Really? Feel free to name one. Anything that can be shown to "have value" (utility) is usually illegal to remove from another person's control against their will - there have been plenty of court decisions in various parts of the world to that effect over the years. Including "virtual Internet stuffz".

You're correct, I edited my post. My bad. However, you need to offer to use that method ("Split key address generation") as well for it to work

Since no one, as far as I know, have built support for third party generation of vanity addresses without the person generating the address also knowing the private key I'd strongly recommend against doing this. Not only will people need to trust you, if anything happens later they'll most certainly believe you scammed them.

(Did my build instructions for Mac still work or did they need updating?)

edit: Oops, I hadn't read the vanitygen thread recently - I was wrong. It is possible to outsource address generation, but then Coinabul needs to offer to do it that way. It's called "Split key address generation".

Gavin has verified Tihan to be what he says he is, and if Gavin isn't an upstanding member of the community we're in a lot of trouble.

And yet nothing in that post explains you posting on your QQ that you're selling LR, which turns out to come from the same LR account you claim "the hacker" created.

Oh that brings back memories from the old embedded system days. Interesting hypothesis - I wouldn't be surprised to see Internet services not realizing such attacks very well can be performed over Internet-distances if you get enough tries.

Posting additional information for those who plan on making their own password-validation code not having heard about this class of attacks before: http://www.computerworld.com/s/article/9179224/Researchers_Authentication_crack_could_affect_millions

(However, if there is such an information leak on LR's side we would surely see other services accepting LR to be affected as well)

Explaining the external use of their LR key with "brute forced" has me worried, I don't see how that's computationally possible: https://bitcointalk.org/index.php?topic=96831.msg1068030#msg1068030

What additional security practices are put in place in case the hackers are able to extract new replacement keys easily?

Thank you. If you didn't notice, you passed over the LR-selling once again in your first reply. I consider the question of shilling to have been answered now.

(I'm still asking for anyone who has met either Zhou or Tihan in person to step forward)

Zhou has still not been able to explain selling LR using his own QQ account from the LR account Zhou said "the hacker" created.

You conveniently pass this over every time. Your shilling is beyond obvious - I just can't figure out why.

https://bitcointalk.org/index.php?topic=95795.msg1063838#msg1063838

https://bitcointalk.org/index.php?topic=95795.msg1063850#msg1063850

Really? That would make it the longest known brute forced key I've heard of.

caveat: I haven't studied the actual implementation in LR, maybe there are shortcuts. I would've just assumed to end up in the right ballpark with an estimation along these lines:

GPU brute forcing speed - let's go with 3Mhash/s (SHA-1) based on http://golubev.com/gpuest.htm

Time-to-find 16 char l/U/# at 3Mhash/s estimation using http://lastbit.com/pswcalc.asp

Result: 510892508003511 years

(Feel free to halve for each added GPU and a final halving for 50% time instead of 100% - assume a lucky hacker)

40K BTC and 40K USD were taken.

https://bitcointalk.org/index.php?topic=93074

~

Linode, March, 40K BTC
Rackspace, May, 18K BTC + loss of database
MtGox, July, 40K BTC + $40K

I'm sure the list is not complete.

tl;dr: The road to hell is paved with good intentions.

I'm quite sure you launched Bitcoinica with the intention for it to provide value to the community. As initially suggested by Patrick/Intersango and others, your claims about trade volume were very suspicious. It's likely you simply exaggerated them, not unusual when being proud of what you've created.

Whether the Linode theft (where other accounts as well were swiped) just provided an excuse for some profit on the side or not I don't know, but I'm quite sure the only real money to have come out of running Bitcoinica were from user deposits. I have no personal opinion of whether it operated as a pure bucket shop or not, but others have documented the lack of visible MtGox movement even when Bitcoinica should've been hedging.

When, based on how you presented the success of Bitcoinica in public, you were approached with investment offers I believe you were simply unable to admit that it wasn't as successful as you claimed. I believe you went along way too far with whatever happened, and that the Rackspace "hack" was the simplest way out when Tihan started questioning the books. Additionally, it provided yet more profit which you might've needed to be able to keep up appearances with your friends and family.

After the very visible and complete failure by the Intersango people to handle the resulting mess I believe you made yet another profitable "hack" on the service. It wasn't as well planned nor executed as the previous, maybe it was simply opportunistic after having realized the release of the source code provided the excuse needed.

I've posted links to http://en.wikipedia.org/wiki/Pseudologia_fantastica and http://en.wikipedia.org/wiki/Cognitive_dissonance since I do believe they apply. I think you're currently unable to admit to yourself and people close to you where things went wrong, and you're still hoping to be able to exit this unscathed.

(I consider the above to be the simplest explanation possible that still fits all the known facts. I'm wary about the exact involvement by Amir, Patrick and Donald though - and since Tihan and Zhou supposedly have met in person it would be interesting to know exactly whom else have actually met either of them.*)

But then, the only reason I really care is that if people's only takeaway from having joined the Bitcoin community is that they get constantly scammed this will never fly. I thus believe Bitcoin fraud needs to be handled by the proper legal authorities. We're way past Mybitcoin's "as long as I give 49% back you guys won't hurt me, right?" - which btw looks suspiciously close to what you're currently trying to do as well.

*) Edit: Tihan's identity is verified by an upstanding member of the community, and thus Zhou's should be as well.

Exactly. Mybitcoin should've been the first and the last. I had no money in Bitcoinica (and I consider everyone who had to be naïve) but I strongly want Bitcoin to succeed. Thus, my motivation is in making sure scammers stop their bullying of my playground.

Or uses the popular version. I could've stated that in science the hypothesis requiring the least amount of free variables is likely to be correct, I'm just not sure that would've made the point clearer.

So, this deal you did with a "friend's" account just happens to be the same account as "the hacker" created? I'm sorry, but that explanation can't even begin to satisfy your own quest for consonance.

http://en.wikipedia.org/wiki/Cognitive_dissonance#The_Belief_Disconfirmation_Paradigm

Occam's Razor says that the simplest explanation is neither that someone, for no reason, created a screenshot where your QQ-account would start selling LR that when the transactions were made turned out to come from the LR account you yourself stated that the hacker created. Nor is the simplest explanation that you now all of a sudden would start to claim that "Chen" has hacked your QQ account to do deals.

The simplest explanation is that you didn't expect that someone who bought LR from you, the transactions you've so far claimed are completely unrelated and "for a friend", would match up the LR account to information released much later by aurumxchange.




vs


http://en.wikipedia.org/wiki/Pseudologia_fantastica

Select quotes:

There's no reason whatsoever to involve a second person called "Chen" in anything. The simplest explanation that fits all the known facts (including the LR-selling you, just like Zhou, seem to skip over) requires only ... Zhou.

But there is: https://bitcointalk.org/index.php?topic=95738.msg1055632#msg1055632

Why was Zhou, through his own QQ-account, selling LR from the LR-account Zhou said "the hacker" created?

Occam's razor.

I agree, that's interesting. We should be getting some information from the investigations following the Linode and Rackspace-"hacks" now, shouldn't we?

(Unless, of course, if the service in question isn't what it claims to be. Then it would be much more important to do everything possible to keep the lid on)