Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MtGox salted passwords cracked

pastebin.com

Post reply on HN
Print view View original

81–90 of 97 posts

Re: MtGox salted passwords cracked

#81

Post by gojomo »

andrewcooke wrote: post #58
andrewcooke wrote: post #27

i suspect some people here don't really know in any detail how password cracking works. you start with a dictionary. a good dictionary combines multiple passwords, slang, common patterns of keys on the keyboard, and old, known, passwords (so all the entries here will be added, for example). but that's just the start. the cracking programs also have rules. in simple terms these can be "shift to upper case" or "combine…

oops. "a good dictionary combines multiple passwords, ..." should be "a good dictionary combines multiple languages , ..." WTF. some fuckwit downvoted this? i wrote the text i am correcting. screw you. why do i bother to write useful comments? this place gets worse.

I think there are a few grumpy types that downvote for little reason, or perhaps completely arbitrarily. They're often the first votes in, as this action requires little consideration, and presumably such people have few other distractions.

Also, some downvotes are cast in error. This is very easy on touch-screens, and occasionally a problem elsewhere. Since totals are no longer displayed, a person may not even realize their intended upvote registered as a downvote.

So assume it was a mistake. Or a hopelessly grumpy person whose bad attitude is best ignored, rather than amplified with curses and complaints. Brush off the first downvote or two, and well-considered upvotes follow soon enough.

Re: MtGox salted passwords cracked

#82

Post by alanh »

AndyKelley wrote: post #72
SeoxyS wrote: post #71

This is a brute force / dictionary attack. Only "bad" passwords have been cracked. My password isn't on the list—it's a randomly generated 17-char string of alphanumeric and mixed case character. Btw, you should all check out 1Password. Automates the process, syncs with all my devices and dropbox, and integrates with all the major browsers.

It looks windows-only. Not going to work for me.

Um it most certainly isn't Win-only. 1Password has fantastic Mac and iOS apps.

Re: MtGox salted passwords cracked

#83

Post by shinratdr »

brianleb wrote: post #43
andrewcooke wrote: post #27

i suspect some people here don't really know in any detail how password cracking works. you start with a dictionary. a good dictionary combines multiple passwords, slang, common patterns of keys on the keyboard, and old, known, passwords (so all the entries here will be added, for example). but that's just the start. the cracking programs also have rules. in simple terms these can be "shift to upper case" or "combine…

I have a tangentially related question. During this LulzSec situation, I stepped into 2009 and started using LastPass. I generated 16 character random passwords for every place that I've been visiting. As I understand it, these passwords are encrypted on my machine and then uploaded to LastPass servers. When I login with my master password, I have access to all of these passwords unencrypted. My question: is there an…

Yes, it is. Use 1Password or KeePass because they aren't centrally hosted. 1Password even provides a little security through obscurity by using DropBox for its optional keychain syncing. People store a lot of uninteresting crap on Dropbox, filtering through to gather .agilekeychains would be a real PITA.

Re: MtGox salted passwords cracked

#84

Post by frederickcook »

andrewcooke wrote: post #75
frederickcook wrote: post #57

Earlier quoted context omitted.

Thanks. I was under the impression somehow that cracking the first few passwords would make it easier to crack the rest (by figuring out the salting scheme perhaps)? Also, if there is no restricted range of characters, and a solid, random password is used, how can the attacker know when they have broken it, short of trying them all against the actual server? Edit: Forget that last bit. I'm confusing myself.

actually, the last point is interesting, but goes the other way: the attacker doesn't have to find your password, just some text that hashes to the same value that is in the password file. that places an upper limit on how secure you can make passwords for any given hash (although in practice it's usually irrelevant).

Ok, this is interesting, so now we're talking about hashing collisions, right? The idea might be that if you just start iterating through all possible alphanumeric combinations, that it's possible you'd stumble on a successful collision before you'd stumble on the actual password. It seems this would only be likely once the number of possible passwords was greater than the number of possible hash outputs (32^66 for MD5, right)? That would occur if the length restriction on the password was greater than the length of the hash output, or a broader charset was allowed for the password than for the hashing output.

I guess if this ever actually became a relevant concern, you'd simply keep adding a few extra chars to the hashing algorithm output to keep it beyond the range of reasonable.

Re: MtGox salted passwords cracked

#85

Post by saurik »

wahnfrieden wrote: post #76
andrewcooke wrote: post #58

Earlier quoted context omitted.

oops. "a good dictionary combines multiple passwords, ..." should be "a good dictionary combines multiple languages , ..." WTF. some fuckwit downvoted this? i wrote the text i am correcting. screw you. why do i bother to write useful comments? this place gets worse.

Just so you know, there's an edit link in each of your posts, though it goes away after enough time.

