Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Those 500K Bitcoins that caused the flash crash weren't real

mtgox.com

Post reply on HN
Print view View original

91–100 of 176 posts

Re: Those 500K Bitcoins that caused the flash crash weren't real

#91

Post by eric-hu »

daeken wrote: post #18
rheide wrote: post #12

Earlier quoted context omitted.

How so? Seems to me like it could mean any number of things, all of which succeed in securely hashing+salting a password.

They could be using 3 different salts, each of which is statically stored on the server. They could be using 3 per-password salts, and applying each of them once. They could be.... At the end of the day, salts are there for one thing alone: eliminating the possibility of rainbow tables. But whether you use 1 salt of decent size (64-bit minimum for that) or 1000, you've got the exact same protection there. There's a g…

Doesn't a salt just make a rainbow table attack more expensive, in direct relation to the length of the salt?

Re: Those 500K Bitcoins that caused the flash crash weren't real

#92

Post by Uchikoma »

chc wrote: post #82
Andys wrote: post #63

Earlier quoted context omitted.

The reason Mt Gox needs to obsess over password database is because they don't seem experienced enough to secure the rest of their site. When it comes down to it, they are still a "PHP+mysql" site like all the others on the Internet. Would you store your funds at the Bank of Wordpress?

Is a site inherently safer if you use Java?

Might sound strange but: Yes it is. Since the first JDBC DB drivers it's common sense to use prepared statements and not build a query on your own. Because of this SQL injection is a much much smaller problem in Java codebases than in PHP ones. (this being a Java culture result more than a language one).

Re: Those 500K Bitcoins that caused the flash crash weren't real

#93

Post by tzs »

rheide wrote: post #12
daeken wrote: post #7

Earlier quoted context omitted.

The part that bothers me about that is "triple salted hashing". This could mean any number of things, all of which point to a misunderstanding of what a salt is for.

How so? Seems to me like it could mean any number of things, all of which succeed in securely hashing+salting a password.

Security is hard, and we KNOW they are not experts in this area. The ONLY way they can do a secure system is to use someone else's design.

Thus, the fact that they are describing it in terms that none of us have heard of is a troubling sign.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#94

Post by Uchikoma »

nowarninglabel wrote: post #90
eli wrote: post #48

Earlier quoted context omitted.

An exchange. That accepts deposits. And holds your money for you. Like a bank.

A bank is a legally defined concept, this exchange is not one.

I think you've meant: A bank is a legally defined concept where I live, this exchange is not one.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#95

Post by walkon »

walkon wrote: post #62
zachanker wrote: post #40

Earlier quoted context omitted.

It was crypt-MD5, the fact that they call it MD5 with salt is generous at best. They seem to have made the decision to move to crypt-MD5. I don't really have any faith in their ability to secure the servers.

True, but I think this has been fixed, assuming their new site is live: "The new Mt. Gox site features SHA-512 multi-iteration, triple salted hashing and soon will have an option for users to enable a withdraw password that will be separate from their login passwords."

Not sure why I'm downvoted, SHA-512 is obviously better than MD5 and we don't know the details. The constant spewing that bcrypt is the only way to hash a password is getting old fast.

Ok, whatever, keep downvoting, fuckers.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#96

Post by cvandyck76 »

bcl wrote: post #59
rlpb wrote: post #6

"The new Mt. Gox site features SHA-512 multi-iteration, triple salted hashing" Why not use a standard key derivation function such as PBKDF2 or bcrypt to provide some confidence in the system rather than inventing their own? AFAIK bcrypt is strong because of Blowfish's expensive key setup. How does this compare to SHA-512?

1st rule of cryptography - don't try it at home. You'll get it wrong. There are any number of standard ways to protect passwords, there's no need for them to be reaching for the bottle of Snake Oil.

Exactly. Security through obscurity does not work (for long, at least).

Re: Those 500K Bitcoins that caused the flash crash weren't real

#97

Post by nowarninglabel »

Uchikoma wrote: post #94
nowarninglabel wrote: post #90

Earlier quoted context omitted.

A bank is a legally defined concept, this exchange is not one.

I think you've meant: A bank is a legally defined concept where I live, this exchange is not one.

Not really no, a bank is a legally defined concept in pretty much every country in the world. Suggested reading: http://www1.law.nyu.edu/centralbankscenter/texts/order.html

Re: Those 500K Bitcoins that caused the flash crash weren't real

#98

Post by drivebyacct2 »

nkassis wrote: post #77
drivebyacct2 wrote: post #57

Earlier quoted context omitted.

I was more referring to the fact that we fail to produce proof of the limited amount of gold that we claim to have and every attempt to audit it is rebuked magically. In terms of the question, how would it be handled from an FDIC perspective if it came to a worst case scenario... it'd be a shit-show.

They would just call up the federal reserve and have them print money. When accounts close down it's money that disappear from the money supply that the fed would replace.

Exactly, but surely this move would be transparent to those who trade with/in USD.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#100

Post by bzbarsky »

ceejayoz wrote: post #64
TheSkeptic wrote: post #27

Everybody should give the people behind Mt. Gox a break. These guys make real banks look good - no small feat!

> These guys make real banks look good - no small feat! How, exactly? I don't remember many instances of banks having security issues that dropped the value of the US dollar to 1/1750th of its value, even briefly.

Yes, that's why real banks look good compared to Mt. Gox, as claimed!
Post reply on HN