Bitcoin Forum

Mod note: there are reports of people getting their BTC stolen from addresses generated using this service, use at your own risk.

---

THE MOD IS CORRECT WE HAVE BEEN HACKED.

Someone accessed the site on the 31st Dec 2013. Any address before that date are 100% OK.

They changed the javascript in the calckey page that ran on your browser to after it calced the private key to send it direct from your browser to their server. Address is listed in comment below. If you used bitaddress.org to calc you key you are OK.

We will be paying out refunds this weekend to addresses bought for over 0.005. Cost of addresses below that we will donate to BTC Foundation the amount as else too many small payments to be made.
Sent - 7a8e2458b230d346c14435de8e11578f3abf022607f189dbf9f488334abd56d7

---

---

So you fancy a bitcoin address like 1MyName62WiL6W2Qoj9AE1cerfCHRaUW4x ?

And you want it to be 100% secure (i.e. no-one else knows your private key).

Now this is all possible using our new service at:
https://bitcoinvanity.appspot.com
without having to install any software.

Just enter your desired address prefix (in the above example it would be 1MyName), and the site will calculate if this is a free address or one you have to pay for (the example is just 0.004BTC but most shorter ones are FREE).

The site will then in your browser create a new keypair. You need to keep the private key safe.

Then the address will be searched for automatically (once you have made a payment if required).

When the address is found you then generate the private key to import into your Wallet using a javascript web page where all the data is kept in your browser.

Features:

• Short addresses are FREE (e.g. 1Nibor is free)
• Your address is 100% secure
• Nothing to install
• If the private key imports and you can see the address in Wallet you are 100% sure it is working
• Checks if FirstBits for this address is available
• Instant searching for low value address (6 confirmation for ones over 1BTC)

Additional information is available on the Help page of the site.


Enjoy...

This is now out of Beta, and we have a reasonable amount of power so can generate addresses for you in a reasonable time frame.

nice work. i have vanitygen myself, but for non-CLI users this is just right.

maybe convert the keys to readable format instead of hex.

This service looks very promising.
Touch up the page design a little bit, and you'll be successful in no time.

Dude :D This was crazy fast ^_^ Good luck in the future. (I just don't like lagging out my CPU on my own computer. definitely worth 0.1BTC :3)

One suggestion, allow case insensitive searches. Easier on you, cheaper for us :)

Works great ;)
These services are greatly missed in Bitcoin community.
Agreed with b!z.. enhance the UI and you'll be successful very soon.

given enough demand i`m sure nibor will make the site pretty :)

I'm impressed at the speed it matches though. I got a match for a 6 character case sensitive string in less than 10 minutes.

Hah I was wondering how people did that. Nice, thanks!

Well you can do it for free with VanityGen (https://bitcointalk.org/index.php?topic=25804.0) if you don't mind using up processing power on your own computer. (With a CPU, it's dog slow, so I recommend this site unless you have a  GPU. I only manage to pull about 800k addresses a second, while some manage to pull millions.)

Has anyone had any issues?
I can see that there are between 5-10 addresses created a day, but few paid for ones :(.

Any constructive feedback welcome.

vanitypool is less userfriendly but costs less for people looking for multiple addresses. You may be able to use it as a backend for your service and profit both from the added mining power and cost reduction when offering lookups for multiple addresses.

To the OP, are you planning on adding any new changes to the website?

This has been one of my most favorite Bitcoin services for a long time.

No, I spent my time adding a patch to the bitcoin client to make it easier to import a private key.
But the developers were fine with the code but did not like the principle!
See: https://github.com/bitcoin/bitcoin/pull/2050

Most people want it:
https://bitcointalk.org/index.php?topic=129212.0

Maybe add a case insensitive option to lessen work, and therefore enable cheaper addresses.

Is this still a thing? E-mail sent through contact form a few days ago still unanswered and the statuses are showing unpaid, but they have been. Just trying to figure out if I'm being too impatient or if something is messed up...

There's an alternative (a pool) running (I mine on it and just created an address yesterday for one of its customers): https://vanitypool.appspot.com/.

