MtGox salted passwords cracked

I guess you can argue that no more harm can be done to the poor users of Mt. Gox but I disagree.

Why would you post this? If someone really wanted to pair them up, they could have but that at least would have taken -some- determination.

Obviously you knew you were pushing it since you even went out of your way to create a new handle. For the "lulz"? Troll.

The purpose of salting is to prevent the use of "rainbow tables" (precomputed hashes). With salted passwords, the attacker has to compute the password hash for every password he tries (takes time), he cannot use pre-computed hash tables and just compare the password hash to the precomputed hashes (a simple string compare).

Using one salt defeats rainbow tables. Using multiple salts does not defeat it any better.

Using multiple salts would seem to help defeat brute forcing or dictionary attacks, but that is only true if the salts are secret... the problem is that they are not secret because the at this point the attacker access to everything, including the salts.

http://en.wikipedia.org/wiki/Salt_%28cryptography%29

I'm pretty sure this article[1] is posted daily on HN. General purpose hashing functions are all fast (which, for a password storage system, is synonymous with bad).

[1] http://codahale.com/how-to-safely-store-a-password/

i suspect some people here don't really know in any detail how password cracking works.

you start with a dictionary. a good dictionary combines multiple passwords, slang, common patterns of keys on the keyboard, and old, known, passwords (so all the entries here will be added, for example).

but that's just the start. the cracking programs also have rules. in simple terms these can be "shift to upper case" or "combine two words from dictionary" or "reverse word" or "replace "e" with "3". and there are common sets of rules that people develop (and test) that do standard transformations like automatically making passwords "leet", or extending with common sequences (123), etc.

and you can automate this. so something like hashcat will generate random rules and apply them to the dictionary. because the rules are written so that they can be composed this is surprisingly powerful and probably explains some of the "harder" cracks on this list.

the only way to beat this, then, is to use random passwords (for example, as generated by keepass) and to make them large enough that just running through every combination doesn't work.

on size: what is important is the number of available combinations. systematic cracking - trying every possible combination - still uses common characters first so "size" is a combination of character variety and number of characters. again, something like keepass makes this easy.

finally, note that on some old or poorly maintained systems, you may be restricted (perhaps without knowing) to 8 characters. then using a wide range of characters is critical.

i know this is obvious to many, but some of the comments about "hard" passwords made me think it might be useful...

What about public-private key authentication ? Isn't this demonstration enough ?