Quote from: kiba on July 23, 2012, 10:36:02 PM

Hi, you misunderstood me. I was talking about mtgox, not LastPass.

There would be no need to log in multiple times to MtGox. From what Genjix claimed, the thief hacked into their LastPass account, which had the new MtGox password stored within. It's the hacking into LastPass that would require guessing the password correctly within 5 attempts.

Quote from: genjix on July 13, 2012, 09:00:07 AM

We regret to inform you that there has been another huge breach of Bitcoinica. While all passwords were changed after the theft which occurred May 11th, the password for LastPass was not compromised and thus left unchanged. The breach today occured because the password for LastPass was in fact a duplicate password which had been compromised during the hack.

Unbeknownst to us, Tihan was using the mtgox api key as the password for a website called LastPass.

LastPass contains all your passwords. The username was info@bitcoinica.com. After the initial compromise, the sourcecode would have been tainted. But the password for LastPass was not changed.

Even if it was the original hacker, according to genjix the LastPass PW was not compromised. The password was the MtGox API key and that key was stored in the source that the Rackspace hacker would have had access to, but how likely is it that if you had 5 guesses you would choose an API key buried in the source vs attempting one of the other passwords that you did compromised to see if it was a duplicate of those?