Quote from: NewLiberty on February 12, 2015, 05:19:42 PM

Quote from: spin on February 12, 2015, 09:18:36 AM

Quote from: fasbit on February 07, 2015, 02:48:59 PM

Quote from: gmaxwell on February 06, 2015, 07:35:14 PM

Quote from: fasbit on February 05, 2015, 12:06:10 AM

I will argue that 256 coin flips from random.org is the best random number possibility available. And assuming that you push the results through an offline computer using brainwallet offline, you will have a VERY SAFE, VERY RANDOM private key.

LOL. A "VERY SAFE" number which is trivially known to a third party. Is someone at "random.org" paying you to encourage people to have them generate their private keys, or did you come by this cluelessness naturally?

I haven't looked recently but last I checked random.org methods were secret and not peer reviewed. So not only may the results be trivially maliciously logged (by the site operators or anyone whos compromised their system; or the operators of the VPSes they use (rackspace cloud)), they're probably more likely to be accidentally flawed because their methods are not reviewed.

A. Attacking an idea or postulate is a great thing. Attacking a person and calling them "clueless" is ad hominem and is below your status as a moderator of this board.
B. Random.org is peer reviewed here https://www.random.org/media As well as tested by third party orgs like http://www.ecogra.org/ Their methods are not secret but they are not public either.
C. So lets examine your logic: Since random.org (peer reviewed, certified and in business since 1998) creates a buffer in advance full of billions of ones and zeroes and since it uses https, someone could log the front end usage of these ones and zeros after they leave the buffer and before they hit the https (side note on magnitude: these ones and zeroes from the buffer are used for ALOT of different applications on the site other than coin flips), track the usage by ip, collect and then echo the data once an ip pulls precisely 256 bits of data, run the bits through a key generator, (also try various combinations of the 256bit sequence like only look at the last 256 bits, since the first x bits could have been a test), create a database to collect all of these new bitcoin address and repeatedly query the entire blockchain to see if any of the addresses are extant. If any one address is extant and holds bitcoins, import the corresponding key into a wallet and steal the bitcoins. OK... I will concede. This may be possible. Its not likely considering the high level access, the subterfuge necessary, and the high number of bitcoin addresses to generate & query; not probable, but maybe possible.

So to test your theory I am going to publish a bitcoin address that I created using random.org, leave some BTC there and see if they evaporate. If they magically walk away, then we will know that someone at random.org is malicious. If nothing happens, then Im going to stick with my "SAFE" comment. I will however add a note of caution to the thread warning people that 1) They could get struck by lightning today 2) Earth could get destroyed by a meteor in the next 5 minutes AND 3) Somebody at random.org might guess your intent out of the millions of possible intents by those who use this service, parse through the data looking for precisely 256 bits of interesting target data turn them into a bitcoin key and steal your BTC.

Dear Mythical Hacker at Random.Org: I created this address with the coin flip service on 02/07/2015. I flipped 8 coins at once using Polish Zloties. I pulled precisely 256 bits of data from the buffer to make it easy on you. Please steal my bitcoins.
Here is the address: 1DcS5pEgjnLGJ43h7znVxdcxMfx6pfaZvA

A. He may have been a little harsh, but you need to understand cryptography for some of these things. And you can't simply claim something is secure. I am trying to learn about cryptography, and all I've really learned thus far is that there is a lot out there and one can quickly do a lot of damage.
B. Those are random citations that don't any really appear to be peer review of the methods. For random.org to be tested their methods should be fully disclosed. They have a question covering this in their FAQ: https://www.random.org/faq/#Q2.2 It talks about gaming and gambling. Being verified for that is NOT the same as being verified for cryptographic purposes. Also see https://www.random.org/faq/#Q1.2 Standard security practice before using something in cryptography is that it's open to inspection and that a lot of people have looked at it. The code they use is not available so how do you know it's right.
C. In theory the whoever can access the machines they use can get to the random numbers generated. These include the hosting company, the site owners, hackers with access etc. gmaxwell did point out that the most likely source of error was a accidentally poor implementation of the random number generator process. The point is you cannot know because it's all closed source and not reviewed. So do you want to use something that is well reviewed random generator or something that may or may not be random?

A poor random generator may make it possible to solve private keys for 1 in 1000 or 1 in a 1000 000 generated using the site. The point is even 1 in 1bn is a lot (and I mean a LOT) less secure than other methods used to generate private keys. So your test address is probably safe, but how safe you won't know, because it's all closed up. Now if lots of people start using the service (like when someone start recommending them) the odds start looking a lot better for an attacker.

This is my lay understanding of the issues around something like this.

GMaxwell writes from a development point of view.
Make it provably safe therefore trustless (not requiring unusual trust).
I appreciate that view point in a developer, because it makes the code useful for very large values.

The "test" is one which uses very small bait: 1DcS5pEgjnLGJ43h7znVxdcxMfx6pfaZvA has 0.05 XBT.
It is not a very valid test. It will not entice someone with an exploit to go after those coins.

1. I agree that my measly .05 BTC of bait is not a real enticement. But it would demonstrate if someone had maliciously swiped the code and was using the site to swipe private keys no matter the balance.
2. I appreciate gmaxwell's point and I added warnings based on his point. This thread is however, about creating the private key with a coin flip not a web site. Using a site like random.org is ancillary to the thread and I marked it "educational only."
3. The only thing I claim is safe is: 1) its done offline, 2) its done randomly, and 3) no one can know the method of creation. I will stick by that maxim. < this is the essence of the thread