It's cheaper (and the recommended fees are even a bit overvalued: my miners don't pickup work from this pool unless it's more profitable than mining Bitcoin or Litecoin. With the current mining market conditions, they work on 7 char address prefixes (including leading 1) if they are paid 0.05BTC or more. Bitcoinvanity asks 0.84BTC for the same service...

If you look for several addresses using the same public key you will make it even more profitable for miners to work on them and could lower your fee a bit for each address.

Just updated with a 75% price reduction.

1A34567 costs just  0.004BTC which is a lot less than the 0.05BTC quoted above!

And we have miners that will work on your prefix instantly.


PS - we were using bitcoin247 and they seem to be having issues so have switch to another provider.

I should probably report that nibor squared everything away shortly after his last post above. I received the addresses and did not have to pay again.

And then immediately after, the price dropped to where what I paid for 2 addresses could now get me 25 lol. I decided to do one more just for the heck of it. Payment was accepted automatically and quickly and I received the address quickly as well. It appears everything has been fixed.

With the new pricing, it's a good service if you don't want to generate your own and/or have the computational ability to do so very quickly.

I just made one for free, maybe if I found it useful I will take a paid one. Thanks for the service.

This is a great service. Special thanks and kudos to you guys....

Just got my name for free Thanks!

If the review from the other post you made checks out I will think of something more creative and pay a fair price for it.

https://bitcointalk.org/index.php?topic=119340.0

Changing my sig line now...

1DrewuSwLUQtboJi4XvnBgXXvxa8Zjfj1c

Very easy to use, great service.

Shall be using it again.

Where can I create a vanity paper wallet?

How long is this expected to take ?   Paid 0.2 btc for an address, what kind of hashrate is dedicated to this effort ?

At the moment a 0.2BTC address takes on AVERAGE 15 hours.
But it can take 3 times that on rare occasions.

Also if we have a "rush" it can take longer but 15 hours is normal.

Thanks for the precision,  it ended up taking about two days.

Just reduced price another 20%.

SCAM ALERT !!!

NIBOR using https://bitcoinvanity.appspot.com to steal BTC

read here:
https://bitcointalk.org/index.php?topic=278769.0

Nibor, can you address these accusations?

Any updates on this?

The Vanitygen code is here: - https://github.com/samr7/vanitygen - this looks pretty easy to do so why go to an outside and pay .20 BTC - at the going price of BTC that's a pretty penny-(BTC)   

This was addressed here:
https://bitcointalk.org/index.php?topic=278769.msg3007827#msg3007827

We are currently looking for miners as have a 4BTC backlog!

We pay equivalent yo 1.2 million difficulty.

https://bitcoinvanity.appspot.com/sp/minerhelp

We are now searching at 150 million addresses per second!

Will take about 1 hour for each 0.1 BTC spent.

e.g. 10 BTC address will take about 3-4 days.

Can you help me limit the speed ?
It decimates my PC usage.

I'm trying to help mine for addresses, but it just tells me that there is "no work" even though there are "new/unpaid" entries on the stats page.

Here is an example output:

Know if I'm doing something wrong and it should be working or if it's currently not accepting workers?

Thanks! :)

Service not working ?

Is the pricing still correct, considering the recent "bubble"?

I checked this summer to generate one (forgot about it), and the price in BTC is still the same now.
It does NOT become more difficult to "mine" adresses, however, the return on GPU mining is going down... So it would be logical to lower the fees.
I would be happy to pay 0.02 BTC, but not the proposed 0.107 BTC for "1DnaLeor"...

Would like to get some others peoples opinion of this vanity gen website after myself and others had bitcoins stolen.

Please read https://bitcointalk.org/index.php?topic=445764.0

In nutshell, vanitygen used and address imported into an online wallet secured with email/2FA but bitcoins disappeared.  Would love to hear from nibor but his last post at the end of December kind of clinches it for me:

"Currently off-line due to hack - no bets lost though. Will update later."

Im assuming the hack has compromised the vanitygen as well.

If I am wrong then I hold my hands up and apologise but at a total loss to explain how someone accessed my online wallet

I just lost 2.3 Bitcoin I had stored on an address generated with this service.

Edit: I don't know why this didn't pop up when I initially researched the site. Just lost 2.3+ BTC today to this site.

