Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MtGox salted passwords cracked

pastebin.com

Post reply on HN
Print view View original

11–20 of 97 posts

Re: MtGox salted passwords cracked

#11

Post by silencio »

doublec wrote: post #6
thaumaturgy wrote: post #4

Earlier quoted context omitted.

Well, considering that 292 of the passwords contain mixed case, 79 of them are 12 characters or more (this one's nice: "qwe123QWE!@#"), 59 of them contain non-alphanumeric characters, and 6713 of the 8655 passwords posted are unique ... it's probably only a matter of time. Nice. I think it's time to upgrade all my passwords.

"qwe123QWE!@#" is only nice until you look at the keyboard. First three qwerty letters. First three keys just above them. Then the same shifted.

I was surprised at how few randomly generated passwords there were in that list, if any. Like you mention, there's a lot of variants on qwerty/12345/!@#$%: 1qaz2wsx, Zaq1Xsw2, 1qazxsw23e, 1q2w3e, !@#$1234, etc.

"ZXasqw12!@" was about as random as it got from a quick scroll-through, and even that is basically just keys directly next to each other.

I assume randomness doesn't mean as much as sheer password length does when it comes to crackability, but I wonder if there's anything to be learned from this. Maybe only that random password generators tend to default to a safer (longer) length? :)

Re: MtGox salted passwords cracked

#13

Post by DarkShikari »

silencio wrote: post #11
doublec wrote: post #6

Earlier quoted context omitted.

"qwe123QWE!@#" is only nice until you look at the keyboard. First three qwerty letters. First three keys just above them. Then the same shifted.

I was surprised at how few randomly generated passwords there were in that list, if any. Like you mention, there's a lot of variants on qwerty/12345/!@#$%: 1qaz2wsx, Zaq1Xsw2, 1qazxsw23e, 1q2w3e, !@#$1234, etc. "ZXasqw12!@" was about as random as it got from a quick scroll-through, and even that is basically just keys directly next to each other. I assume randomness doesn't mean as much as sheer password length does…

Random passwords are probably not going to be cracked by a run-through of John with a ruleset, which is likely similar to -- or exactly -- what was used to create this list.

These are salted FreeBSD MD5s (iterated hash); even with a powerful GPU, you're probably only going to be able to check a few hundred thousand per second at best.

Re: MtGox salted passwords cracked

#14

Post by brs »

thaumaturgy wrote: post #4
meric wrote: post #2

Hmm it isn't complete; My password isn't on there yet. =\

Well, considering that 292 of the passwords contain mixed case, 79 of them are 12 characters or more (this one's nice: "qwe123QWE!@#"), 59 of them contain non-alphanumeric characters, and 6713 of the 8655 passwords posted are unique ... it's probably only a matter of time. Nice. I think it's time to upgrade all my passwords.

For what it's worth, my password was 8 random alphanumerics, and it's not in the list, while /.,mnbvcxz (12 alphanumerics with symbols) is there. The cracker must have some sort of algorithm that looks for consecutive patterns on the keyboard.

It goes to show that the old rules - non-dictionary word, mixed case, etc - really don't cut it anymore. Psychologically, picking a password that has high entropy is quite difficult, and the crackers are only going to develop better algorithms in the future. I think using a good random generator is the only way to ensure you have a decent password these days.

Re: MtGox salted passwords cracked

#16

Post by thadeus_venture »

What kind of impact would having used something like sha-512 with a 128 bit salt have had over md5? How many more cycles do those take to generate? I assume the attacker had to brute force the salt from a known password as well, if that's sufficiently random that should provide some security as well shouldn't it?

Re: MtGox salted passwords cracked

#17

Post by tzs »

A lot of them are just 6 characters. Even a random 6 character password can be brute forced in a few minutes. Many of the short ones were just single dictionary words, so wouldn't even get past the initial check for stupid passwords--they would fall in seconds.

Most of the longer ones seem to be simply combinations of a couple dictionary words, or a word and a number, or similar fairly low entropy combinations that would come early in a brute forcer's search.

Most of the ones that aren't like that are based on simple patterns on the keyboard, which would also be in a brute forcer's list of things to check early.

Re: MtGox salted passwords cracked

#18

Post by Jach »

shawndumas wrote: post #12
meric wrote: post #2

Hmm it isn't complete; My password isn't on there yet. =\

Nor mine.

Nor mine. Of course mine was only 8 characters, character set of size 72, so only a "mere" 722,204,136,308,736 possible permutations. In any case the couple places that one was reused have been updated already, I'm still waiting for it to show up eventually.
Post reply on HN