Mt.Gox Accounts and passwords released, impact to BTC econ

[warsmith]

How do you think the released passwords for MtGox accounts will impact the BTC price? Personally, I think it will drive the price down, because of the bad publicity related with such leaks.


P.s. http://www.megaupload.com/?d=XHMMAIU8 <- The file with the accounts and  hashed (maybe salted too?) passwords.

[1714160438]

1714160438

[1714160438]

1714160438

[1714160438]

1714160438

[Goldenmaw]

Would somebody scan that thing on a computer isolated from sensitive bitcoin related material?

[Bit_Happy]

It will be hard to have prices actually fall to $1 (for example) since there is so much money to be made on bear market rallies. Eventually the (temporary) massive over-supply of BTC will win out and we could see prices in the $1 to $4 range, IMO. The story continues, stay tuned...

[warsmith]

Would somebody scan that thing on a computer isolated from sensitive bitcoin related material?

Dude, treat it as a plain text *.TXT....

[Goldenmaw]

No offense to you personally warsmith, but paranoia pays around these parts.

[warsmith]

No offense to you personally warsmith, but paranoia pays around these parts.

None taken. It would destroy the thread and the user's browsers if I'd pasted the whole 3mb text file as a reply.
Anyway. I hope everyone changes the password asap when it comes back online.

[ploum]

It means a lot of questions. I've asked some of them here:
http://thebitcoinsun.com/post/2011/06/19/Huge-crash-and-compromized-datas-on-MtGox

But I don't have answers yet. (be welcome to comment on the article page)

[EricSU]

I just received this email from mtgox.

Dear Mt.Gox user,

Our database has been compromised, including your email. We are working on a
quick resolution and to begin with, your password has been disabled as a
security measure (and you will need to reset it to login again on Mt.Gox).

If you were using the same password on Mt.Gox and other places (email, etc),
you should change this password as soon as possible.

For more details, please see this:

https://support.mtgox.com/entries/20208066-huge-bitcoin-sell-off-due-to-a-compromised-account-rollback

The informations there will be updated as our investigation progresses.

Please accept our apologies for the troubles caused, and be certain we will do
everything we can to keep the funds entrusted with us as secure as possible.


The leaked data includes the following:

- Account number
- Account login
- Email address
- Encrypted password

While the password is encrypted, it is possible to bruteforce most passwords
with time, and it is likely bad people are working on this right now.


Any unauthorized access done to any account you own (email, mtgox, etc) should
be reported to the appropriate authorities in your country.


Thanks,
The Mt.Gox team

[DukeOfEarl]

I just received this email from mtgox.

I haven't gotten mine yet, but I like that they at least own up to it.

[dinzy]

I can confirm my username and email are on the list.  Damn. 

Is everyone going to open up a tradehill account and crash that market ( the server, not price) as soon as they get in?

[Clipse]

Im confused, didnt get any email and Im a fairly bigtime trader o_0

[warsmith]

no comment about the salt though

[dev^]

What might happen with those users who didn't enter an email address? (including me...)
How can they log in again, if all passwords were resetted? 

[warsmith]

What might happen with those users who didn't enter an email address? (including me...)
How can they log in again, if all passwords were resetted? 

Perhaps they didn't reset all of them?

[TurboK]

I looked at that password list. Only around 1800 passwords were kept in regular md5, those are piss easy to crack (see http://www.md5decrypter.co.uk/ if you don't have a rainbow table setup already). The other 60000 were using some other format I did not recognize, though possibly by my own fault... they remind me of Wordpress passwords. It's probably some combined multiple md5 + hash, so I'd think that they are difficult if not impossible to crack, especially if you used a password that is long enough with a wide enough character set.

The danger for password reuse is very real though. It is in theory possible to find a less secure password from some site you signed up to, recover the password from there, and use it at mtgox with your username. So if you use the same password at mtgox or anywhere else, you'll NEED to change passwords. Otherwise you are fairly safe, provided your account is not one of those with regular md5 hashes (the ones not starting with $1$whatever are regular md5s).

[dev^]

What might happen with those users who didn't enter an email address? (including me...)
How can they log in again, if all passwords were resetted? 

Perhaps they didn't reset all of them?

I hope so...

[Tolsi]

where is user of number 51190 in the file?!

[digimag]

No offense to you personally warsmith, but paranoia pays around these parts.

None taken. It would destroy the thread and the user's browsers if I'd pasted the whole 3mb text file as a reply.
Anyway. I hope everyone changes the password asap when it comes back online.

I hope mt gox will refund everybody and close after this disaster.

[bcpokey]

UPDATE REGARDING LEAKED ACCOUNT INFORMATIONS

We will address this issue too and prevent logins from each users. Leaked information includes username, email and hashed password, which does not allow anyone to get to the actual password, should it be complex enough. If you used a simple password you will not be able to login on Mt.Gox until you change your password to something more secure.

I'm not sure what their definition of simple is. I can't remember if I used an email addy on mtgox, and if I didn't my password was pretty complex, so hopefully I can get in and get mah moniez.

[bustaballs]

I submitted my first coin to mtgox last night and now it's saying my account doesn't exist. I hope I get my account and my 1 BTC back.