Cracking the passwords: Don't blame the MtGox, USERS ARE STUPID - page 3.

bitsalame

donator

Activity: 714

Merit: 510

Preaching the gospel of Satoshi

Quote from: BTC Economist on June 20, 2011, 05:43:53 PM

Another thread clearly demonstrating the lack of understanding of how to achieve wide adoption. The attitude of many bitcoin users is another reason to bet against it long term.

Wide adoption with weak security is suicidal, sir.
Before trying to adopt demagogic methods to achieve wide adoption, lets teach them a lesson: this is money, better be safe than sorry.

I still don't understand this psychological barrier: if it is about tangible money, they buy the heaviest safe.
If it is untangible, they use straws to cover it.

And for the other user who talks about "test accounts", there is an awful amount of "test accounts".
No, sir, these users show a very very high degree of mental laziness:
user : cracked pwd
-------------------
jazy510 : mtgox1
joevm3 : mtgox1
wwwhatup : mtgox1
bitcoin.jstar : mtgox1
mglbt1 : mglbt1
ronello : ronello1
jonashuckestein : jonas1
jaydrum : jaydrum1
etc... (so far 581 passwords cracked)

I MEAN, SERIOUSLY?

I wrote a small tutorial to make very strong passwords and very easy to remember them:
http://forum.bitcoin.org/index.php?topic=19913.msg248514#msg248514

But still lazy people will be lazy enough to not even try to read it.

BitcoinPorn

hero member

Activity: 630

Merit: 500

Posts: 69

Users, while stupid, are not as stupid as systems that allow you to put in a user name as the password. I thought that was not allowed 'these days'

BTCrow

sr. member

Activity: 243

Merit: 250

BTCrow.com

Quote from: bitsalame on June 20, 2011, 04:09:46 PM

I am currently cracking the leaked password file just for fun and because I am curious.
Guess what?

1) Hundreds of accounts with their usernames as passwords.
2) Hundreds of accounts with the password "123456"
3) Hundreds of accounts with the password "testtest"
4) Hundreds of accounts with the password "bitcoin"

Are you guys STUPID?

TO THE THOUSANDS OF USERS WHO ARE THIS DUMB:
YOU DESERVE TO LOSE YOUR BITCOINS, IDIOTS.

This is the MAJOR problem of password mechanism. Users aren't able or too lazy to remember something more complex. Even if you force them using something complex, they will bypass this security measure by writing it down into a .txt or a paper on their desktop. Got a good conf at hackfest 2010 talking about weakness of password mechanism. Cause if you check that the password strenght is only measured by the brain.

How a brain can remember a password, for a lot of people if you're able to remember a 9 char password with letter / numbers / only one special caracter the most recent hardware and technics including GPU cracking won't ever be able to crack your brain.

We need to educate people in order to have good security but this is impossible to educate everyone.
Passwords, encrypted or not are really not a good authentification mecanism.

csshih

member

Activity: 96

Merit: 10

Quote from: bitsalame on June 20, 2011, 04:09:46 PM

1) Hundreds of accounts with their usernames as passwords.
2) Hundreds of accounts with the password "123456"
3) Hundreds of accounts with the password "testtest"
4) Hundreds of accounts with the password "bitcoin"

you realize that a ton of people create test accounts?

BTC Economist

member

Activity: 112

Merit: 10

Another thread clearly demonstrating the lack of understanding of how to achieve wide adoption. The attitude of many bitcoin users is another reason to bet against it long term.

tlan

newbie

Activity: 7

Merit: 0

It seems like it doesn't matter what the username/password combination is supposed to be protecting, it's the same every time. A lot of users just use silly passwords because they don't manage to remember something more advanced, and don't give much thought into what would happen if someone can access the data you're sitting on now.

I used to work as a sys.admin at a university with 30k students, and we used to crack passwords every now and then, our average was 500 passwords found by the first day every time.