I made a reddit post on this topic.

You can upvote it here if you're so inclined: http://www.reddit.com/r/Bitcoin/comments/1y7upu/bitcoinvanityappspotcom_is_not_secure_and/

Here's the blow by blow:

Oh the blessings and curses of irreversible transactions. I'll be honest - this one stings a bit.
I have some pretty damning circumstantial evidence that bitcoinvanity.appspot.com is skimming the private keys of their users, and transferring away Bitcoin from those who create addresses on their service.
Here's the sequence of events:
1) Over the weekend, I decided I wanted to create some vanity BTC addresses for myself and family (because, hey, if those 1Enjoy 1Sochi bitspammers get one, why not me?).
2) Of the several addresses I created, on of them was a goof account (1FartsVaXCqT8MAJxAjTwrfz3UAXqVKbCh).
3) I imported the vanity addresses into my hot-wallet on Blockchain.info.
4) I swept an old, non-vanity address where I kept change from purchases into the new vanity address
5) I messaged a buddy of mine, joking that I was going to bitspam the world with 1Enjoy 1Farts, and showed him the address.
6) He replied back "Whoa, looks like there was once 2.36244159 BTC in there."
7) As soon as I see it, my stomach sinks, because that BTC should not be in the past tense.
8) I log into Blockchain.info, and notice that the BTC is 8 confirmations away from a wallet address I control, having been transferred to 1JMPsVyyCrLt8xRSiBypG6JKawsUVTGjKy.
I rang up my aforementioned buddy (a BTC veteran) diagnosed the possibilities:
1) My blockchain.info account has been compromised. I determine this to be unlikely, since only the contents of that vanity address have been swept, not the entire wallet.
2) Blockchain.info may have erroneously swept the address into another holding address. That's possible, since it says the transfer occurred on a BCI IP adress.
3) The vanity address generator I used (https://bitcoinvanity.appspot.com) has been compromised. I haven't seen anything on the web indicating that, but it's the most likely thing, since it's the only address that's been compromised in my wallet. I'm 100% certain my traffic wasn't packet-sniffed since I created the vanity address on my home network, which is highly-engineered and secured by me. I'm on a Chromebook that I regularly check for malware, so I'm not being keylogged. The only vulnerability is the obvious one: the service.
I'm hoping and praying, at this point, that it's #2, and BCI can fix it, but I know that I've been scammed, and it was stupid to put a non-trivial amount of BTC into a newly created address that's possibly insecure... I know in the pit of my stomach that it's #3.
I ping a few people I know that can fast track my ticket at BCI, and get directly in touch with Mandrik of Blockchain.info, who was very apologetic as he confirmed what I suspected.
He pointed me to a discussion I'd missed in my research on the vanity address service that described what had happened to me. I noted that the transaction showed that it was relayed by BCI, but as I suspected and he confirmed, that meant very little:
"There really isn't anything we can do if the funds really were stolen, whether the transaction was relayed by us or not. Anyone can relay a transaction through our site, but they could just as easily do it from any other wallet app. They could easily import any private key across multiple wallets if they wanted to, too. If these funds were stolen, then they are essentially gone forever. The only person who can return them is the one who has access to the key the funds were sent to."
At some point, I'll probably pursue some legal action against this company (there is a British corporation listed, according to a friend I was just on the phone with). I haven't had the time to contemplate or investigate my options - this all happened over the last couple of hours.
Here's the lessons to take away from this one:
1) Don't trust third-party services (free or paid) with non-trivial amounts of coin unless they have a seriously impeccable reputation.
2) Blockchain.info customer service is pretty bad-ass, but they're not miracle workers. Irreversible transactions are irreversible.
3) If you're using a third-party service where you're risking non-trivial amounts of money, and you have a seed of doubt, either conclusively quash that seed through research, or don't use them.

Tip me? 1LpLLDP1hMp34eDQXSS6yFj9FVtsJ83WWA

Thanks for your information...
i request an address from bitcoinvanity too.... i pay the total amount but until now never get the private key....

I am very lucky i eventually created my vanity addresses by myselsf. The service was too expensive or 7 letters.

Thanks or the warning, sorry for your loss.
I tipped you a milli :)

Consider yourself lucky.

