's not the only problem. Signing a message with the key associated with the address the funds were sent from - and this would of course have to be an unaffected address as well - does work well... if you can do so. If you are not the owner of that address - e.g. you purchased Bitcoin from a service, you're mining at a pool, any case where the coins were sent to you by a third party - you would be SOL, at least as far as this approach goes.

In the mean time, it looks like blockchain.info is intending to make affected people whole again. Perhaps some people will effectively double their returns as a result Wink

[ StickMiners - Where FUN > ROI ] [ iMiner miner-in-a-USB-stick teardown ]
[ temperature-based throttling of CPU processes ] [ Building cgminer, Win+MinGW ]

migovision

Newbie

Offline

Activity: 1
Merit: 0

Re: Reused R values again

December 09, 2014, 02:16:06 AM

#67

Quote from: JorgeStolfi on December 08, 2014, 10:05:51 PM

Here is one BCI user who claims to have lost 99 BTC which were not moved to the Good Samaritan's address:

http://www.reddit.com/r/Bitcoin/comments/2oo72b/victim_100_bitcoins_stolen_from_blockchaininfo/

The destination address got two other inputs; perhaps other ursers?
https://blockchain.info/address/1M77fUCzQrmY8jHRRgpzDVPAK5eQ31bwxZ

I am the other user with the adress 1LDpUmrwVKSFyXy2czE423dH8yd4K9R9WW. If the user with the 99BTC will read this. pls write me a messeage.

molecular

Donator
Legendary

Offline

Activity: 2800
Merit: 1023

Re: Reused R values again

December 09, 2014, 07:20:24 AM

#68

Can someone point me to the actual commit that introduced this bug?

PGP key molecular F9B70769 fingerprint 9CDD C0D3 20F8 279F 6BE0 3F39 FC49 2362 F9B7 0769

sunkawakan

Newbie

Offline

Activity: 1
Merit: 0

Re: Reused R values again

December 09, 2014, 07:42:17 AM

#69

Quote from: molecular on December 09, 2014, 07:20:24 AM

Can someone point me to the actual commit that introduced this bug?

"Improvments to RNG":
https://github.com/blockchain/My-Wallet/commit/98d5a7ca59ef04d06ac6aee468634b12975a0f5c

JorgeStolfi

Hero Member

Offline

Activity: 910
Merit: 1003

Re: Reused R values again

December 09, 2014, 08:07:50 AM

#70

Quote from: sunkawakan on December 09, 2014, 07:42:17 AM

Quote from: molecular on December 09, 2014, 07:20:24 AM

Can someone point me to the actual commit that introduced this bug?

"Improvments to RNG":
https://github.com/blockchain/My-Wallet/commit/98d5a7ca59ef04d06ac6aee468634b12975a0f5c

I suppose that they generated one number with the new code, and it looked random allright. Tongue

Academic interest in bitcoin only. Not owner, not trader, very skeptical of its longterm success.

johoe (OP)

Full Member

Offline

Activity: 217
Merit: 295

Re: Reused R values again

December 09, 2014, 10:56:09 AM

#71

I just want to say that I contacted the blockchain.info support, but I haven't heard back from them, yet.

To avoid double reimbursement, I want coordinate this with the blockchain.info people. They should, hopefully, be able to check whether claims are valid or not. If you lost funds due to this bug, contact the blockchain support, not me. I cannot answer all PMs regarding this problem.

Donations to 1CF62UFWXiKqFUmgQMUby9DpEW5LXjypU3

cr1776

Legendary

Offline

Activity: 4533
Merit: 1358

Re: Reused R values again

December 09, 2014, 11:13:08 AM

#72

Quote from: johoe on December 09, 2014, 10:56:09 AM

Just remember, no good deed goes unpunished. Perhaps this should be in a new thread too.

yakuza699

Hero Member

Offline

Activity: 935
Merit: 1013

Re: Reused R values again

December 09, 2014, 01:00:59 PM

#73

Most of the coins were saved (216BTC) the remeaning ones went to this address https://blockchain.info/address/1xyWYGDStMKVmNH4hivbfhJZa5xWFVWfd

▄▄▄▄▄▄▄▄
▄▄▄▄▄▄
▄▄▄▄
▄▄

【BTC】 BitDice.me

Simple and Fast 1% Dice
Invest - Play - Join The Family

JorgeStolfi

Hero Member

Offline

Activity: 910
Merit: 1003

Re: Reused R values again

December 09, 2014, 01:41:07 PM

#74

Quote from: yakuza699 on December 09, 2014, 01:00:59 PM

Most of the coins were saved (216BTC) the remeaning ones went to this address https://blockchain.info/address/1xyWYGDStMKVmNH4hivbfhJZa5xWFVWfd

