Quote from: bitsalame on June 21, 2011, 12:42:48 AM

Quote from: btyako on June 21, 2011, 12:36:55 AM

i'm sorry but not storing passwords without decent salts as well as decent hashes is the fault of mtgox.

getting access to a database that isn't salted is like hitting a goldmine because of the fact that so many people use the same passwords (iloveyou, password etc) when you get access to an unsalted hash user databaseit would look like this (sort by password, or whatever they call their password column):
8e6c488d2eb01fc691470ceb3a6f700c
8e6c488d2eb01fc691470ceb3a6f700c
8e6c488d2eb01fc691470ceb3a6f700c
746dd6c349cb2e97923be477e8d96423
746dd6c349cb2e97923be477e8d96423
(insert tons of other random md5's)
since they aren't salted you instantly see that there are multiple passwords that have the exact same hash (and therefore the exact same password) so if you crack one of them, you've cracked all of them..

with salted hashes you have a random salt combined with the hash up there to create a new salted hash, which generally means that every 'password' that a person who has access to the database sees is 100% unique (since each user gets a random salt and that salt is added to their password to create a salted password)

so if for example you have a database of 100,000 users all salted and hashed passwords, no 2 passwords will be cracked at the exact same time, it would take more time to crack a decent amount of passwords unlike with what happened to a bunch of mtgox accounts (which they admitted were there, but claim they are older accounts and their passwords are salted and hashed properly)

not only that but not requiring more advanced passwords is the fault of the site, not of the user.

The thousands of passwords that I ALREADY CRACKED are all salted ones.
It doesn't matter if it is Blowfish, SHA-1 or whatever algorithm, if you are using 123456 as your password, you'll be more more fuckable than a horny bitch.

you do understand the difference between cracking 1 password and unlocking 500 of them because they are the exact same password and being forced to crack all of them right?
thats my point.

btyako

Posts

Merits