satoshin@gmx.com is compromised

[AGD]

I believe that post when he stated "I am not Dorian" is from SN. From the logs of the emails that were posted, the hacker just received access right before he sent the email to theymos. So, I believe that earlier post is legit...

Why didn't he sign that message to proof it was legit?

[1714186570]

1714186570

[1714186570]

1714186570

[1714186570]

1714186570

[1714186570]

1714186570

[wasserman99]

I believe that post when he stated "I am not Dorian" is from SN. From the logs of the emails that were posted, the hacker just received access right before he sent the email to theymos. So, I believe that earlier post is legit...

Why didn't he sign that message to proof it was legit?

No one questioned if the post was legit or not. It was assumed by the community that it was.

[AGD]

I believe that post when he stated "I am not Dorian" is from SN. From the logs of the emails that were posted, the hacker just received access right before he sent the email to theymos. So, I believe that earlier post is legit...

Why didn't he sign that message to proof it was legit?

No one questioned if the post was legit or not. It was assumed by the community that it was.

Not true. Some people need proof before they classify a message as "legit". Satoshi would not forget to sign it if he wanted everybody to believe it was him without a doubt.
He found it important enough to break his silence after years to post this strange message, but forgot to sign it to proof it was legit? No way...

[dewdeded]

The site also reveals to anyone attempting to reset that the alternate email is  s******@v********.com
This is pretty piss-poor security, since it's obvious that s****** is satoshi and there are lists of free email providers, even ones from 5 years ago that have domains now expired or parked that could be bought and tried against the reset:
vahoo.com
...
vr9.com

The reset email shown could be set by the current hacker, if it was previously s******@g****.com it would be even more obvious what else to compromise.

s******@v********.com is "satoshi@vistomail.com". This is general knowledge, Satoshi used the Vistomail-adress e.g. at the Cryptography-mailing-list [1] or for Bitcoin-related public announcements/postings/publications/communication [2].

1 = http://marc.info/?l=cryptography&m=122694149201952&w=2
2 = http://library.uniteddiversity.coop/Money_and_Economics/bitcoin.pdf & http://blog.dustintrammell.com/2013/11/26/i-am-not-satoshi/

[itod]

s******@v********.com is "satoshi@vistomail.com". This is general knowledge, Satoshi used the Vistomail-adress e.g. at the Cryptography-mailing-list [1] or for Bitcoin-related public announcements/postings/publications/communication [2].

1 = http://marc.info/?l=cryptography&m=122694149201952&w=2
2 = http://library.uniteddiversity.coop/Money_and_Economics/bitcoin.pdf & http://blog.dustintrammell.com/2013/11/26/i-am-not-satoshi/

Interesting comment in those emails regarding the reusing of addresses:

Address book labels for receiving addresses is confusing but I'm not sure what else to do.  Anyone using it for more than just simple purposes would need to create different receiving addresses for each payer so they could tell who's paying them.  That concept doesn't have much analogy in the real world.

Satoshi

[proofofarat]

Looking at GMX's password recovery process, to recover an account it looks like they will either send an email to s***@v*****.com
or they will let you enter your birthdate. Perhaps somebody exploited one of these two options?
reddit formatting markdown fucked up the email address characters, but it looks like S followed by 6 stars @ V followed by 8 stars

entering birth date is rate limited to 3 attempts per 24 hrs. So probably wasn't accessed through this unless the attacker had narrowed down the range a bit

[Skinnyman]

Looking at GMX's password recovery process, to recover an account it looks like they will either send an email to s***@v*****.com
or they will let you enter your birthdate. Perhaps somebody exploited one of these two options?
reddit formatting markdown fucked up the email address characters, but it looks like S followed by 6 stars @ V followed by 8 stars

entering birth date is rate limited to 3 attempts per 24 hrs. So probably wasn't accessed through this unless the attacker had narrowed down the range a bit

This has already been discussed and is likely how he gained access. Think someone said it would take max a year to guess the birthdate by bruteforce.

[wasserman99]

Looking at GMX's password recovery process, to recover an account it looks like they will either send an email to s***@v*****.com
or they will let you enter your birthdate. Perhaps somebody exploited one of these two options?
reddit formatting markdown fucked up the email address characters, but it looks like S followed by 6 stars @ V followed by 8 stars

entering birth date is rate limited to 3 attempts per 24 hrs. So probably wasn't accessed through this unless the attacker had narrowed down the range a bit

This has already been discussed and is likely how he gained access. Think someone said it would take max a year to guess the birthdate by bruteforce.

I would think that the hacker likely changed the password reset questions once he gained access to the account. I would not be surprised if some hacker was able to exploit some kind of vulnerability at gmx (and potentially sold this information on some dark web site). 

[FloodZone]

Looking at GMX's password recovery process, to recover an account it looks like they will either send an email to s***@v*****.com
or they will let you enter your birthdate. Perhaps somebody exploited one of these two options?
reddit formatting markdown fucked up the email address characters, but it looks like S followed by 6 stars @ V followed by 8 stars

entering birth date is rate limited to 3 attempts per 24 hrs. So probably wasn't accessed through this unless the attacker had narrowed down the range a bit

Would take 4 months max to crack the birth date.. So it's quite possible.

