161–170 of 262 posts
Earlier quoted context omitted.
Your post ran counter to internet-libertarian dogma.
Probably. I regret each time i comment here, but I attribute this to the cultural differences between California based NH-users and the rest of the world.
http://news.ycombinator.com/item?id=752262 (shame can't see the vote counts on this one any more)
I'm on record here as saying a few weeks ago that a BTC bank needs to be established. I reiterate my position. A BTC bank needs to be established, with appropriate data protection features.
Sounds like a startup opportunity.
A BTC bank will have to have some no-kidding competent security around it.
Earlier quoted context omitted.
this is the only way to fight incompetence of some websites. those passwords are (most likely) unsalted vanilla MD5 hashes. just entered a few of them into google from that file and yes, many of them are present in rainbow tables. damn. makes me angry as a programmer how financial website can be this unsecure and easy to compromise.
They look like salted hashes to me.
Earlier quoted context omitted.
They were hashed using the standard php crypt() method, it generates a salt for every password encrypted. I'm in that database and was able to generate the exact hash. Luckily I use one-time passwords with such things...
Hm, if it is using the same hash all over the world (on your computer it has the same salt as on the MtGox server?), what is the point? I don't understand how this salting scheme is supposed to work? Edit: Ah OK, the salt is encoded in the String.
In reality, it's all MD5 and the passwords were leaked to a community who are running tons of GPUs to brute force hashes. So it's kind of irrelevant.
Earlier quoted context omitted.
Doesn't look as if passwords were salted, though :-( (Edit: just read in another comment that there seems to have been a global salt)
They were hashed using the standard php crypt() method, it generates a salt for every password encrypted. I'm in that database and was able to generate the exact hash. Luckily I use one-time passwords with such things...
Newest update: Apparently someone got the whole user account database of Mt.Gox I wont publish the link to it though for obvious reasons. Quick analysis: the database is legit, it contains user id, username, email if set, and a bcrypt hash. The hashes seem salted with a global salt.
Earlier quoted context omitted.
It's not cultural differences between California and the rest of the world. It's simply that your statements indicate you're commenting without an understanding the subject matter. This incident occurred because (a) people with large amounts of bitcoin do not always store them securely, and (b) the bitcoin market is very small, and therefore can be destabilised by relatively small amounts of money (a few million doll…
I should say it again: This monetary system have no authority behind it and as such is going to nowhere. Disclaimer: I work as financial analytic and at least have some knowledge of how money work.
Earlier quoted context omitted.
They were hashed using the standard php crypt() method, it generates a salt for every password encrypted. I'm in that database and was able to generate the exact hash. Luckily I use one-time passwords with such things...
Wait. The effective exchange for bitcoins worldwide is using PHP internally? People are actually trusting this with thousands of dollars in cash?
Earlier quoted context omitted.
I can confirm that the alleged dump is the real deal. Some passwords are md5 hashes, some are salted md5 hashes (utilizing the crypt[0] function). I did not log in for a long time and my password was still unsalted, so I assume that converting to salted passwords was done either automatically on login or on password changes. 0: http://www.kernel.org/doc/man-pages/online/pages/man3/crypt....
I hate to look down my nose at other programmers, because I understand that we all start somewhere, but if you are building a financial exchange and you encrypted passwords using unsalted MD5 at any point in the history of your product, you have proven to me that you are learning as you go, and there is no way in hell I'd trust you with any significant sum of money.
Earlier quoted context omitted.
I hate to look down my nose at other programmers, because I understand that we all start somewhere, but if you are building a financial exchange and you encrypted passwords using unsalted MD5 at any point in the history of your product, you have proven to me that you are learning as you go, and there is no way in hell I'd trust you with any significant sum of money.
Where do programmers learn about this stuff? Is it taught at schools? Can anyone recommend good books on proper security procedures?