Thanks chief. Very much appreciated. :)

confirmed scam... nibor u are scum lol... good thing I only had 0.1 btc on it... some of the other people clearly had more
https://blockchain.info/tx/9e95fd443621d3d9fc150f290144401feb1627573c9161beb08edb472069a819

I see you decided to steal all the Bitcoin in the end.

We think we have been hacked. But currently have no idea what is going on.

Will post updates when we understand what happened.

Very sorry for this update. All our funds have been taken too.

If you used your own Public/Private key you should be safe as we know of no way that it would be possible to get you coins. However if as we suspect our site was compromised and they uploaded bogus code they could have found keys of addresses that used the browser generated keys.

We have found hack. They hacked the calckey page and posted keys to:
http://192.241.136.248

So if you calculated you private key using bitaddress.org like suggested in the help page you should to the best of our knowledge be OK.

But if you calc'd the private key using our calckey page they KNOW your private key (we do not though).

Looking at the date on the file they did it on the 31st Dec 2013.

We are still investigating.

We have decided to shut the site down as only ran it for fun - and now it is no fun!

Well tnx guys rely i paid for addy and u guys did not even checked code for 3 months rely ? 
Anyways i lost all coins i had , coz they all been stored on that address 0.4 btc i worked 2 months for. Rely tnx guys.

If you downloaded the source of bitaddress.org from GitHub to generate your vanity key in conjunction with bitcoinvanity.appspot.com, it should be safer than not.

We have emailed all users who we had an address for to mitigate any damage as much as we can.

What information did you want us to post here to get refunded?

Thank you,
perogi.

Well yes i got email. And if u guys rely going to even try to refund, that is for respect . And i take back all i said about u guys scamming. Will delete that post till further notice.

How do i request refund ?

My addy that i been taken 0.4 btc from is : 1microLtvk1LzFzdbBeoWz9pBfXkP26yJ
Tx: https://blockchain.info/tx/9e95fd443621d3d9fc150f290144401feb1627573c9161beb08edb472069a819

Is that enough ?

Ah well and my address where refund should go : 1GyDQ3npFsa72Ute6bXm3wen7U1GEFfpF4

I did not expect this from u guys if u pull this off will be rely amazing. Tnx.


Wait wait wait, do they mean we only get refund what we paid for address to be made or what we are stolen ???

1DankFtSthZdyTqsuCt4cHpYEyGj8ymUH4  i lost almost .08 from being hacked

Just to be clear I mean we will refund cost of Addresses as they are now useless if you used the calckey page.

If this is true, my adress was:
1BREDYpxyYZbFRxgYD8Bo92TNqqNH6N7pB (https://blockchain.info/address/1BREDYpxyYZbFRxgYD8Bo92TNqqNH6N7pB)

You can refund to:  1MbKhR9gdzBYijLGuJ1r6z8Y9kmAJvgXyZ  (https://blockchain.info/address/1MbKhR9gdzBYijLGuJ1r6z8Y9kmAJvgXyZ)

(this address was used to fund hacked address) - https://blockchain.info/tx/6d026ac21c1fcddb6e439e1a1fd76a104cc72c3137da9896f6c6814b046647f8

Total: 0.7598 BTC

Thank You!


-----BEGIN BITCOIN SIGNED MESSAGE-----
Ondrej Bredy Novak
-----BEGIN BITCOIN SIGNATURE-----
Version: Bitcoin-qt (1.0)
Address: 1BREDYpxyYZbFRxgYD8Bo92TNqqNH6N7pB

HFWi/iKNWX3RITlVlfKo+1krHWj5UUohn5k4+qgkhKxnJlAbj5q8RjddZccRUVvfO5vvDlrqTnb9x+nEIN3yI1U=
-----END BITCOIN SIGNATURE-----

AHha... Rely ? That is wonderful. WHos fault is we lost balances ? I don't care about 0.003 i paid for it. It was urs responsibility to provide SECURE keys like u say on ur site . Nvm as far i am concerned , u may not even be hacked. For 3 months not to notice change in ur own code its ridiculous. Now will be refunding what we paid for them , but not balance that was on them.... Hahahaha.... Great.

