Man, I seriously underestimated the power of GPU password crackers!
I had an 11-character password which I thought was pretty good--b1Ackb0x3!1, and that was cracked. I'm pretty sure I didn't succumb to any phishing attempts.
Good thing I use 20+ characters for passphrases.
I had an 11-character password which I thought was pretty good--b1Ackb0x3!1, and that was cracked. I'm pretty sure I didn't succumb to any phishing attempts.
Good thing I use 20+ characters for passphrases.
It depends. IIRC in the broadcast Mt. Gox mentioned that some of the older accounts were MD5 unsalted. In which case leetspeek pass isn't very good. Yours interestingly enough was salted.
IMHO this was simply bad luck in one of two senses:
i) Your password happened to be in some wordlist or is a simple permute of some worklist
ii) They started multiple crackers bruting specific keyspaces and yours was close to whatever the startpoint was for 11 char passwords.
By contrast I ran oclHashcat on my 6990 for my password and it seemed to say it would take 4 years to exhaust the keyspace but hey if someone here wants to divert some of their mining software to the cause they're welcome to show me the error of my ways. That would be pretty cool too....
Interesting side issue. If your organization uses google as a mail system and they perform password synchronization. They are shipping unsalted hashes to the big G (either SHA1 or MD5). I don't know how many people have access to encrypted hashes at Google but the sample seems large enough that it's only a matter of time before someone sees the money making potential there. (Password reset function + known gmail address + big ass hashing equipment = access to your Mt. Gox account).