(The two comments were made four hours apart.)

Re: MtGox salted passwords cracked

#86

Post by bitbear »

andrewcooke wrote: post #27

i suspect some people here don't really know in any detail how password cracking works. you start with a dictionary. a good dictionary combines multiple passwords, slang, common patterns of keys on the keyboard, and old, known, passwords (so all the entries here will be added, for example). but that's just the start. the cracking programs also have rules. in simple terms these can be "shift to upper case" or "combine…

Would you consider very long passwords (say 40 characters) containing only dictionary words to be safe?

Re: MtGox salted passwords cracked

#87

Post by andrewcooke »

bitbear wrote: post #86
andrewcooke wrote: post #27

i suspect some people here don't really know in any detail how password cracking works. you start with a dictionary. a good dictionary combines multiple passwords, slang, common patterns of keys on the keyboard, and old, known, passwords (so all the entries here will be added, for example). but that's just the start. the cracking programs also have rules. in simple terms these can be "shift to upper case" or "combine…

Would you consider very long passwords (say 40 characters) containing only dictionary words to be safe?

you can do the maths. if the words are drawn from a dictionary of size D and you use N words then the number of choices that need to be explored is D^N. the equivalent number of bits is log2 of that.

so what's D? i imagine most people would use common words, so let's take the most popular 1 percent of "dict/words" on my computer. that's 4,000 words. log2(D^N) = N * log2(D) = N * 12 (since log2(1000)~10).

now in another thread here there's an article saying that 9 characters drawn from an alphabet of 100 (lower+upper+symbols) is around the current limit. the equivalent number of bits there is log2(100^9) = 60. so you'd need about 5 words (5*12=60) for the same level of security.

tl;dr: you need more than 5 words (very) roughly. i am not 100% sure i have the maths right, either :o)

in more practical terms, i don't know of a program that actually does this. the programs i know about typically only combine a few words. but i am no great expert, and it would be fairly easy to write such a program.

[edit: actually, you are less safe than i estimate above if the attacker is smart, because the words probably aren't independent (most people will use meaningful sentences). so you can use markov chains to hugely reduce the search space (in more general terms: "the" will be followed by a noun phrase, etc). so you need significantly more than 5 words. heh. if someone wants to pay me to write such a program, please get in touch... ;o]

Re: MtGox salted passwords cracked

#88

Post by bradleyland »

AndyKelley wrote: post #72
SeoxyS wrote: post #71

This is a brute force / dictionary attack. Only "bad" passwords have been cracked. My password isn't on the list—it's a randomly generated 17-char string of alphanumeric and mixed case character. Btw, you should all check out 1Password. Automates the process, syncs with all my devices and dropbox, and integrates with all the major browsers.

It looks windows-only. Not going to work for me.

http://agilebits.com/products/1Password

Mac is the first platform listed.

Re: MtGox salted passwords cracked

#89

Post by bluesnowmonkey »

shinratdr wrote: post #83
brianleb wrote: post #43

Earlier quoted context omitted.

I have a tangentially related question. During this LulzSec situation, I stepped into 2009 and started using LastPass. I generated 16 character random passwords for every place that I've been visiting. As I understand it, these passwords are encrypted on my machine and then uploaded to LastPass servers. When I login with my master password, I have access to all of these passwords unencrypted. My question: is there an…

Yes, it is. Use 1Password or KeePass because they aren't centrally hosted. 1Password even provides a little security through obscurity by using DropBox for its optional keychain syncing. People store a lot of uninteresting crap on Dropbox, filtering through to gather .agilekeychains would be a real PITA.

If only there were a device that could automate computational tasks, such filtering would no longer pose a challenge. Some sort of compute-er...

Re: MtGox salted passwords cracked

#90

Post by 16s »

frederickcook wrote: post #53
andrewcooke wrote: post #27

i suspect some people here don't really know in any detail how password cracking works. you start with a dictionary. a good dictionary combines multiple passwords, slang, common patterns of keys on the keyboard, and old, known, passwords (so all the entries here will be added, for example). but that's just the start. the cracking programs also have rules. in simple terms these can be "shift to upper case" or "combine…

So this is not the complete set of passwords, only the ones that have been cracked so far, using a dictionary? Scanning through the list, very few look like a random set of characters that a password generator would come up with. Does that mean that passwords which were randomly generated are, and are likely to remain, safe?

You can actually calculate password bit strength/safety (assuming the chars are indeed random... and that's a big assumption). A randomly selected character from all printable ASCII characters (roughly 95 chars) has about 6.5 bits of entropy. So an eight character password is about 52-bits strong.

9 = 58.5-bits

10 = 65.0-bits

11 = 71.5-bits

Edit: Spelling & Grammar

Post reply on HN