Well let's be honest - there aren't many people nice enough in the world to refund 10K of losses unless your a bigtime player or a big business. There are really just two scenarios:

a) Not hacked, instead maliciously edited code to steal coins. Then logic tells you that he would never refund your losses, but possibly only the cost of the addresses themselves in order to maintain some respectability for his account
b) Hacked, and refunding because it's the least he could do. Still can't give you a full refund because he doesn't have the funds necessary to cover it.

Both cases make sense with his actions so you can't really tell. The lesson to be learned with all of this is that is your going to make addresses do so yourself and don't trust it to any external party at all.

Hello nibor,m

I paid 0.1 btc for 1perogijwqgDFN2HAhQZQfehiCyAadc3L

Please send refund to: 1D8ADgs37jobPjeNFKRc3sge2nLismc1zk

Thank you very much and have a great day!
perogi.

I just don't get how they did not notice that code . And also, how theirs money we paid them also got stolen ? Don't tell me that it was on address made after 13 dec, and also vanaty . If u only know how much i regret making that . Lost all money i saved up for scholarship in 2+ month. So many scammers in this fcn world.

This is whole scam. I don't trust them. Sorry. They should close their business and return all stollen coins.

They did close business now , that its to late. But my 0.4 btc is GONE! And they won't be paying back that . Now i am screwed :( .

Another victim here.

I immediately contacted both Blockchain.info, where I imported the private key, bitcoinvanity.appspot.com and the bitcoin IRC when I noticed a transaction was made without me knowing about it.

Mandrik over at blockchain.info responded swiftly and professionally and we quickly pinned down the possible causes of the problem. During the day Mandrik received a lot of tickets regarding stolen coins from vanity addresses so we were pretty sure it had something to do with bitcoinvanity.appspot.com.

Luckily I didn't store a lot of value on the address as I used it as a hot wallet. May others learn what I learned from this. As the value and popularity of Bitcoin is growing, hackers are becoming more and more creative and dedicated to steal them.

Transaction: https://blockchain.info/tx/9e95fd443621d3d9fc150f290144401feb1627573c9161beb08edb472069a819

Compromised vanity address: 1JeroenYGvKMX8VXB25VESvCUq4L3SaE2f

Refund/tip address (no worries, I created this one locally after the theft ^.^): 1Jeroend9CaRRnK2Pd88NyGJF6AQApiCRR

Where do you live that losing 230ish USD is a life-altering event?

Serbia, that is more than monthly pay here, and i am student saving up for scholarship. It is huge to me , worked 2 months for it .

I know i won't get any donations now but doesn't cost anything to try, i got donation of 0.1 btc from pd. 0.3 to go... I hope i make it back till the half of next month :( .
My donation addy if anybody cares: 1GyDQ3npFsa72Ute6bXm3wen7U1GEFfpF4

When that reach 0.55 btc i am back where i was before this scam. I had 0.15 btc on that addy and 0.4 on that vanity. OH i wish i transferred it all to that other addy :( .

Prefix         : 1oscar
Your Public Key: 04830329F7CAD7090810343E8F75D41FC07B33DF9F91999540CDCBB6C94F8620598C2E6297E3D30 C8FC66FA2521EC92D13ECE74C24B0F1CEC0199585A02CEBF878
Time Found     : 2014-03-17 01:01:31.985360

Please send the refund to: 164pscUn4hUMVEzHLgah29MoyRt3s8t6pJ

Paid 0.003 for 1EAGLETxVWmE8CT2caF7XcxAXRuXGFuVez

details of transaction at http://[Suspicious link removed]/EAGLET (My part public key is 04884B77730B6C0A3E482A8FEBAE05A4610E3D1EA748FD84DE3D3FEBF2EDAE7F541814B10BF4283 CA3F0953135C42318960CF33735B74CA82BBB8366D2A2459B5B)

Refund to 1EAGLETDaTmopHSkhMfKkDBY9FZwt2Q9eg (I temporarily took one of my mining rigs offline to create this vanity myself, as well as 3 1CSTwo based vanity addresses, once I heard coins were being taken from vanity addresses created by this service.)

