My password isn't on that list, but it's on a different list. I found it by googling my email address. :/
MtGox salted passwords cracked
51–60 of 97 posts
Re: MtGox salted passwords cracked
#52Here are the plain text passwords combined with their respective mail addresses: http://pastebin.com/RhheV8Gj
I guess you can argue that no more harm can be done to the poor users of Mt. Gox but I disagree. Why would you post this? If someone really wanted to pair them up, they could have but that at least would have taken -some- determination. Obviously you knew you were pushing it since you even went out of your way to create a new handle. For the "lulz"? Troll.
The horse is out of the barn. All of these users need to change their passwords everywhere – yesterday.
Re: MtGox salted passwords cracked
#53i suspect some people here don't really know in any detail how password cracking works. you start with a dictionary. a good dictionary combines multiple passwords, slang, common patterns of keys on the keyboard, and old, known, passwords (so all the entries here will be added, for example). but that's just the start. the cracking programs also have rules. in simple terms these can be "shift to upper case" or "combine…
So this is not the complete set of passwords, only the ones that have been cracked so far, using a dictionary? Scanning through the list, very few look like a random set of characters that a password generator would come up with. Does that mean that passwords which were randomly generated are, and are likely to remain, safe?
Re: MtGox salted passwords cracked
#54i suspect some people here don't really know in any detail how password cracking works. you start with a dictionary. a good dictionary combines multiple passwords, slang, common patterns of keys on the keyboard, and old, known, passwords (so all the entries here will be added, for example). but that's just the start. the cracking programs also have rules. in simple terms these can be "shift to upper case" or "combine…
So this is not the complete set of passwords, only the ones that have been cracked so far, using a dictionary? Scanning through the list, very few look like a random set of characters that a password generator would come up with. Does that mean that passwords which were randomly generated are, and are likely to remain, safe?
So this is not the complete set of passwords, only the ones that have been cracked so far, using a dictionary?
a dictionary + rules + time. yes (i assume - i have no inside knowledge).
[...] passwords which were randomly generated are, and are likely to remain, safe?
it depends on the length and range of characters. random passwords are still vulnerable if they are short and/or use a restricted range of characters. they can be found "by accident" when using rules and dictionaries. they can also be found by simply trying all combinations ("a", "b", ..., "aa", ..., "ab"...). length and character range protects against both of these.
it's likely that attackers will use all available approaches, including simple brute force. i focused on dictionaries + rules above because (1) that's generally more efficient and (2) some people don't seem to realize how powerful it is.
Re: MtGox salted passwords cracked
#55Re: MtGox salted passwords cracked
#56I take it straight up dic attack, i see no gen password with 32 chars in it. Guess this teaches you a lesson, 32 character generated password (or max pass size) as a requirement for 99% of sites. Now if only windows had a standard password storage API which programs can access using special rules and special admin programs can manage this way just like the web browser we can have password stores for windows + sync to cloud.
Re: MtGox salted passwords cracked
#57Earlier quoted context omitted.
So this is not the complete set of passwords, only the ones that have been cracked so far, using a dictionary? Scanning through the list, very few look like a random set of characters that a password generator would come up with. Does that mean that passwords which were randomly generated are, and are likely to remain, safe?
So this is not the complete set of passwords, only the ones that have been cracked so far, using a dictionary? a dictionary + rules + time. yes (i assume - i have no inside knowledge). [...] passwords which were randomly generated are, and are likely to remain, safe? it depends on the length and range of characters. random passwords are still vulnerable if they are short and/or use a restricted range of characters. t…
Thanks. I was under the impression somehow that cracking the first few passwords would make it easier to crack the rest (by figuring out the salting scheme perhaps)?
Also, if there is no restricted range of characters, and a solid, random password is used, how can the attacker know when they have broken it, short of trying them all against the actual server?
Edit: Forget that last bit. I'm confusing myself.
Re: MtGox salted passwords cracked
#58i suspect some people here don't really know in any detail how password cracking works. you start with a dictionary. a good dictionary combines multiple passwords, slang, common patterns of keys on the keyboard, and old, known, passwords (so all the entries here will be added, for example). but that's just the start. the cracking programs also have rules. in simple terms these can be "shift to upper case" or "combine…
oops. "a good dictionary combines multiple passwords, ..." should be "a good dictionary combines multiple languages, ..."
WTF. some fuckwit downvoted this? i wrote the text i am correcting. screw you. why do i bother to write useful comments? this place gets worse.
Re: MtGox salted passwords cracked
#59i suspect some people here don't really know in any detail how password cracking works. you start with a dictionary. a good dictionary combines multiple passwords, slang, common patterns of keys on the keyboard, and old, known, passwords (so all the entries here will be added, for example). but that's just the start. the cracking programs also have rules. in simple terms these can be "shift to upper case" or "combine…
So this is not the complete set of passwords, only the ones that have been cracked so far, using a dictionary? Scanning through the list, very few look like a random set of characters that a password generator would come up with. Does that mean that passwords which were randomly generated are, and are likely to remain, safe?
about 8200 of the 61017 accounts compromised. "only" 13%, so not bad password choices among bitcoin users on MTGOX
Re: MtGox salted passwords cracked
#60Earlier quoted context omitted.
So this is not the complete set of passwords, only the ones that have been cracked so far, using a dictionary? a dictionary + rules + time. yes (i assume - i have no inside knowledge). [...] passwords which were randomly generated are, and are likely to remain, safe? it depends on the length and range of characters. random passwords are still vulnerable if they are short and/or use a restricted range of characters. t…
Thanks. I was under the impression somehow that cracking the first few passwords would make it easier to crack the rest (by figuring out the salting scheme perhaps)? Also, if there is no restricted range of characters, and a solid, random password is used, how can the attacker know when they have broken it, short of trying them all against the actual server? Edit: Forget that last bit. I'm confusing myself.
No cracking one doesn't help you with the rest at all. Salt and encryption scheme figured out to even start.
You just keep going in bruteforce and build bigger rainbow tables / variant dictionary attacks. Given a large number of GPU's you will get all passwords.. time though could be a number of years to thousands of years.