That 2000BTC the thieves made off with is worth about $32,000 at the moment.
I'm surprised they weren't able to raise the amount they could withdraw at once; I would imagine the limit is database-backed.
Those 500K Bitcoins that caused the flash crash weren't real
11–20 of 176 posts
Re: Those 500K Bitcoins that caused the flash crash weren't real
#12"The new Mt. Gox site features SHA-512 multi-iteration, triple salted hashing" Why not use a standard key derivation function such as PBKDF2 or bcrypt to provide some confidence in the system rather than inventing their own? AFAIK bcrypt is strong because of Blowfish's expensive key setup. How does this compare to SHA-512?
The part that bothers me about that is "triple salted hashing". This could mean any number of things, all of which point to a misunderstanding of what a salt is for.
How so? Seems to me like it could mean any number of things, all of which succeed in securely hashing+salting a password.
Re: Those 500K Bitcoins that caused the flash crash weren't real
#13That 2000BTC the thieves made off with is worth about $32,000 at the moment.
It wasn't thieves, was it? It was just a guy who bought bitcoins during the crash and withdrew some. That's perfectly legal, from where I'm standing.
EDIT: It looks like the guy I'm talking about only withdrew 640ish coins, so this must be someone else.
Re: Those 500K Bitcoins that caused the flash crash weren't real
#14Earlier quoted context omitted.
The part that bothers me about that is "triple salted hashing". This could mean any number of things, all of which point to a misunderstanding of what a salt is for.
Triple salted hashing sounds like either there's three salts in a hash or it's hashed with a salt three times.
Perhaps they mean it's salted by 3 different environments, so an attacker would need to crack the db server and 3 other servers just to get a chance to start cracking the passwords.
Re: Those 500K Bitcoins that caused the flash crash weren't real
#15Earlier quoted context omitted.
Triple salted hashing sounds like either there's three salts in a hash or it's hashed with a salt three times.
Perhaps they mean it's salted by 3 different environments, so an attacker would need to crack the db server and 3 other servers just to get a chance to start cracking the passwords.
That would mean that logins would have to go through 3 different servers. If anything, I would be more worried about security in that case.
Re: Those 500K Bitcoins that caused the flash crash weren't real
#16Earlier quoted context omitted.
The part that bothers me about that is "triple salted hashing". This could mean any number of things, all of which point to a misunderstanding of what a salt is for.
Triple salted hashing sounds like either there's three salts in a hash or it's hashed with a salt three times.
That is indeed what it sounds like, but what's really worrisome about that is that anyone who thinks the solution to keeping passwords is to triple-salt them really needs to learn some things about keeping passwords safe.
I could quintuple-salt my passwords with 4096 byte salts chosen purely randomly and there would be no perceivable advantage over a single 512 bit salt.
Re: Those 500K Bitcoins that caused the flash crash weren't real
#17What this means is that very easily, or even accidentally, MTGox could be running a fractional reserve bank in bitcoin. Balances are just numbers in the database, so there's no cryptographic requirement that they sum up to the actual amount in the dollar and bitcoin escrow accounts/wallets.
They can inflate the bitcoin in circulation, and all it takes is enough real bitcoin and cash to cover the withdrawals for no one to know the difference.
Re: Those 500K Bitcoins that caused the flash crash weren't real
#18Earlier quoted context omitted.
The part that bothers me about that is "triple salted hashing". This could mean any number of things, all of which point to a misunderstanding of what a salt is for.
How so? Seems to me like it could mean any number of things, all of which succeed in securely hashing+salting a password.
They could be using 3 different salts, each of which is statically stored on the server. They could be using 3 per-password salts, and applying each of them once. They could be....
At the end of the day, salts are there for one thing alone: eliminating the possibility of rainbow tables. But whether you use 1 salt of decent size (64-bit minimum for that) or 1000, you've got the exact same protection there. There's a good reason it's recommended that you use PBKDF2 or bcrypt.
Re: Those 500K Bitcoins that caused the flash crash weren't real
#19Earlier quoted context omitted.
The part that bothers me about that is "triple salted hashing". This could mean any number of things, all of which point to a misunderstanding of what a salt is for.
How so? Seems to me like it could mean any number of things, all of which succeed in securely hashing+salting a password.
[deleted]
Re: Those 500K Bitcoins that caused the flash crash weren't real
#20Earlier quoted context omitted.
The part that bothers me about that is "triple salted hashing". This could mean any number of things, all of which point to a misunderstanding of what a salt is for.
Triple salted hashing sounds like either there's three salts in a hash or it's hashed with a salt three times.
Triple salt sounds bad. Should be Salt, Pepper, and Cayenne.