Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MtGox salted passwords cracked

pastebin.com

Post reply on HN
Print view View original

91–97 of 97 posts

Re: MtGox salted passwords cracked

#91

Post by seanp2k »

gojomo wrote: post #81
andrewcooke wrote: post #58

Earlier quoted context omitted.

oops. "a good dictionary combines multiple passwords, ..." should be "a good dictionary combines multiple languages , ..." WTF. some fuckwit downvoted this? i wrote the text i am correcting. screw you. why do i bother to write useful comments? this place gets worse.

I think there are a few grumpy types that downvote for little reason, or perhaps completely arbitrarily. They're often the first votes in, as this action requires little consideration, and presumably such people have few other distractions. Also, some downvotes are cast in error. This is very easy on touch-screens, and occasionally a problem elsewhere. Since totals are no longer displayed, a person may not even reali…

Yeah, I've gotten downvoted a lot for correcting people...but I think that not even approaching proper english makes you look like an idiot, so really, I'm helping.

Re: MtGox salted passwords cracked

#92

Post by seanp2k »

bradleyland wrote: post #88
AndyKelley wrote: post #72

Earlier quoted context omitted.

It looks windows-only. Not going to work for me.

http://agilebits.com/products/1Password Mac is the first platform listed.

Looks great but no Linux support. Since I use Ubuntu on my work (and home) laptop and netbook, this is largely useless for me.

KeePassX + Dropbox is a great way to go, but it's kind of more "DIY"-ish. Still not hard to set up, keeps all my passwords in sync, and KeePassX has some great features like "auto-type" which basically is a one-click website login.

I now use the max-length passwords on all the sites I use, and they're all crazy random ones. I don't memorize any of them because it's so easy to reset a password if I lost my KeePassX access (unlikely since it's on Dropbox + 4 computers + CrashPlan backups).

Re: MtGox salted passwords cracked

#93

Post by seanp2k »

dlikhten wrote: post #56

I take it straight up dic attack, i see no gen password with 32 chars in it. Guess this teaches you a lesson, 32 character generated password (or max pass size) as a requirement for 99% of sites. Now if only windows had a standard password storage API which programs can access using special rules and special admin programs can manage this way just like the web browser we can have password stores for windows + sync to…

KeePassX + Dropbox bro. It's only an alt-tab and a right-click -> log in to site on whatever you want to get into, once you enter your master password and/or present your password file.

Re: MtGox salted passwords cracked

#95

Post by seanp2k »

pavel_lishin wrote: post #66
cel wrote: post #51

My password isn't on that list, but it's on a different list. I found it by googling my email address. :/

I wonder how many people google their password to check if it's been cracked.

Yeah dude, mine was on the bigger list. It's a 10chr semi-random password (all lower case tho).

I pick passwords based on easy things to type and the memorize the pattern / commit it to muscle memory. I also try to use obscure but pronounceable patterns somewhere in the pass.

Re: MtGox salted passwords cracked

#96

Post by DennisP »

gvb wrote: post #47
sorbits wrote: post #30

Earlier quoted context omitted.

I accidentally up-voted parent, so felt I had to reply since this part is somewhat wrong: > Using multiple salts would seem to help defeat brute forcing or dictionary attacks, but that is only true if the salts are secret If I have a dictionary of common passwords, I need to hash this with the salt used by MtGox and then I can test the hashes against all the passwords from MtGox. Had they used a different salt for ea…

Using multiple salts makes it more expensive, but it doesn't defeat an attack unless it makes the attack impossibly expensive. My contention is is that multiple salts by themselves will not make the attack impossibly expensive. Better encryption, e.g. bcrypt http://en.wikipedia.org/wiki/Bcrypt attempts to make it impossibly expensive to crack passwords. Part of their technique is to use per-password salts to increase…

Given that the bitcoin protocol adjusts the difficulty of block generation, it's kinda ironic that mtgox didn't use bcrypt.

Re: MtGox salted passwords cracked

#97

Post by shinratdr »

bluesnowmonkey wrote: post #89
shinratdr wrote: post #83

Earlier quoted context omitted.

Yes, it is. Use 1Password or KeePass because they aren't centrally hosted. 1Password even provides a little security through obscurity by using DropBox for its optional keychain syncing. People store a lot of uninteresting crap on Dropbox, filtering through to gather .agilekeychains would be a real PITA.

If only there were a device that could automate computational tasks, such filtering would no longer pose a challenge. Some sort of compute-er...

If it was simple as filtering for those files, you would have a point. It's not though. If you can't see the difference between a big compiled database of 1 million+ users password DBs vs a multiple petabyte mess of all types of files including a handful of agilekeychains, then it's not worth discussing further.
Post reply on HN