They look like salted hashes to me.

lubos · on June 19, 2011

you can recognize salted hashes from unsalted ones just by looking at them? open the file and search for 5f4dcc3b5aa765d61d8327deb882cf99, at least 1,600 passwords in that list are unsalted. (those without $1$)

rorrr · on June 19, 2011

5f4dcc3b5aa765d61d8327deb882cf99 = md5("password")

for those who don't know

Man, these programmers are fucking amateurs. It's a FUCKING TRADING PLATFORM.

jonknee · on June 20, 2011

That's what happens when there's no regulation...

icebraining · on June 20, 2011

You must not have been following the news: http://www.theinquirer.net/inquirer/news/2079431/citibank-ha...

It happens everywhere.

jfoutz · on June 20, 2011

Would you be willing and able to point out the regulation violated?

http://www.federalreserve.gov/bankinforeg/reglisting.htm

Cause, I don't think they broke any rules. Are they even required to keep those details secret? It's pretty clear marketing agencies can buy that data, so i don't think it's any sort of violation of privacy policy.

gcb · on June 20, 2011

icebraining, that's called irony

...i hope

leon_ · on June 20, 2011

I find it funny that people are outraged about unsalted MD5 yet they use passwords like "secret123" that are found in every wordlist.

Guess what: Even salted hashes won't save your ass with such weak passwords. And yes: it's a FUCKING TRADING PLATFORM you want to put money on so _you_ should think of a secure password.

krschultz · on June 20, 2011

And what makes you think that the same people who are complaining about unsalted MD5 are also the same people who use passwords as weak as 'secret123'?