All great hackers use hotmail

I don't buy it...
and even if I did buy it.....
and I certainly wouldn't pay for it in bitcoins!

Seems appropriate http://forum.bitcoin.org/index.php?topic=19360.0

Isn't it that even if they did manage to get a copy of the user database they would only find the password hashes and not the actual passwords? So if you had a secure password, there is probably nothing to worry about.

Yeah I would suggest changiing the password too. But I think the mtgox would use multi-round hashing to protect stupid people that use 'password' as a password.

I fear nothing! Say it. I fear nothing!

If you're using dictionary words - even if there's numbers & capital letters, there's a high chance your password will be found. Hybrid dictionary attacks process a shit ton of passwords/second regardless of how complex the md5 & salt equation is.

Unlikely unless you're sloppy.

To prove the point, 10 bitcoin for each pass for any of these unsalted MD5s:

824cfad07c88261afb4dd3285627887a
73550477b12849b2a4dcd3b0db187415
3e567bcbb2aa5c28c47012b857bf6e48
3709fb6b0e1c0b26ff22a19ae92fd080
9133c451dd761d29943dcc653252e2fa
ff111d6144367b4abd99aa4321b0a618
8602188ef5a05a13afc59c51b395426c
da842aa7c84236d17a04098fa1273f2d

Have fun! ;P

EDIT: alphanumeric only. I'll pay legitimate finds or my name is mud!

Challenge accepted.

MagicalTux has already responded to these false claims via IRC:

While I'd agree that it seems likely the offer of the database for sale is a fake and just intended to shake confidence in Mt. Gox given all of the other activity that's going on, MagicalTux's response doesn't instill much confidence. In fact suggesting things like salted hashes would protect the passwords and no suspicious logins found sound exactly like the kinds of reports that come in early from actual intrusion victims. Most salted hash schemes in use won't protect people with weak to crack passwords, which will be about 99% of the users, and a SQL injection compromise which is by far the most likely approach wouldn't involve OS logins. The fact that there was a recently discovered CSRF hole lends credence to the idea that there could easily have been a SQLi. And while he may be playing dumb, he doesn't sound like he has the instrumentation in place that would even necessarily allow him to discover an intrusion like that after the fact, even if he knew what to look for.

So while it's only smart for him to categorically deny any intrusion he doesn't have direct evidence of, and I'd still rate the HN post as much more likely to be fake than real, I'd still personally change my password all the same.  Tux really couldn't give you that advice unless he'd already found and closed a flaw without tanking his business.

Rainbow tables != reverse lookup tables.

It's stupid as fuck banking on MD5 - either the plaintext for those hashes is really long and/or not actually alphanumeric, or he's going to be some 80BTC poorer in a couple weeks. If they really are <16 chars, unsalted and alphanumeric, I'd be willing to bet the 80BTC is probably worth more than what you'd spend on some Amazon EC2 instances to break it in a hurry...

It's also stupid as fuck chaining multiple rounds of MD5 together, particularly without changing the salt each time. - I believe you actually make it weaker to rainbow table attacks by doing that... but I'm absolutely no expert in cryptography by any stretch of the imagination.

Regardless, if there's any evidence at all that the DB is taken, assume the passwords are broken. Now where's the credible evidence the DB was taken?