Quote from: aliro38 on December 29, 2014, 06:18:53 PM

Well, I'm stuck here: http://bitcoin.stackexchange.com/questions/22/is-it-possible-to-brute-force-bitcoin-address-creation-in-order-to-steal-money
The math posted there is ok for me but I'm not familiar with crypto so those parts are over my head for now, Anyway, as one can see, there is no consensus among experts. Interesting enough, it seems that one post there clearly reads "It is possible to brute force some Bitcoin addresses, because some people generate their private keys in an insecure manner." and further the author even gives some practical cases!

Well, yes, if the private key was not generated at random, it is possible to crack it.

This is in fact what happened earller this month to customers of Blockchain.info (BCI) web wallet. That service gives you javascript code that is supposed to generate random private keys, which remain in your computer so they are supposedly safe. One day their Chief Blunder Officer tried to improve the random number generator, but instead broke it quite thoroughly. As a result, some clients who generated private keys with the broken javascript got some keys that were easy to guess (so much so that the same key was given to different clients, it seems). Also, any transactions that were signed with that buggy code contained enough information to allow guessing of the private keys of the input addresses.

Fortunately, a "white hat" hacker was monitoring the blockchain for the latter weakness, promptly warned BCI, and the bad javascript was pulled from their site a few hours later. Even so, about a thousand addresses with about a thousand BTC total had their contents swept by hackers who broke the private keys -- fortunately, most of them by that "white hacker", who returned them to BCI. Those keys were so weak that they could be cracked by an ordinary PC. There were similar incidents in the past but this may have been the worst one so far.

However, I suppose that old addresses do not have this kind of weakness, since there were fewer wallet programs available and those were written by competent programmers. But who knows. Perhaps Satoshi was still using some lousy random number generator when he generated his private keys...

This is a also method that a hacker could use to steal bitcoins. He gets people to use malicious wallet software, that generates intentionally weak keys, and/or transaction signatures that reveal the private keys. Unlike the BCI accident, these weaknesses can be masked so that they cannot be detected by looking at the keys and signatures. The hacker then needs only monitor the blockchain until he sees enough BTC in those compromised address. This attack would work even if the victim generates the keys and/or signs the transactions in a computer that is not connected to the internet.