Revisit blockchain.info listing

Blockchain.info received a relaxed review by being in the first wallets added on bitcoin.org. For basic fairness with other wallets, I think it should be revisited with reasonable criterias at least as demanding as other wallets.

After some review and research, I have found several important issues summarized below.

**Bugs and losses**: BC.i has suffered from concerning issues during the past year (e.g. iOS denomination bug, weak key stretching, sizeable number of users losing funds, and more issues I haven't verified yet)

**Backup/Password Security**: BC.i hasn't adopted security features which are slowly becoming standard in other wallets (e.g. BIP32, random passphrases, backup on setup, rotating addresses, 2FA by default).

**Transparency**: Source code of the app has been reset or not updated repeatedly, making bitcoin.org often relay the false claim that the app is open-source.

To be fair, each of these issues would have blocked or delayed listing BC.i if the wallet was submitted today. Accordingly, I think the logical next step to incentivize security and reduce risks for the user is to raise the bar for BC.i like other wallets. I suggest 7 days for BC.i to review/comment the list of issues below (@zootreeves), then suspend BC.i listing for at least 60 days. After this period, the wallet could be re-submitted for review.

Note: This pull req is **not** for bashing BC.i, I know they are having a bad image lately and not interested to feed that. If anything, I hope this can give them an opportunity to show they can address these issues.

In the absence of critical feedback, this pull request will be merged on December 6th.

--

Some issues for which I think fixes would be reasonable in the future:

BC.i's security relies on strong passwords (way more than a custodial wallet due to bruteforce attacks), yet BC.i's wallets are stored online (BC.i, email, Google drive, dropbox) and:

- Don't use truly random mnemonic passphrase, instead rely on users' passwords known to be weak. Edit: (Although this suggestion might not be *the* good one, see @vbuterin comments below)
- Allow weak passwords such as 0000000000 - Edit: fixed
- Password strength warnings are optional (and blue) - Edit: fixed
- Password strength information makes false claims (126 years to crack 123456789123456789) - Edit: fixed
- It is unclear to me yet if the new key stretching is secure enough.

BC.i does not remind or require the user to enable 2FA.
Edit: (Although it now appears that 2FA was almost no effect with the current security model - similarly to wallets on bitcoin.org using no third parties)

BC.i still has unpublished source code for their Android app (4.0.17 on Google play, 4.0.12 on GitHub).
Edit: (Same issue with the new repository, 4.0.17 on Google play, 4.0.15 on GitHub)

~~BC.i does not enable HSTS (seems to me this could be a simple change to reduce MITM attacks).~~
Edit: Blockchain.info implemented HSTS.

--

Some issues that may not meet future requirements:

The wallet does not rotate addresses.

The wallet does not uses BIP32 wallets.

Edit: The wallet does not uses deterministic ECDSA nonce (RFC6979).

--

Some issues that may require to be fixed to avoid downgrading the control score:

BC.i does not let the user backup and access their wallet offline.

BC.i does not encourage or tell the user to download or print a copy of their wallet during setup.

BC.i requires recurrent manual backup, and automated backups is not set by default.

(BIP32 again could fix those issues altogether)