New MtGox password

[michaelmclees]

So, umm, what exactly are the requirements of our new passwords?

For example, something like "mic396pip$!" is apparently not strong enough for Mt Gox.  What's the deal?

[1713852836]

1713852836

[1713852836]

1713852836

[1713852836]

1713852836

[1713852836]

1713852836

[anatolikostis]

So, umm, what exactly are the requirements of our new passwords?

For example, something like "mic396pip$!" is apparently not strong enough for Mt Gox.  What's the deal?

use passgenerator soft...20-digit pass will fit to...
something like a ........GMqojrOcjjCFeqhCNwzM......

[dodgrr]

This is insane, there has to be a better way to security 

[michaelmclees]

This is insane, there has to be a better way to security 

I agree.  I used lastpass to generate a 20 character password which it accepted.  But I remember trading stocks on Zecco with a password weaker than what I originally had on MtGox.  Oh well.

[Randall Flagg]

Well, use something like keepass. Will help you get through the day, just avoid keyloggers.

So true ! LOL

[hawks5999]

14 chars accepted with upper/lower/number/symbol

[Oldminer]

This is insane, there has to be a better way to security 

RSA token IMO

[myrkul]

Two options:

1: Lastpass/Keepass/password manager du jour

Pros: Random, nigh impossible to crack.
Cons: Twice as impossible to remember, Database may be vulnerable if you use a weak password.

2: GRC's Password Haystack Method.

Pros: Easy to remember, hard to crack
Cons: Difficulty to crack is based on how good your haystacking method is.

Examples:
Generated from my Lastpass: R7b!ij2zi^74QVS
Made up for a previous thread: !....1gOd1....!

Test them, if you'd like.

[hawks5999]

This is insane, there has to be a better way to security 

RSA token IMO

Or Not:

In a letter to customers Monday, the EMC Corp. unit openly acknowledged for the first time that intruders had breached its security systems at defense contractor Lockheed Martin Corp. using data stolen from RSA.

Read more: http://online.wsj.com/article/SB10001424052702304906004576369990616694366.html#ixzz1PweLseTU

[ttyler333]

A better way to secure would be the do aes_254 encryption.. i beleive thats what the banks are using. As well has a sha1 or md5 hash that has been salted. Very easy to do.

Also maybe throw in some geolocation into the login process. So you have to be atleast from the same country or even same state/region.

All security should be on mtgox's end, not your guy's. A simple password of "hi" should be secure. Look at the recent hacks against sony. They didnt secure anything so 1 million people had account info stolen and then if you had that list you could get on their email, find paypal or other payment sites... All because one site did not encrypt or hash anything. Security resides within. Also do not reuse passwords. Plain and simple!. Reuse them if you want but don't over use them. Keep a different password for your email account.
Simple PHP MD5 Salting.

Code:

$salt= 'SOME UNIQUE STRING MAYBE WITH NUMBERS';
$password = md5($salt.$password);

[myrkul]

A simple password of "hi" should be secure.

Uh... No. That would get cracked in milliseconds. No matter what the security on the server side was.

[ttyler333]

A simple password of "hi" should be secure.

Uh... No. That would get cracked in milliseconds. No matter what the security on the server side was.

I do not think you understand... But anywho, lets keep you in the dark

[myrkul]

A simple password of "hi" should be secure.

Uh... No. That would get cracked in milliseconds. No matter what the security on the server side was.

I do not think you understand... But anywho, lets keep you in the dark

A weak password is a weak password. IP geolocation will not save you from the hacker next door.

[qed]

32 random characters is my new standard.

Nice, where did you write it? Into a txt file on your desktop?

[perfectchoice4u]

I understand everyone wants to be super secure and all that good jazz.

But why don't i need a 20 character password for paypal or my banks or whatever,
filled with all kinds of crap garbage and symbols and all other kinds of stuff?

"Spotruns22" = good enough (and no thats not my password)

My point is, this shit has nothing to do with your password.
Your password could be 1000 characters long and contain upside down letters in it too.
It all means jack if the mtgox site isn't secure. Bottom line.

The problem here wasn't that your password wasn't good enough guys. Its that they were taken.

[ttyler333]

A simple password of "hi" should be secure.

Uh... No. That would get cracked in milliseconds. No matter what the security on the server side was.

I do not think you understand... But anywho, lets keep you in the dark

A weak password is a weak password. IP geolocation will not save you from the hacker next door.

Yeah you do have a point but i was talkin about a database being taken too and the person having the hashes/encryption. Anyways if they just brute force it, then yeah... don't matter the password is SOL unless they implement some features to lock an account after 5 attempts in 15 mins or something and say 10 in 30 would be an ip ban. Of course ip bans are almost pointless.Throw in cookie checker or some vbscript and save a file to their pc. Problem solved if they don't know you saved that file. Anyways security really isnt that good for online activity once they have that database.

[myrkul]

Anyways security really isnt that good for online activity once they have that database.

My Password was in that database. It was not cracked.