[jabo38]

Looking at GMX's password recovery process, to recover an account it looks like they will either send an email to s***@v*****.com
or they will let you enter your birthdate. Perhaps somebody exploited one of these two options?
reddit formatting markdown fucked up the email address characters, but it looks like S followed by 6 stars @ V followed by 8 stars

entering birth date is rate limited to 3 attempts per 24 hrs. So probably wasn't accessed through this unless the attacker had narrowed down the range a bit

Would take 4 months max to crack the birth date.. So it's quite possible.

If somebody knew the exact calendar year, that's true. But do we really really know exactly what year he was born?

[Buge]

Looking at GMX's password recovery process, to recover an account it looks like they will either send an email to s***@v*****.com
or they will let you enter your birthdate. Perhaps somebody exploited one of these two options?
reddit formatting markdown fucked up the email address characters, but it looks like S followed by 6 stars @ V followed by 8 stars

entering birth date is rate limited to 3 attempts per 24 hrs. So probably wasn't accessed through this unless the attacker had narrowed down the range a bit

People in this thread have already said that even though it claims to limit you to 3 tries per 24 hours, it actually doesn't limit you.

[ALXBOB]

http://motherboard.vice.com/read/the-satoshi-nakamoto-email-hacker-says-hes-negotiating-with-the-bitcoin-founder?trk_source=recommended

[TsuyokuNaritai]

http://motherboard.vice.com/read/the-satoshi-nakamoto-email-hacker-says-hes-negotiating-with-the-bitcoin-founder?trk_source=recommended

Why does everyone keep reposting this as if it's still news?

[giveBTCpls]

http://motherboard.vice.com/read/the-satoshi-nakamoto-email-hacker-says-hes-negotiating-with-the-bitcoin-founder?trk_source=recommended

Why does everyone keep reposting this as if it's still news?

Lol. Hasn't it proved already the "hacker" was a dumb kid that got doxed? OP should update the thread with the info so people dont keep asking or something.

[SomethingElse]

http://motherboard.vice.com/read/the-satoshi-nakamoto-email-hacker-says-hes-negotiating-with-the-bitcoin-founder?trk_source=recommended

Why does everyone keep reposting this as if it's still news?

Lol. Hasn't it proved already the "hacker" was a dumb kid that got doxed? OP should update the thread with the info so people dont keep asking or something.

I am not sure.  http://blogs.wsj.com/moneybeat/2014/09/12/bitbeat-satoshi-nakamoto-hacked-or-not-remains-anonymous/

[Bill Bisco]

It would have been nice if the hacker released Satoshi's old emails foe posterity.  It's a real shame we had such an idiot hacker.

[AGD]

I don't believe in this "idiot hacker" story at all.

[DubFX]

There are lots of sites where you can send mail under fake e-mail address, it's simple.

[UsernameBitcoin]

Looking at GMX's password recovery process, to recover an account it looks like they will either send an email to s***@v*****.com
or they will let you enter your birthdate. Perhaps somebody exploited one of these two options?
reddit formatting markdown fucked up the email address characters, but it looks like S followed by 6 stars @ V followed by 8 stars

entering birth date is rate limited to 3 attempts per 24 hrs. So probably wasn't accessed through this unless the attacker had narrowed down the range a bit

Would take 4 months max to crack the birth date.. So it's quite possible.

If somebody knew the exact calendar year, that's true. But do we really really know exactly what year he was born?

If Satoshi is only one person and not a group, just try the birth dates of

Nick Szabo, Wei Dai, David Chaum, John Nash, Adam Back, Tatsuaki Okamoto, Hal Finney, Neal King, Vladimir Oksman, Charles Bry, Michael Weber, Shinichi Mochizuki, Robert A. Hettinga, Gavin Andresen, and Ray Dillinger

and you have your Satoshi.

[marcus_of_augustus]

Looking at GMX's password recovery process, to recover an account it looks like they will either send an email to s***@v*****.com
or they will let you enter your birthdate. Perhaps somebody exploited one of these two options?
reddit formatting markdown fucked up the email address characters, but it looks like S followed by 6 stars @ V followed by 8 stars

entering birth date is rate limited to 3 attempts per 24 hrs. So probably wasn't accessed through this unless the attacker had narrowed down the range a bit

Would take 4 months max to crack the birth date.. So it's quite possible.

If somebody knew the exact calendar year, that's true. But do we really really know exactly what year he was born?

If Satoshi is only one person and not a group, just try the birth dates of

Nick Szabo, Wei Dai, David Chaum, John Nash, Adam Back, Tatsuaki Okamoto, Hal Finney, Neal King, Vladimir Oksman, Charles Bry, Michael Weber, Shinichi Mochizuki, Robert A. Hettinga, Gavin Andresen, and Ray Dillinger

and you have your Satoshi.

... it is common practice for pseudonyms to use cryptic yet significant dates, numerology or the like. 1/1/1971, 2/8/82, etc ...