I had intended to use 1EAGLET to store bitcoins that I would be saving to eventually buy I copy of CadSoft Eagle professional,  (would require almost 2 BTC), so yeah, I don't exactly wish to be using a compromised by hack address.

So what is the best way to fix this problem? I have it in a wallet with other addresses..can I just delete that address and not worry then? Or should I start all over with a new wallet and new addresses?

Just delete the vanity address and never use it again. The rest should be fine provided you generated them yourself using your own client. Delete all the vanity ones you made with this site.

I lost 0.02BTC which is about an average worker's day's wage where I live. I guess compared to your loss I can't complain but I certainly feel you. At the very least we learnt to be more prudent dealing with bitcoin in the future

To nibor, for what it's worth,  if my 0.02BTC can be refunded, please send to: 1JSTyxAswtBQNGxsDTH81JfvqsEGrsbQSV

How do you know, when site has been hacked? Which way hacker used to modify code on the web? I bet that hacker is guy who latest updated the content on the web, or the admin of webhosting site. I want to know which steps you will do to find who hacked the site! You cannot simple say "sorry, it was hacker". Despite on what happened, you are responsible ,you should return all the money, first.

We have now done analysis of all address paid for since the hack.

4   @ 0.1
83 @ 0.003
12 @ 0.001

Since the admin in people claiming lots of $2 we are planning to donate 0.261 to the Bitcoin Foundation to cover all the small amounts and request them to spend on educating users about security.

We will process the other 4 manually.

Seriously? Are you laughing to my face? THERE IS NO HACKER. YOU OWNER DID STOLE ALL BITCOINS! SCAM, FCKNG SCAM!

did you never check your ANN thread before?
someone said get hacked from your vanity address in feb 2014
https://bitcointalk.org/index.php?topic=118968.msg5211706#msg5211706

This is exactly why I don't trust companies that aren't run and managed by someone I can personally visit in America.


What you've written is the single most f'd up thing I have ever seen anyone write in these forums (and that's saying a lot).

The person who needs to be educated about security is you. It was your site that was hacked, and you who did not notice it going on three months. Much, much better you spend that pittance on educating yourself about security, rather than insult those who, rightly or wrongly, placed their trust in you.

Wow... glad I never did get around to paying for my requested vanity - even though I used my own key and wouldn't have used the resulting address regardless.  I feel sorry for you, Nibor - assuming of course you're not behind it all along (We can never be suuuuuuure!) - though for one of my upcoming posts, this is extremely timely (will have to move its schedule up a bit).

Really guys? You trust a stranger with your private keys.. All you would have to do is search the forums to see you could easily do it yourself. This is worse then trusting a stranger with your wallet and bank account. This had red flag written all over it. No sympathy here.

And what about your wallet software. Are you sure, that there is no back-door, which logs your private key to an hidden server every time your wallet software generates one? To have source code of that software is no win. Hack has been written in javascript, everybody was able to see that hack directly on the web page. And nobody did during three long months.

For me the biggest mistake I made was probably laziness. I took the fast and easy way of using their calckey instead of taking the extra effort to generate my own keys. Those who generated their own keys weren't affected. Yes I know all about never ever, ever using addresses not generated by your ownself, but I thought it wouldn't hit me. Guess I learned my lesson. So far the lessons I've learned:

Never put btc into exchanges (mt.gox incident)
Never put btc into an online wallet or so called bank (flexcoin incident)
Never mine on a pool (btcguild incident)
Never keep btc in your harddrive (guy who threw out his 7500btc containing harddrive incident)
and now Never use vanity addresses not generated by yourself

So I guess to ONLY way to keep your btc is in a paper wallet kept inside a maximum security vault under constant surveillance. Or am I still missing something?

Sad news  indeed....

Please refund my two addresses :
1HugoGCZnGgLhRKHHDrWiDPHACjdbFXY3N
1FiveD3UqxjK3ryNpBHAFRiodj9LdrNJon

Send the funds to 1HYkxU8gioGWJRbMyoMcEKgqJdkWpZcnS9

Thanks...

