It would be rather article 158 or freshly minted 159.6. But the Bitcoin should pass tests defined in article 128 of Civil Code first. When (and if) it will be deemed as some kind of property, the advances in tax planning art would be astounding!
In Russia class-action lawsuits are impossible, but individual litigation is too time-consuming and just not worth. 
Topic: Blockchain.info security [FUNDS STOLEN] - page 4. (Read 28216 times)
The only way I can see under Russian Federation laws to get to such third party is deriving private key from something protected by copyright. OK, IANAL and that's offtopic here.
According to Russian criminal code it seems to be fraud (article 159 applies to any property, not only fiat money).We need to know what system created the transactions that were linked above as reusing R values.
Do you mean that need to know what was hacker's system? 
I created this address in April 2013 with Google Chrome on Windows 7 64-bit.
We need to know what system created the transactions that were linked above as reusing R values.Though the sudden reports suggests to me that this was a product of recent bc.i code changes, not the browsers.
The only way I can see under Russian Federation laws to get to such third party is deriving private key from something protected by copyright. OK, IANAL and that's offtopic here.
According to Russian criminal code it seems to be fraud (article 159 applies to any property, not only fiat money). If you can 100% confirm the exact client software / platform / browser that generated this transaction, that would be helpful.
I created this address in April 2013 with Google Chrome on Windows 7 64-bit.P.S. This hacker stole 0.02 BTC again from the same address right after I received earnings from Anonymous Ads!
https://blockchain.info/tx/edf891400feba38339738910aeb40545a77e7c69ad9ff58ab208999df3d6db4f
There's only one address implicated in all the recent thefts so I'm not sure how useful releasing a scanner would be ... other than increasing competition for snatching funds from weak addresses.
I'm eager to refresh my math skills and play with modern cryptography a bit. Looks like RNGs are good target to try bit diffusion methods. But if such attempt will succeed, touching any weak address by myself would be both unethical and legally risky. And by publishing research results I'll shift all such problems to someone else 
Although your first point brings up a larger legal question ... if someone makes their private key public (intentionally or non-intentionally) ... under what conditions (if any) and under what legal theory could a 3rd party be liable for signing with it? Any lawyers out there?
The only way I can see under Russian Federation laws to get to such third party is deriving private key from something protected by copyright. OK, IANAL and that's offtopic here.
Another blockchain.info wallet here loss https://bitcointalksearch.org/topic/my-wallets-were-stolen-just-now-can-any-one-help-me-277601
I'm thinking of augmenting it so that it snatches weak funds immediately
The legal risk is too high.On the other hand, I thought about writing and releasing such scanner without touching funds myself and letting people to catch and sue each other. I see every bitcoin-related court case as a good thing that make adoption of Bitcoin by business easier.
There's only one address implicated in all the recent thefts so I'm not sure how useful releasing a scanner would be ... other than increasing competition for snatching funds from weak addresses.
Although your first point brings up a larger legal question ... if someone makes their private key public (intentionally or non-intentionally) ... under what conditions (if any) and under what legal theory could a 3rd party be liable for signing with it? Any lawyers out there?
FWIW, My logs show someone was complaining at one point a while back their new wallet under chrome had someone elses coin in it. They dropped out before I could extract useful information from them. May be related.
One thing that has long really frightened me about all these webwallets is that if they fail to read from the secure rng they just use some snake oil "randomness" (the mouse position) that has practically no entropy.
One thing that has long really frightened me about all these webwallets is that if they fail to read from the secure rng they just use some snake oil "randomness" (the mouse position) that has practically no entropy.
I'm thinking of augmenting it so that it snatches weak funds immediately
The legal risk is too high.On the other hand, I thought about writing and releasing such scanner without touching funds myself and letting people to catch and sue each other. I see every bitcoin-related court case as a good thing that make adoption of Bitcoin by business easier.
However, at this point I'm thinking of augmenting it so that it snatches weak funds immediately so I can return funds to peeps who are able to prove ownership of the victim address by signing a message with a bunch of keys with a 1-degree relationship to that address.
