Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MtGox salted passwords cracked

pastebin.com

Post reply on HN
Print view View original

61–70 of 97 posts

Re: MtGox salted passwords cracked

#61

Post by rakkhi »

brianleb wrote: post #43
andrewcooke wrote: post #27

i suspect some people here don't really know in any detail how password cracking works. you start with a dictionary. a good dictionary combines multiple passwords, slang, common patterns of keys on the keyboard, and old, known, passwords (so all the entries here will be added, for example). but that's just the start. the cracking programs also have rules. in simple terms these can be "shift to upper case" or "combine…

I have a tangentially related question. During this LulzSec situation, I stepped into 2009 and started using LastPass. I generated 16 character random passwords for every place that I've been visiting. As I understand it, these passwords are encrypted on my machine and then uploaded to LastPass servers. When I login with my master password, I have access to all of these passwords unencrypted. My question: is there an…

Yes you have centralized your risk. http://www.rakkhis.com/2010/12/why-you-should-use-password-v...

An alternate option to reduce some of this: http://www.rakkhis.com/2011/06/i-was-hacked-mtgox-bitcoin-3-...

Re: MtGox salted passwords cracked

#62

Post by leon_ »

getsat wrote: post #33
leon_ wrote: post #31

Earlier quoted context omitted.

some determination? it's one invocation of john to pair them up. releasing the cracked passwords at first was stupid and doesn't show any skill. it only shows that you have a strong cpu.

> cpu Consumer-grade GPUs are better at this than even the highest end CPUs.

no shit?!

Re: MtGox salted passwords cracked

#63

Post by pbreit »

dekz wrote: post #20

Hot damn some people have horrible passwords: 123456 -> 199 results. password -> 118 results. Who would use such weak passwords for an account with potential monetary value?

People who just registered to take a look around and had no intention of actually trading?

Re: MtGox salted passwords cracked

#64

Post by pavel_lishin »

dekz wrote: post #20

Hot damn some people have horrible passwords: 123456 -> 199 results. password -> 118 results. Who would use such weak passwords for an account with potential monetary value?

It's okay, Bitcoins don't have any potential monetary value!

If I were to sign up for MtGox, I don't know if I'd use anything above my standard "don't care" password, at least until I decided to get serious about it. Typing "shifty3rd" is easier than generating a LastPass password - and I only use it for accounts when I don't care if they're compromised.

Re: MtGox salted passwords cracked

#65

Post by pavel_lishin »

dlikhten wrote: post #56

I take it straight up dic attack, i see no gen password with 32 chars in it. Guess this teaches you a lesson, 32 character generated password (or max pass size) as a requirement for 99% of sites. Now if only windows had a standard password storage API which programs can access using special rules and special admin programs can manage this way just like the web browser we can have password stores for windows + sync to…

Does Windows not have something equivalent to OS X's keychain?

Re: MtGox salted passwords cracked

#67

Post by rprasad »

pavel_lishin wrote: post #65
dlikhten wrote: post #56

I take it straight up dic attack, i see no gen password with 32 chars in it. Guess this teaches you a lesson, 32 character generated password (or max pass size) as a requirement for 99% of sites. Now if only windows had a standard password storage API which programs can access using special rules and special admin programs can manage this way just like the web browser we can have password stores for windows + sync to…

Does Windows not have something equivalent to OS X's keychain?

Windows does have a password keychain (and has since XP), but AFAIK the only programs that use it are Microsoft programs. Internet Explorer uses the Windows keychain to store saved passwords.

Re: MtGox salted passwords cracked

#68

Post by pbreit »

Could someone help this newbie understand why proper salting doesn't make this hard enough? And how does the cracker know they have the right password? Wouldn't they need to check it against the authentication mechanism or figure out the algorithm?
Post reply on HN