4 ms·
They were hashed using the standard php crypt() method, it generates a salt for every password encrypted. I'm in that database and was able to generate the exac
by olex 15y ago
They were hashed using the standard php crypt() method, it generates a salt for every password encrypted. I'm in that database and was able to generate the exact hash. Luckily I use one-time passwords with such things...
- Tichy 15y agoHm, if it is using the same hash all over the world (on your computer it has the same salt as on the MtGox server?), what is the point? I don't understand how this salting scheme is supposed to work? Edit: Ah OK, the salt is encoded in the String.
- zachanker 15y agoIn theory, it just slows it down so rainbow tables are ineffective (not that people need them anymore), and it requires you to brute force each password than brute forcing one password and then checking it against everything. In reality, it's all MD5 and the passwords were leaked to a community who are running tons of GPUs to brute force hashes. So it's kind of irrelevant.
- drpancake 15y agoThe salt is one of the other fields in the row? I'm pretty sure I used unimportant password, but I can't remember for sure!
- olex 15y agoYou can recreate the hash by calling crypt() in php with your PW and the full hash as arguments. Basically, the hash is built like $1$_salt_$_hash_ - by feeding it as an argument to the function, you make it use the same salt used originally at encryption, when it was randomly generated. This is exactly the way these hashes are verified on login.
- SeanLuke 15y agoWait. The effective exchange for bitcoins worldwide is using PHP internally? People are actually trusting this with thousands of dollars in cash?
- fredoliveira 15y agoI'm not even much of a PHP fan, but it seems like you're unaware of what most people use. Including financial institutions.
- Ixiaus 15y agoHaha. I came from PHP and won't ever go back, but, you would be surprised what people use PHP for.