Someone claimed to have lost 99 BTC
http://www.reddit.com/r/Bitcoin/comments/2oo72b/victim_100_bitcoins_stolen_from_blockchaininfo/

They ended up here:
https://blockchain.info/address/18MFgZkAqcBLJcQof81xLFzAQ4r4XLS6sn

Only a tiny amount from them ended up at https://blockchain.info/address/1xyWYGDStMKVmNH4hivbfhJZa5xWFVWfd

Academic interest in bitcoin only. Not owner, not trader, very skeptical of its longterm success.

flipperfish

Sr. Member

Offline

Activity: 350
Merit: 251

Dolphie Selfie

Re: Reused R values again

December 09, 2014, 07:10:21 PM

#75

Quote from: sunkawakan on December 09, 2014, 07:42:17 AM

Quote from: molecular on December 09, 2014, 07:20:24 AM

Can someone point me to the actual commit that introduced this bug?

"Improvments to RNG":
https://github.com/blockchain/My-Wallet/commit/98d5a7ca59ef04d06ac6aee468634b12975a0f5c

Is it the unconditional use of Math.random() after the use of the Crypto API (if available), that lead to the bug? Or is there some other problem, I don't see?
Why isn't there a fixing commit, yet?

Initscri

Hero Member

Offline

Activity: 1582
Merit: 760

Re: Reused R values again

December 09, 2014, 08:59:07 PM

#76

Quote from: johoe on December 09, 2014, 10:56:09 AM

In my support ticket with them, I mentioned you. Hopefully this may elevateescalate the priority.

----------------------------------
Web Developer. PM for details.
----------------------------------

itod

Legendary

Offline

Activity: 1988
Merit: 1077

Honey badger just does not care

Re: Reused R values again

December 10, 2014, 12:46:33 AM

#77

Quote from: flipperfish on December 09, 2014, 07:10:21 PM

Quote from: sunkawakan on December 09, 2014, 07:42:17 AM

Quote from: molecular on December 09, 2014, 07:20:24 AM

Can someone point me to the actual commit that introduced this bug?

"Improvments to RNG":
https://github.com/blockchain/My-Wallet/commit/98d5a7ca59ef04d06ac6aee468634b12975a0f5c

Is it the unconditional use of Math.random() after the use of the Crypto API (if available), that lead to the bug? Or is there some other problem, I don't see?
Why isn't there a fixing commit, yet?

zootreeves added a note an hour ago:

Quote

For those interested. The bug was caused by missing line 29 and not initialising rng_pptr to 0. This commit was force pushed over.

johoe (OP)

Full Member

Offline

Activity: 217
Merit: 295

Re: Reused R values again

December 10, 2014, 12:57:10 AM

Merited by Welsh (30), Vod (20), redsn0w (15), suchmoon (4), LoyceV (4), Woshib (3), Cyrus (2), o_e_l_e_o (2)

#78

The money has been returned to blockchain.info. Please write to blockchain support to claim refund.

Quote

From: Ben Reeves <...@blockchain.info>
If you could return the funds to address 15tXHJCjehqCEL6zRCkGwvuDY6YzZV5sKP that would be fantastic.

I should also add if that using our admin tools, if users supply us with the correct wallet information, we are able to accurately determine which refund claims are valid and which are not. So far we have processed over 30 refund requests and will be processing more over the rest of this week.

https://blockchain.info/tx/ea8fa447d59000843910932a42bf7a28915772d97a006e97714d026b78885754

Donations to 1CF62UFWXiKqFUmgQMUby9DpEW5LXjypU3

theymos

Administrator
Legendary

Offline

Activity: 5698
Merit: 14623

Re: Reused R values again

December 10, 2014, 01:14:15 AM

#79

Quote from: johoe on December 10, 2014, 12:57:10 AM

The money has been returned to blockchain.info. Please write to blockchain support to claim refund.

That's very ethical of you. I hope they gave you a substantial reward.

1NXYoJ5xU91Jp83XfVMHwwTUyZFK64BoAD

BruceFenton

Sr. Member

Offline

Activity: 404
Merit: 250

Re: Reused R values again

December 10, 2014, 02:04:08 AM

#80

Quote from: johoe on December 10, 2014, 12:57:10 AM

The money has been returned to blockchain.info. Please write to blockchain support to claim refund.

Quote

From: Ben Reeves <...@blockchain.info>
If you could return the funds to address 15tXHJCjehqCEL6zRCkGwvuDY6YzZV5sKP that would be fantastic.

The return address is SINGLE SIG??!? C'mon guys.

I absolutely love Blockchain -- but there is not a great excuse to not use multi signin this of all transactions.

Pages: « 1 2 3 [4] 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 » All

Page 3

Viewing Page: 4