Post
Topic
Board Bitcoin Discussion
Re: Cracked Passwords List Leaked, were you cracked?
by
Uzza
on 29/06/2011, 00:38:36 UTC
As someone said, this is just 3001 of 61017 accounts. About 1700 of all accounts were unsalted.

It is very obvious, if you do the maths, that this cannot have been brute-forced.
A 15 character mix has a pretty good length advantage, purely on the number of combinations. And since there seems to be quite a few of that kind and above, I'll base calculations on that.
The most basic mix of characters would be numbers and lowercase letters, for a total of 36 different possibilities. That gives a 15 char long password a total of 36^15 or 2.21*10^23 combinations.
Since the bitcoin network is a very good indicator of hashing power, if we translate the current capacity (12.571 Thash/s) to only 5870 cards, that gives 31292 @ 400 Mhash/s.
The best numbers my cards would give was 3.9 billion combinations/s each, which gives the bitcoin network a total power of 122567 billion hashes each second, or ~1.23*10^14.

Simple mathematics then gives: 2.21*10^23 comb. / 1.23*10^14 comb./s = 1.80*10^9 seconds, or 57.2 years.
To get anything realistic for brute-forcing, they would need 21.4 million 5870 cars, which brings it down to one month for a single 15 char length password with only numbers and lowercase letters.
One of the passwords was 24 letters like that, which would take longer than the calculated age of the universe using the bitcoin network!

Conclusion, this is either malware/virus, some form phishing attack or, though unlikely, hash collision.