Tom Williams ~ The Smoking Gun(s) or Phin's Pholly

[Phinnaeus Gage]

I'm not ready to call your whole story hogwash-or-not yet, but many of the assumptions and conclusions you're making seem like big stretches to me, so far.

I see that robert @ mckay.com has more than one account registered there, but I noticed lots of instances of more than one account from the same person last time I perused the MtGox leak file for interesting tidbits. I don't see how that email address is connected to any of this yet, nor do I see a plausible connection to edwardgel or some (*gasp*) Russian person, aside from their accounts being registered at about the same time. With over 60k accounts registered over the relatively short period of time between MtGox's inception and the leaking of their password file, there are bound to be lots of weird-looking coincidences in there.

Ok, I'm going to tell you a secret. Very few people know this, so don't spread it around: NF6X is not the name I was given at birth. I hope that you don't think any less of me because I'm posting here under an alias. 

I'll accept your argument, NF6X. I'll continue to make sense of it all.

PS: I won't share your secret, Terry Gilbert.

[1714170114]

1714170114

[1714170114]

1714170114

[greyhawk]

This is by far the worst attempt of doxing I have ever seen and I have both seen and done a lot of them in my lifetime.

[NF6X]

My hat is now securely fastened atop my head. I'll be back after I go feed the horse, if you know what I mean.

Yep, I do. I saw that episode of South Park.

LOL! Well, in this case, I meant that my neighbors were running a bit late so they asked me to feed their horse for them. Just hay; no chili. I did give him an extra carrot, though. 

[Phinnaeus Gage]

Can we start by safely assuming that BW and EG probably signed up on the same day and possibly on the same computer? (and before you say it, in the same chair with their pants...)

666  sroe  sroemen@gmail.com    (delayed registration because he wanted to be the 666th member)
667  brucewagner  bruce@brucewagner.com
668  Almad  prace@almad.net
669  SergGT serg_gt@rambler.ru
670  iamiam  ed@edwardgel.com
671  welsh  (no email listed)

I believe we could assume that the people who signed up before, during and after BW and EG have no connection to them, with the exception all six are Bitcoin users, unless a direct connection is proven at a later date.

[NF6X]

PS: I won't share your secret, Terry Gilbert.

Drat! You figured me out! There goes my 10-year run of posting both anonymously and posthumously.  

[Phinnaeus Gage]

My hat is now securely fastened atop my head. I'll be back after I go feed the horse, if you know what I mean.

Yep, I do. I saw that episode of South Park.

LOL! Well, in this case, I meant that my neighbors were running a bit late so they asked me to feed their horse for them. Just hay; no chili. I did give him an extra carrot, though. 

I am so glad you said carrot instead of pineapple, for I saw that episode, too.

This is by far the worst attempt of doxing I have ever seen and I have both seen and done a lot of them in my lifetime.

Would you be so kind as to explain that statement to me. I'm a tad slow tonight.

[Phinnaeus Gage]

PS: I won't share your secret, Terry Gilbert.

Drat! You figured me out! There goes my 10-year run of posting both anonymously and posthumously.  

FYI, everyone. I was joking about NF6X being Terry Gilbert. I made that up. Now, let's see if I can tied this all together.

[NF6X]

Can we start by safely assuming that BW and EG probably signed up on the same day and possibly on the same computer?

I'll go along with "probably signed up the same day" based on proximity in the password file, but I don't conclude "possibly on the same computer" any more than for any other two accounts that are near each other in that file. Maybe I'm just dense (as a side-effect of entering the afterlife back in 2001), but I'm just not seeing the connection between BW's and EG's pants.

[cypherdoc]

It's not that much of a stretch to see that weusecoins.com and Tom Williams registered the same day, and probably at the same time on the same computer.

That's where you're losing me. I'll say that those two accounts appear to have been registered consecutively, but I don't see anything else that suggests that they were registered by the same person, and/or from the same computer, or even on the same day. Without IP logs and timestamps of registrations, how do you know that those accounts weren't registered from different addresses a few hours apart? Can we also assume that Tom Williams registered his fribit.no account a moment later?

Patterns!

667,brucewagner,bruce@brucewagner.com,$1$... (purposely waited till the 666th member joined so that he wouldn't be it)
668,Almad,prace@almad.net,ad8... (note password--not starting with $1$)
669,SergGT,serg_gt@rambler.ru,$1$... (Russian)
670,iamiam,ed@edwardgel.com,71b... (note password--not starting with $1$)

Different day?