Just to note (you did allude to this, so I'm sure you know - just clarifying for others), you can use vanity addresses not generated by yourself - but you cannot trust it if it was generated solely by the third party's keys.  You must use your own public key in a Split Key generation setup.  If the service you use only uses its own generated keys or doesn't use Split Key at all, you should avoid them.  In this case, the site generated its own keys but you could paste in your public key.  It would probably have been wise not to include the key generation at all (leaving it to other parties to deal with) but I can see why it was added as a service.
The tl;dr of Split Key is that you generate a challenge key pair and give the service the public challenge key, they use that public challenge key to generate a vanity address that matches your request, and give you a private solution key.  That private solution key cannot be used to spend from the generated address.  Then you combine that private solution key with your private challenge key to generate a new private spending key that can be used to spend from the generated address.  You destroy all keys except for that last private key.

U are right, but.... U should not generate vanity even by ur self, how do u know that vanity generator software don't have back door ? Its all fucked up in this world , there is no safety , and that is one of big problems of bitcoin, but well we get more aware as we go, we learn expensive lessons, but we LEARN them . Mine cost me all 90% of my bitcoins, so...

Because even if it did - how would anybody access it if the computer it's on is offline?  That's the same reason e.g. bitaddress.org suggests that you save the page and use it offline to remove all doubt.
( Plus, vanitygen's source code is available so you can conceivably compile it yourself.  I know the javascript of this service was also plainly available if anybody bothered to check - just that nobody did. (I did check vanitygen's code - was safe last I saw.. but don't trust me, check it yourself. ) )

This doesn't help. The attack was made through GET request to an picture outside of the site (big security issue of web browsers) . The attack will work even if you open that page from disk. Only protection is pull out the ethernet cable.

That's the thing. We did not know , many people don't have idea about scripts , or anything. This site said they doing it in java, and that they are NOT storing ours keys. Its "safe" , fast .... bla bla bla.... There shoulda been warnings all over the site. But well they will send me back 0.003 i paid for addy will help alot ! Just so i lost all my bitcoins , 0.4 coz i stored it all on that stupid addy , and saved that private key very safe offline ! I guess they stored it good to . I wanted to have all my btc in one place so i can access it all when i need, coz i don't have much to split. But well... Now its to late.

I guess that will not help to, it will be still stored . Only way is to do it on pc that never connects to internet , but well who knows all that , he would never bother making "cool" vanity addy in a first place. We just did not know, never even crossed my mind  that they will store our private keys.

... isn't that what 'offline' means?  Or are you familiar with some manner of HTTP GET request that bypasses the browser's offline setting / disabling the network interface on the OS, etc? :P

Application is still able to wait until you mistakenly switch to online. It can store all values in local storage and send them later.

At which point you're using the application online again.  If you're trying to say "well we don't know if the application is secretly still running in the background", welllllll.. sure.  But then there's a whole world of increasingly unlikely but certainly possible scenarios to explore :P  In each of them, you're using it online, knowingly or otherwise :)

When you paying?

Bitcoin has one big issue, which may make it unusable in the future. You cannot have easy-to-use true offline wallet. Because if you want to pay - spend funds - you need to go online, download all unspend outputs, then create transaction and sign it at offline, and then switch back to online and broadcast it. Every time you are going to online, there is a chance, that unwanted piece of software running in your offline wallet will get chance to leak your private key.

Alternatively you can use online computer and offline wallet and carry the request through no-internet medium, such a QR code, but it still need device with camera and display and it is not easy-to-use.

Bitcoin protocol need an improvement, which should allow to create partial transaction signed by the private key that allows to 3rd party spend your coins up to specified amount. 3rd party can be merchant. 3rd party can take any of your unspend outputs and create transaction to any address that he chooses, but only up to specified (and signed) amount  (transaction should send rest of coins back to source address). Result transaction is finally signed by another private key... so you will need two private keys to create such a transaction, but second private key is used only to protect transaction against unwanted change. Second private key can be supplied by the 3rd party.

This can help to not only create true offline wallet, but to simplify money transfer between customer and merchant, Customer only needs HW wallet with display able to show QR code and keyboard to type amount and pin. Merchant will need online application to sign transaction and broadcast it.