I'd suggest just requiring the signature of the key itself, plus verifying a name/address.Then share the name/address with others signing for it and let the legit party sue the fraudulent claimee(s) in court.
Your transaction with the repeated signature R values is this one:
https://blockchain.info/tx/e05d98ee17d4610eb4e63cf27dd4e63f7128dc28187ae73588ca5562d9391bb8
Inputs 0 and 2 specifically. If you can 100% confirm the exact client software / platform / browser that generated this transaction, that would be helpful.
The 'k' value was 0x7f561ff2d0a848480f575773dd8b72f17cabc9f202951d9c7392b331b0565f28
I have a tool that can find these things and solve for the private keys but it's a total kludge and I don't use it to snatch funds nor run it on a rolling basis. However, at this point I'm thinking of augmenting it so that it snatches weak funds immediately so I can return funds to peeps who are able to prove ownership of the victim address by signing a message with a bunch of keys with a 1-degree relationship to that address.
... since the guy currently exploiting this at the moment https://blockchain.info/address/1HKywxiL4JziqXrzLKhmB6a74ma6kxbSDj is just cleaning em up and I'm not holding out hope he has plans to return anything.
https://blockchain.info/tx/e05d98ee17d4610eb4e63cf27dd4e63f7128dc28187ae73588ca5562d9391bb8
Inputs 0 and 2 specifically. If you can 100% confirm the exact client software / platform / browser that generated this transaction, that would be helpful.
The 'k' value was 0x7f561ff2d0a848480f575773dd8b72f17cabc9f202951d9c7392b331b0565f28
I have a tool that can find these things and solve for the private keys but it's a total kludge and I don't use it to snatch funds nor run it on a rolling basis. However, at this point I'm thinking of augmenting it so that it snatches weak funds immediately so I can return funds to peeps who are able to prove ownership of the victim address by signing a message with a bunch of keys with a 1-degree relationship to that address.
... since the guy currently exploiting this at the moment https://blockchain.info/address/1HKywxiL4JziqXrzLKhmB6a74ma6kxbSDj is just cleaning em up and I'm not holding out hope he has plans to return anything.
Were any of the keys imported / brainwallets / or vanity?
No one address was ever imported. All generated into the browser (mostly Chrome, few times Firefox).
We need the tool that scans for re-used R values.
Were any of the keys imported / brainwallets / or vanity?
Same address, are you sure that you never used wallet on android cell?
I mean same identifier etc.
Newer used on Android. Only on Windows 7 and few times on Linux Mint.I mean same identifier etc.
P.S. Does it mean that all Blockchain.info addresses are vulnerable and funds from them could be stolen at any time?
https://bitcointalksearch.org/topic/m.2907468
Same address, are you sure that you never used wallet on android cell?
I mean same identifier etc.
Same address, are you sure that you never used wallet on android cell?
I mean same identifier etc.
I used Blockchain.info online wallet for small transactions on my Windows 7 64-bit PC with strong password kept in KeePass.
Today I noticed that about 1.8 BTC was stolen from one of the addresses (which used for Anonymous Ads earnings), but funds from other addresses in this wallet were not affected.
This leads me on thoughts that Blockchain.info or Firefox may have some weakness in random number generator like the vulnerability was recently found in the Android.
TXID with my funds gone: https://blockchain.info/tx/975412ecc21a0ad949deba3f47c6ac41e42fb7bd3f7eeb36cc071f151003d8c9
Today I noticed that about 1.8 BTC was stolen from one of the addresses (which used for Anonymous Ads earnings), but funds from other addresses in this wallet were not affected.
This leads me on thoughts that Blockchain.info or Firefox may have some weakness in random number generator like the vulnerability was recently found in the Android.
TXID with my funds gone: https://blockchain.info/tx/975412ecc21a0ad949deba3f47c6ac41e42fb7bd3f7eeb36cc071f151003d8c9
Jump to: