NXT account hacked. All assets gone.

[devphp]

Actually the PW strength probably wasn't the issue.

In NXT, which is a brain wallet, PW strength is exactly the issue.

OP says it was a word + number + symbol = 12 chars.

So, something like this: Generation5!

It was most likely brute-forced using a dictionary.

Something like this: MaQorLdNxE5!    would be much more secure, also 12 characters, but no dictionary words. At least 20 or more random characters are recommended for better security, with no dictionary words.

[Nullu]

This is what worries me about NXT. Can't you just literally bruteforce it until you come across weak passwords?

[devphp]

This is what worries me about NXT. Can't you just literally bruteforce it until you come across weak passwords?

Someone is doing exactly that. Try to create an account with a simple password, fund it with a few coins and track how long it'll take for coins to disappear Someone did that experiment in Bitcoin with a brain wallet too, brain wallet with a phrase like 'hello, world' or something, it was gone in 5 mins. Moral of the story: use a truely random pass of 20+ chars and keep your PC clean from trojans of course.

[Spoetnik]

This is what worries me about NXT. Can't you just literally bruteforce it until you come across weak passwords?

yeah and that is not FUD'ing but a valid concern !!!

[Yuzu]

Thanks EvilDave.  While I'm changing ALL of my passwords I don't want to put my old one out yet.  It was very simple for a hacker and I meant to change it but kept putting it off.  It was just a Word+number+symbol.  Twelve characters.  Bad, bad, bad.  For anyone who is out there reading this and thinks they have a 'good enough' password, for goodness sakes update it right now.  This truly sucks, and you don't want to be in my postion.  

Actually the PW strength probably wasn't the issue.

Malware and using it on other sites are more than likely the issue.

If you were too lazy to change it,

then there is a high probability you reused it or a similar variation of it somewhere else.

~BCX~

Ah...trojans and dodgy sites are possible, but don't forget that there are also guys running rainbow tables against the NXT blockchain 24/7.
Any simple (or well known) password will be compromised, given enough time.
Had a guy on www.NXTforum.org a few days ago who had chosen a Bible verse as his password, and that got compromised pretty quickly.

The answer is simple: use a complex password, ffs. Not one that is easy to remember......
35 characters, upper+lower case, numbers and symbols.

@Yuzu: I know how much getting shit stolen hurts, so post or PM me your new NXT account (with a supersecure password) and I'll send 1000 NXT to help you back on track a little bit.

Dave, that's so damn nice of you.  But I can't take anything from anybody, though I appreciate the offer more than I can tell you.  Take that 1000NXT and get some of a nice asset like USDbitfnx.  It's a nice quiet little asset that pays out every two weeks.  I'm going to buy more of it when I get more funds.  But thanks, thanks, thanks!

[Spoetnik]

This is what worries me about NXT. Can't you just literally bruteforce it until you come across weak passwords?

Someone is doing exactly that. Try to create an account with a simple password, fund it with a few coins and track how long it'll take for coins to disappear Someone did that experiment in Bitcoin with a brain wallet too, brain wallet with a phrase like 'hello, world' or something, it was gone in 5 mins. Moral of the story: use a truely random pass of 20+ chars and keep your PC clean from trojans of course.

and even more importantly as BitcoinExpress just said.. DO NOT RE-USE YOUR PASSWORDS !

EVER !!!!!!!!!!!!!!!!!!!!!!! period !!!!!!!!!!!!!!!

you can have 9327587298467508926409750602916843509287640956 of random characters
but when you re-use it.. your fucked !

[Nullu]

This is what worries me about NXT. Can't you just literally bruteforce it until you come across weak passwords?

yeah and that is not FUD'ing but a valid concern !!!

They could easily introduce some basic protection. Prevent weak passwords from being allowable. Temp I.P ban users who make too many password attempts. Force two-step verification. There are so many options to choose from, and I can't see any valid counter-argument to implementing some basic security protection.  You wouldn't expect your online bank to let you have such weak security.

[Magic8Ball]

Thanks EvilDave.  While I'm changing ALL of my passwords I don't want to put my old one out yet.  It was very simple for a hacker and I meant to change it but kept putting it off.  It was just a Word+number+symbol.  Twelve characters.  Bad, bad, bad.  For anyone who is out there reading this and thinks they have a 'good enough' password, for goodness sakes update it right now.  This truly sucks, and you don't want to be in my postion.  

Very sad to hear. I hope that the thief gets his comeuppance soon.

I had one simple account created initially which had a few hundred NXT, but its all gone long back. I haven't looked into NXT since.

[EvilDave]

This is what worries me about NXT. Can't you just literally bruteforce it until you come across weak passwords?

Someone is doing exactly that. Try to create an account with a simple password, fund it with a few coins and track how long it'll take for coins to disappear Someone did that experiment in Bitcoin with a brain wallet too, brain wallet with a phrase like 'hello, world' or something, it was gone in 5 mins. Moral of the story: use a truely random pass of 20+ chars and keep your PC clean from trojans of course.

and even more importantly as BitcoinExpress just said.. DO NOT RE-USE YOUR PASSWORDS !

EVER !!!!!!!!!!!!!!!!!!!!!!! period !!!!!!!!!!!!!!!

you can have 9327587298467508926409750602916843509287640956 of random characters
but when you re-use it.. your fucked !

