It's not clear how datetime was used and why that became a weakness? Doesn't it improve the password security by taking some bytes from /dev/random and salting it with ?
Researchers cracked an 11-year-old password to a $3M crypto wallet
11–20 of 196 posts
Re: Researchers cracked an 11-year-old password to a $3M crypto wallet
#12Time for a new investment strategy that involves buying whatever (index funds?) then losing your password to force a hold till the encryption algo has been cracked or compute power makes it easy to brute-force. Call it the Moore’s Law Fund.
An interesting but not entirely practical offshoot of this idea is a fund that buys (collects legally?) wallets with lots of crypto & lost passwords and tries to crack them over time.
This is already done. The feds and hackers have huge troves of wallets and files that they are trying to crack, either by finding holes in the encryption method used or brute force.
Re: Researchers cracked an 11-year-old password to a $3M crypto wallet
#13So Roboform has almost certainly thousands (of not millions) of users with weak passwords, and not only didn't they tell anyone, all they give is a shrug when asked about it.
What a bunch of bozos.
Re: Researchers cracked an 11-year-old password to a $3M crypto wallet
#14So Roboform has almost certainly thousands (of not millions) of users with weak passwords, and not only didn't they tell anyone, all they give is a shrug when asked about it. What a bunch of bozos.
Because the vast majority of ppl who use it will not be storing millions of dollars of crypto with it. Crypto changes the game totally.
Re: Researchers cracked an 11-year-old password to a $3M crypto wallet
#15It's not clear how datetime was used and why that became a weakness? Doesn't it improve the password security by taking some bytes from /dev/random and salting it with ?
The roboform password manager used datetime value as the seed of the pseudorandom generator, meaning that it would always generate the same password if the system clock time was the same. They managed to crack the wallet by reverse engineering the password manager and feeding its pseudonumber generator all datetime values between certain dates that were thought to be near the time when the original wallet owner had generated the password.
Re: Researchers cracked an 11-year-old password to a $3M crypto wallet
#16> They really annoyed me, because who knows what I did 10 years ago, He doesn’t seem to be very thankful.
I think it’s an artifact of translation or ESL. Imagine he said “pestered”. I don’t think he necessarily meant the effect it had on his mood.
Re: Researchers cracked an 11-year-old password to a $3M crypto wallet
#17The original video by Joe Grand: https://youtu.be/o5IySpAkThg
Highly recommended, didn't think I'd watch the whole thing but the production quality was great and it explains everything much better than the wired article.
Re: Researchers cracked an 11-year-old password to a $3M crypto wallet
#18So Roboform has almost certainly thousands (of not millions) of users with weak passwords, and not only didn't they tell anyone, all they give is a shrug when asked about it. What a bunch of bozos.
Because the vast majority of ppl who use it will not be storing millions of dollars of crypto with it. Crypto changes the game totally.
No it doesn't. What kind of an excuse is that?
When a password manager maker finds a vulnerability they should absolutely tell their users to regenerate their passwords!
Re: Researchers cracked an 11-year-old password to a $3M crypto wallet
#19Earlier quoted context omitted.
Because the vast majority of ppl who use it will not be storing millions of dollars of crypto with it. Crypto changes the game totally.
No it doesn't. What kind of an excuse is that? When a password manager maker finds a vulnerability they should absolutely tell their users to regenerate their passwords!
didn't the vendor fix it?
Re: Researchers cracked an 11-year-old password to a $3M crypto wallet
#20It's not clear how datetime was used and why that became a weakness? Doesn't it improve the password security by taking some bytes from /dev/random and salting it with ?
yes so knowing the datetime that was used to salt reduces the search space.