Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MtGox salted passwords cracked

pastebin.com

Post reply on HN
Print view View original

31–40 of 97 posts

Re: MtGox salted passwords cracked

#31

Post by leon_ »

romland wrote: post #21
OoThah7o wrote: post #15

Here are the plain text passwords combined with their respective mail addresses: http://pastebin.com/RhheV8Gj

I guess you can argue that no more harm can be done to the poor users of Mt. Gox but I disagree. Why would you post this? If someone really wanted to pair them up, they could have but that at least would have taken -some- determination. Obviously you knew you were pushing it since you even went out of your way to create a new handle. For the "lulz"? Troll.

some determination? it's one invocation of john to pair them up.

releasing the cracked passwords at first was stupid and doesn't show any skill. it only shows that you have a strong cpu.

Re: MtGox salted passwords cracked

#32

Post by mukyu »

A few people seem to be commenting that the salt used for all of the passwords is the same.

This is not the case.

These are crypt(3) strings and the $1$ at the beginning signifies the hash scheme used, not the salt--$scheme$salt$hash. The 1 means that FreeBSD-MD5 is the algorithm used, which is basically MD5 with the salt iterated 1000 times.

Re: MtGox salted passwords cracked

#33

Post by getsat »

leon_ wrote: post #31
romland wrote: post #21

Earlier quoted context omitted.

I guess you can argue that no more harm can be done to the poor users of Mt. Gox but I disagree. Why would you post this? If someone really wanted to pair them up, they could have but that at least would have taken -some- determination. Obviously you knew you were pushing it since you even went out of your way to create a new handle. For the "lulz"? Troll.

some determination? it's one invocation of john to pair them up. releasing the cracked passwords at first was stupid and doesn't show any skill. it only shows that you have a strong cpu.

> cpu

Consumer-grade GPUs are better at this than even the highest end CPUs.

Re: MtGox salted passwords cracked

#37

Post by snorkel »

mukyu wrote: post #32

A few people seem to be commenting that the salt used for all of the passwords is the same. This is not the case. These are crypt(3) strings and the $1$ at the beginning signifies the hash scheme used, not the salt--$scheme$salt$hash. The 1 means that FreeBSD-MD5 is the algorithm used, which is basically MD5 with the salt iterated 1000 times.

Your comment that this is MD5 x 1000 is very informative and got me searching for the FreeBSD MD5 crypt function, and I found this gem from /usr/src/lib/libcrypt/crypt-md5.c:

   /*
   * and now, just to make sure things don't run too fast
   * On a 60 Mhz Pentium this takes 34 msec, so you would
   * need 30 seconds to build a 1000 entry dictionary...
   */
    for(i = 0; i
... which seems to still be the default implementation in FreeBSD. I'd guess it's time to increase the iterations to 200000.

Re: MtGox salted passwords cracked

#38

Post by arundelo »

snorkel wrote: post #37
mukyu wrote: post #32

A few people seem to be commenting that the salt used for all of the passwords is the same. This is not the case. These are crypt(3) strings and the $1$ at the beginning signifies the hash scheme used, not the salt--$scheme$salt$hash. The 1 means that FreeBSD-MD5 is the algorithm used, which is basically MD5 with the salt iterated 1000 times.

Your comment that this is MD5 x 1000 is very informative and got me searching for the FreeBSD MD5 crypt function, and I found this gem from /usr/src/lib/libcrypt/crypt-md5.c: /* * and now, just to make sure things don't run too fast * On a 60 Mhz Pentium this takes 34 msec, so you would * need 30 seconds to build a 1000 entry dictionary... */ for(i = 0; i ... which seems to still be the default implementation in Free…

Ease of increasing how long it takes to compute the hash is the main idea behind bcrypt: http://codahale.com/how-to-safely-store-a-password/

Re: MtGox salted passwords cracked

#39

Post by BCM43 »

dekz wrote: post #20

Hot damn some people have horrible passwords: 123456 -> 199 results. password -> 118 results. Who would use such weak passwords for an account with potential monetary value?

On occasion when signing up for an account that I'm just testing out, I don't feel like creating a random password for it, so I just use a simple one. If it turns out I want to use the service, I will change it to a more complex one. This could be what happened here.

Re: MtGox salted passwords cracked

#40

Post by rmccue »

meric wrote: post #10
cipherpunk wrote: post #5

Earlier quoted context omitted.

Rainbow tables do not exist for randomised salts.

But if the salt is global and its value is "1", it might.

The $1$ part of the hash is purely to indicate that MD5 was the encryption algorithm used. The salt used is the first 12 characters, so from "$1$" to the next "$"

For example, for "$1$JVf3ep..$uvo634QwxDsAuHMOZlKws1:riprip" the salt is "$1$JVf3ep..$" (although those periods may just be padding, IIRC).

Post reply on HN