5 ms·

this is the only way to fight incompetence of some websites. those passwords are (most likely) unsalted vanilla MD5 hashes. just entered a few of them into goog

by lubos 15y ago

this is the only way to fight incompetence of some websites. those passwords are (most likely) unsalted vanilla MD5 hashes. just entered a few of them into google from that file and yes, many of them are present in rainbow tables. damn. makes me angry as a programmer how financial website can be this unsecure and easy to compromise.

jtchang 15y ago
They look like salted hashes to me.
- lubos 15y ago
  you can recognize salted hashes from unsalted ones just by looking at them? open the file and search for 5f4dcc3b5aa765d61d8327deb882cf99, at least 1,600 passwords in that list are unsalted. (those without $1$)
  - rorrr 15y ago
    5f4dcc3b5aa765d61d8327deb882cf99 = md5("password") for those who don't know Man, these programmers are fucking amateurs. It's a FUCKING TRADING PLATFORM.
    - jonknee 15y ago
      That's what happens when there's no regulation...
      - icebraining 15y ago
        You must not have been following the news: http://www.theinquirer.net/inquirer/news/2079431/citibank-hacked-altering-urls http://www.theinquirer.net/inquirer/news/2079431/citibank-ha... It happens everywhere.
        jfoutz 15y ago
        Would you be willing and able to point out the regulation violated? http://www.federalreserve.gov/bankinforeg/reglisting.htm http://www.federalreserve.gov/bankinforeg/reglisting.htm Cause, I don't think they broke any rules. Are they even required to keep those details secret? It's pretty clear marketing agencies can buy that data, so i don't think it's any sort of violation of privacy policy.
        gcb 15y ago
        icebraining, that's called irony ...i hope
    - leon_ 15y ago
      I find it funny that people are outraged about unsalted MD5 yet they use passwords like "secret123" that are found in every wordlist. Guess what: Even salted hashes won't save your ass with such weak passwords. And yes: it's a FUCKING TRADING PLATFORM you want to put money on so _you_ should think of a secure password.
      - krschultz 15y ago
        And what makes you think that the same people who are complaining about unsalted MD5 are also the same people who use passwords as weak as 'secret123'?

by lubos 15y ago

jtchang 15y ago

They look like salted hashes to me.

lubos 15y ago
you can recognize salted hashes from unsalted ones just by looking at them? open the file and search for 5f4dcc3b5aa765d61d8327deb882cf99, at least 1,600 passwords in that list are unsalted. (those without $1$)
- rorrr 15y ago
  5f4dcc3b5aa765d61d8327deb882cf99 = md5("password") for those who don't know Man, these programmers are fucking amateurs. It's a FUCKING TRADING PLATFORM.
  - jonknee 15y ago
    That's what happens when there's no regulation...
    - icebraining 15y ago
      You must not have been following the news: http://www.theinquirer.net/inquirer/news/2079431/citibank-hacked-altering-urls http://www.theinquirer.net/inquirer/news/2079431/citibank-ha... It happens everywhere.
      - jfoutz 15y ago
        Would you be willing and able to point out the regulation violated? http://www.federalreserve.gov/bankinforeg/reglisting.htm http://www.federalreserve.gov/bankinforeg/reglisting.htm Cause, I don't think they broke any rules. Are they even required to keep those details secret? It's pretty clear marketing agencies can buy that data, so i don't think it's any sort of violation of privacy policy.
      - gcb 15y ago
        icebraining, that's called irony ...i hope
  - leon_ 15y ago
    I find it funny that people are outraged about unsalted MD5 yet they use passwords like "secret123" that are found in every wordlist. Guess what: Even salted hashes won't save your ass with such weak passwords. And yes: it's a FUCKING TRADING PLATFORM you want to put money on so _you_ should think of a secure password.
    - krschultz 15y ago
      And what makes you think that the same people who are complaining about unsalted MD5 are also the same people who use passwords as weak as 'secret123'?