This account could easily be a day earlier----------BUT (still connected, I say)

603,justmoon,moon@justmoon.ch,$1$...     (registered just up prior to BW & EG registering) (an early Mt.Gox member)

if i recall correctly those "$1$" are the expect results of the MD5 salting that was added to passwords.  thats why you're seeing so many start with that sequence including nguyens.

[NF6X]

PS: I won't share your secret, Terry Gilbert.

Drat! You figured me out! There goes my 10-year run of posting both anonymously and posthumously.  

FYI, everyone. I was joking about NF6X being Terry Gilbert. I made that up. Now, let's see if I can tied this all together.

I don't even know who Terry Gilbert is; I just googled the name and picked one who had been deceased for an amusingly long period of time. And thankfully, I have never met Ms. Hilton. 

[cypherdoc]

surely you aren't suggesting Stefan Thomas is Tom Williams?  Stefan has done some great work for the community and was one of the key speakers at Bitcon.  i've seen him interviewed by BW and he seems like a very cheerful fellow and dedicated Bitcoin enthusiast in his own words.

No I was not claiming that at all. I was stating that the name and the name associated with the email account is different. BTW, do have a picture of him?

[owner-c] handle: 668732
[owner-c] type: PERSON
[owner-c] title:
[owner-c] fname: Stefan
[owner-c] lname: Thomas      (If the owner's name is Stefan Thomas, then why does email link to another name)
[owner-c] org:
[owner-c] address: Sommerhofenstr. 136
[owner-c] city: Sindelfingen
[owner-c] pcode: 71067
[owner-c] country: DE
[owner-c] state: DE
[owner-c] phone: +49-7031-7853000
[owner-c] fax: +49-7031-700935
[owner-c] email: moon@justmoon.de   Here  (same website design as justmoon.ch and justmoon.net)
[owner-c] protection: B
[owner-c] remarks: 32086495
[owner-c] updated: 2011-07-21 03:19:14

i'll do better than a picture.  here's his keynote speech at Bitcon:  http://onlyonetv.com/#5

[indicasteve]

tien.dat79's profile on a forum called 'Hoc Lap Trinh' which means 'Programming' in English.

http://social360.info/thanh-vien/674200

His pic is there too!

He's pretty active in their Bitcoin forums...over 2600 pages just on bitcoin.

I don't know why you won't even consider this is the guy.

You keep trying to make some connection to Bruce but I highly doubt BW has the technical aptitude to program mybitcoin.  This Vietnamese guy sure does.

[Maria]

Get ready for bitcoin justice.

Maria.

[cypherdoc]

Phinnaeus:  do you still have the .csv list of all the hacked accts on mtgox?  every source i've googled today has been taken down.

[Phinnaeus Gage]

tien.dat79's profile on a forum called 'Hoc Lap Trinh' which means 'Programming' in English.

http://social360.info/thanh-vien/674200

His pic is there too!

He's pretty active in their Bitcoin forums...over 2600 pages just on bitcoin.

I don't know why you won't even consider this is the guy.

You keep trying to make some connection to Bruce but I highly doubt BW has the technical aptitude to program mybitcoin.  This Vietnamese guy sure does.

I will do that. Until then: https://www.bitcoinmarket.com/market/members/view/?market_memberID=6765

[Phinnaeus Gage]

Phinnaeus:  do you still have the .csv list of all the hacked accts on mtgox?  every source i've googled today has been taken down.

I put the link is the first post of this thread and it's still working: http://dump.udderweb.com/Censorship/mtgox_leak.txt

[DrYe5]

Phinnaeus:  do you still have the .csv list of all the hacked accts on mtgox?  every source i've googled today has been taken down.

I put the link is the first post of this thread and it's still working: http://dump.udderweb.com/Censorship/mtgox_leak.txt

Explain the significance of a password starting with "$1$" or not.

[NF6X]

Aha! drumhacker72 and Goat must be the same person, because they (and only they) rated up tien.dat79, and both were invited by dwdollar. We're through the looking glass, people! I still don't see how the Rand Corporation fits in, though.  

[cypherdoc]

Phinnaeus:  do you still have the .csv list of all the hacked accts on mtgox?  every source i've googled today has been taken down.

I put the link is the first post of this thread and it's still working: http://dump.udderweb.com/Censorship/mtgox_leak.txt

Explain the significance of a password starting with "$1$" or not.

there is none.  as you can see in the list Phin just put up, just about every other one or more starts with this string.  i think this is the result of the MD5 salting.  nothing here folks.

[nanaimogold]

Hi Bruno,

I know you are having fun with this. You might get some insight from this;

http://agoristradio.com/?p=480

starting at about minute 15

Shane