The outcome of this is I will be much more careful with my bitcoins from now on. Well if it's any solace, think of those who fell victim to mt.gox (no offence to those who actually got gox'ed). Well, live and learn bro. So much for vanity eh? there I said it. ;)

From following the style of rules here, I've also learnt never to walk next to a road; never to drive a vehicle or fly (how many thousand car fatalities and injuries per year, and flights although much safer are still risks); even never to live in a house (so many fatal accidents happen at home) or go to work (because some people die in work related injuries). I'm currently looking at moving to a secure safe 500m underground where I aim to grow my own food from resources gained from my very rare trips to ground level and filter the water out of the rock. I shall forsake all technology I haven't built/invented myself from scratch and avoid personal contact (people have colds and other diseases and antibiotic-resistant strains are getting stronger).

I think the more practical lessons are to be more cautious in these early days (I still think it is early days, even if its years) of bitcoin and not invest money that you can't afford to lose if you plan to store it anywhere other than secure cold storage (and if you're really paranoid, even cold storage paper in a top-secret government-standard safe is a bit risky). If you want to invest and support and use and share a currency that is, in currency terms, very very new still, expect risk (and the potential gains/usage are higher because of that).

Mt.Gox seemed safe while it was working, but people following it closely already saw warning signs - and moved out in time to avoid too big a loss. Professional investors who deal with risk like this often are practiced at spotting warnings like that and are very methodical about weighing the risk/benefit, so if you're not one of them you're at a slight disadvantage and should be ready to be on the losing side occasionally.

Unless you need a app on your phone for doing small transactions I would stick to the normal client. I would definitely not trust the website of some random nobody. If I had a really large amount I would generate keys offline. Vanitygen only takes a second to download and can be used safely, which makes this guys site nothing but a security risk. Most likely built for the sole purpose of stealing coins. Even if you could verify the source code it could be changed anytime by him or a 3rd party.

Just out of reference if you were really truly in want of making sure you were secure, you could run armory offline, use vanitygen to generate addresses and import those addresses into your cold storage/air gapped device. From there you could create transactions on your internet connected device, then move that transaction to the offline device and have it signed then move that back to the online device to be broadcast. It's a lot of work, but it pretty much guarantees that it's impossible for your keys to be stolen. It's simply a matter of how lazy you are.

Whats the point of bitcoin and crypto currency if u need to go throu all that just to pay something. U should be able to pay from ur phone , from pc at any time fast and easy. That is huge problem of bitcoin.

But well i guess there are many risks with fiat also.

1 more thing is vanitygen that u run on pc , secure for making vanitiy addy ? I made new 1MicroXV8cAyggKeXRJWhRsv1yZaqtiWTE addy if i known that is that easy i woulda never made it on that stupid scam site and lost 0.4 btc. But well now its to late.

Well i'm also one of those who was not careful, and didn't had the proper knowledge, to make a vanity address on the site.
Yes of course i could've look the code, source, but i don't know any of this.  ???
I didn't lose much, thankfully i was a little suspicious( Bitcoin is the most paranoid community i know, they helped me in that sence) and didn't put all the BTC i own.

I don't have a lot of faith of having some fund back but i'll still give a try:

Vanity address gotten by the site-that-shouldn't-be-name: https://blockchain.info/fr/address/1weezoVx2zDnogLRabRcDawTVQ33VrbmB
the amount spent to get the vanity address: https://blockchain.info/fr/tx/1656b29b85d7e8f693ccb3273d63a1e2e00c0e978601a8767dcd205a4532ae34

And finally the address for refund(if that ever happen): 1LJ1GPj5Fkkh2Xgee9bWkwhF1K4yRZmZYY

P.S. I know the amout i've lost is small compare to some others that have been stolen from, but for me it is.
May this lesson help some other newly, or veteran, users of bitcoins.

Hello,

Prefix         : 1Tommy
Your Public Key: 
04A56918BB58EED3129EEE7B08535EC99B941D16226F798692BC3B2F7D90B165299103335C3929F 5B24BBB99DAC5FA4388A330E5E6267982764E9472D19D80A5A2
Time Found     : 2014-01-10 06:57:47.293860

Please send refund to 173cGs9J6CzPj4U8jwpFhzjrNogzYT5edP

" we are hacked"

this excuse reminds me a lot of scams.

btw: I never received my payment.