Its a strange moment....total agreement with Spoetnik!
This was the cause of the BTER hack: if you re-use a password, and it gets compromised somewhere.....the rest of your shit is immediately compromised.

@Yuzu: good luck, mate. I'll see if I can find some orphans to pass a 1000 NXT on to......

[EvilDave]

This is what worries me about NXT. Can't you just literally bruteforce it until you come across weak passwords?

yeah and that is not FUD'ing but a valid concern !!!

They could easily introduce some basic protection. Prevent weak passwords from being allowable. Temp I.P ban users who make too many password attempts. Force two-step verification. There are so many options to choose from, and I can't see any valid counter-argument to implementing some basic security protection.  You wouldn't expect your online bank to let you have such weak security.

Account Control is coming up soon as a NXT feature....it'll allow you to cold-wallet and lockdown your account.
But the point is: the user is responsible for his own security.
NXT is safe, provided you use a decent password and the normal security precautions such as anti-malware scanners and not clicking on every link you see.

[Nullu]

This is what worries me about NXT. Can't you just literally bruteforce it until you come across weak passwords?

yeah and that is not FUD'ing but a valid concern !!!

They could easily introduce some basic protection. Prevent weak passwords from being allowable. Temp I.P ban users who make too many password attempts. Force two-step verification. There are so many options to choose from, and I can't see any valid counter-argument to implementing some basic security protection.  You wouldn't expect your online bank to let you have such weak security.

Account Control is coming up soon as a NXT feature....it'll allow you to cold-wallet and lockdown your account.
But the point is: the user is responsible for his own security.
NXT is safe, provided you use a decent password and the normal security precautions such as anti-malware scanners and not clicking on every link you see.

Ultimately it's the user's responsibility, yes, but even allowing weak passwords to begin with seems counter-intuitive if hackers are allowed unlimited password attempts.

[MacDuro]

I'm still using the one that they randomly generate , I know bad move ... time to create another wallet , transfer funds and pay the damm NxT fess .

[Yuzu]

I'm still using the one that they randomly generate , I know bad move ... time to create another wallet , transfer funds and pay the damm NxT fess .

Dude, do it right now.  Don't be like me! 

[EvilDave]

I'm still using the one that they randomly generate , I know bad move ... time to create another wallet , transfer funds and pay the damm NxT fess .

The fee you see on the transfer page is only a suggestion.......1 NXT is the minimum, and it doesn't matter how much you transfer.
Someone should have told the BTER hacker that, as he paid out the recommended 51,000 NXT fee on the transfer out of BTERs account.....one very happy forger!

BTW: the random 12 word passphrase that current NXT clients have should be secure enough. We've never heard of a randomly generated passphrase being compromised, only bad user-chosen passwords. 

[MacDuro]

I'm still using the one that they randomly generate , I know bad move ... time to create another wallet , transfer funds and pay the damm NxT fess .

The fee you see on the transfer page is only a suggestion.......1 NXT is the minimum, and it doesn't matter how much you transfer.
Someone should have told the BTER hacker that, as he paid out the recommended 51,000 NXT fee on the transfer out of BTERs account.....one very happy forger!

BTW: the random 12 word passphrase that current NXT clients have should be secure enough. We've never heard of a randomly generated passphrase being compromised, only bad user-chosen passwords. 

Thax for all your advices , didn't know about the fess , I think I will create another account just because that password in English is really hard to rememeber for me .

[sx100]

The fee you see on the transfer page is only a suggestion.......1 NXT is the minimum, and it doesn't matter how much you transfer.
Someone should have told the BTER hacker that, as he paid out the recommended 51,000 NXT fee on the transfer out of BTERs account.....one very happy forger!
 

Would the hacker's transaction have confirmed faster because he paid the 51,000 NXT fee, or would it have confirmed just as fast if he had paid a 1 NXT fee?

[digital7]

oh, maybe you are water army   

[Zer0Sum]

This is what worries me about NXT. Can't you just literally bruteforce it until you come across weak passwords?

yeah and that is not FUD'ing but a valid concern !!!

They could easily introduce some basic protection. Prevent weak passwords from being allowable. Temp I.P ban users who make too many password attempts. Force two-step verification. There are so many options to choose from, and I can't see any valid counter-argument to implementing some basic security protection.  You wouldn't expect your online bank to let you have such weak security.

I doubt that you hear about even 10% of crypto hacks...
In fact, virtually all security deficiencies are automatically blamed on "password hacks".

Would you put $1,000,000 on the NXT platform?

OP, don't feel bad...
For every post I read where the user maybe was careless...
I read another one where victim was an amateur cryptologist, jumped through 100 hoops, and still got ripped off.

Decentralized crypto security = Free Lunch.

[NattyLiteCoin]

So the the password I got from NXT is not secure?

Freeze gulp magnetic vibe manifest knee sprain winter ungulate hoofed your mom

Solid fucking gold right there.

[devphp]

So the the password I got from NXT is not secure?

Freeze gulp magnetic vibe manifest knee sprain winter ungulate hoofed your mom

Solid fucking gold right there.

12 random words generated by the client are secure.

It's when a user rejects that random pass and invents their own weak password that most of the hacks take place.

If you can't invent your own secure password, just use what the client software tells you to use and you'll be safe.