Here's some important links you might want to check out! My Discord: discord.gg/rY4unvn RetroGamingNow Discord: discord.gg/retrogamingnow Tominecon.7z Team Discord: discord.gg/Q2BU69AN3S Download tominecon.7z: buu.sh/u/tominecon.7z

I like how Doge just casually has a bunch of leaked Mojang passwords like its nothing

All community: we finally cracked a decoy for 10 years !! Doge: pull outs an all old mojang pass word and did it in 1 day.

Please don't say "way back in 2020". It makes me feel old

Thank you so much for introducing me to this mystery! I had a blast learning about it and discussing it with everyone!

I can't believe you listed totally real passwords on screen like that. Anyway, gg!

10:15 your data will still be encrypted. It's just that you wouldn't know the key so the data will just be garbage and unusable

i just finished watching a video talking about how it will never be cracked, WHAT THE

This was solved because 2 people had random info lying around.

Alright but seriously, why wasn't "boxpig41" bruteforced sooner?

GGs to Doge who somehow decided to keep the old leaked passwords, then to Dinnerbone who helped have this spread further, and of course, the original user who had sent the real thing and not a decoy.

it was just 1.0 version of minecraft with minimal differences biggest differences being the extra files

great video! the only thing missing here is a mention that the server files are in fact different builds from the final 1.0.0. while code-wise (and even content-wise) they're identical, the final 1.0.0 server was built 6 hours after the tominecon 1.0.0 server, making them have different file hashes.

That explanation about encryption is.... entirely wrong. The parts about hex and dec are correct, but everything else is completely off the mark. 1. The server only ever sends _encrypted_ data. Your client only ever sends _encrypted_ data. There is no way for the game to do anything else, _by design_ . It would be a massive security risk if the opposite were the case, not only for your account details, but both your computer _and_ the server machine. 2. There is no way for encryption to "break" and be left completely open while in transit. That's not how encryption works, unless someone very stupid implements a fallback to plaintext which defeats the point of encrypting that data in the first place, as you could just force one side or the other to fail, receiving all that data without needing to decrypt it. 3. The server ID being parsed in the wrong base wouldn't initially cause an issue. In fact, you'd be able to _try_ to connect just fine. You wouldn't be able to fully connect, but you could try. 4. The reason it appears that multiplayer is completely disabled is because of a related (but different) problem. The first time the server (or your client, on modern versions it's the client) would try to send a packet the other would receive, what appears to them as, a garbled mess of incorrectly encrypted data. As such, they'd immediately close the connection, since trying to proceed would be a waste of time. The decryption fails because the encryption keys (in this case, the server id) would be different on either end, like trying to log in with the wrong password.

10:15 No, parseInt would just throw an exception, which would then be caught by the try-catch blocks surrounding that code, which would then disconnect. I don't even think the serverid is used for encryption, but if it is, the encryption wouldn't be "broken", it'd just fail to decrypt/encrypt anything because the keys don't match up.

7:09 "unless you have time travel and use it to connect to the office WiFi." Ok, another use of the password that we know now too.

The fact that it was broken in such a simple way without some expert cia level shit like that methods, along with the only difference of it between the offical 1.0 being 4 characters in the code feels so anticlimactically funny

Kinda strange all the mobs in the sounds folder had names in singular (blaze, ghast, magmacube, etc.) but endermen are listed there as "endermen"…

*Gives up after 13 years* "So, I cracked this password in just a second now this is public information."

haha I have been waiting for this video since the password got cracked lmao

I'm so disappointed nobody cracked an 8 character long password of printable ascii.

I feel like Minecraft’s greatest mystery get solved every week now…

3:36 Oh my God, I just love seeing other KZfaqrs I watch being mentioned in videos, this mystery would have gone in a very different direction if any of you didn't cover it! From the seeds of panoramas, to paintings, now passwords to files.

he sugarcoats a pointless thing the video

10:14 This is a very bold statement obviosuly made by someone who doesn't know how programming works. If encryption fails on a software, the device doesn't go "Oh well, guess I'm just gonna send everything unencrypted then!" for OBVIOUS reasons. At worse it may send junk data instead of actually readable encrypted data that may or may not be possible to reverse depending of the encryption scheme used assuming that incorrectly encrypting the data by ommiting the hex parts of the server ID makes the process reversible without further keying, but I HIGHLY doubt it. The most likely scenario is just that the server will go "wtf?" and reject the connection during the handshake step, and assuming it didn't, the client would just send irreversibly unreadable junk data. Also, not encrypting some data during an internet transfer doesn't mean that the average joe can see what you're sending. You still need to be on the same network as the person or have higher authority to spy on national or international internet transfers (like some countries do to catch torrent-ers)

Doge: "so i just happen to have a list of mojang passwords that *might* work, dont ask how or where i got it tho" 😭😭

would personally never have guessed the password to be 6 letters and 2 numbers, one would think that would’ve shown up in people’s dictionary attacks by now

this is so absolutely roaring.. GOOD EPIC MOMENT!

10:16 no, the data would be encrypted, the encrypted data just wouldn't be able to be read by the server since it didn't have the right decryption key. this would cause the client to be disconnected. also, passwords aren't sent to the server, your Mojang session ID was sent to the server. sending your password unhashed to an unofficial server is a huge no-no.

damn 13 years ggs guys

>Cracks a file >"16" That's... That's it?

It's crazy that someone named Doge did this considering the dog we all know as Doge (Kabosu) just passed away.

HOLY SPLAUGENSPLUGEN

13 years ago with this video being 13 hours ago

9:37 : it's not a "server id", it's an encryption key. the code literally says right there that if it fails to parse the "server id" it will stop and say "The server responded with an invalid server key". 10:09 : no, it couldn't. of course it couldn't. where in the world did you get that idea from? right in the oracle docs: Throws: NumberFormatException - if the String does not contain a parsable long. 10:13 : wrong again, the code says right there that if it fails to parse the "server id" it will stop and say "The server responded with an invalid server key". even if it *did* try to communicate without the right key, all of the data between the server and client would be garbled and a connection would never be established. did you run this section by someone who knows anything?

I love content like this about mysteries or old minecraft there all just really fun to watch ty MCBYT

this channel is just consistently good like seriously the amount of stuff that minecraft has undiscovered that you somehow find about and make thousands also be interested in is crazy

Yeah… I can see why no one wanted the password out there in the early days of the hunt (Even the people who claimed to have cracked the password said they probably shouldn’t have done it) if it was the making email password

The fact we not only cracked the password but learned TONS of stuff about the files is nuts. First, the contents of the file, and the fact it IS different from an actual release of 1.0 Minecraft- albeit very, VERY slightly. And yet that slight change was such a massive problem... quite interesting, honestly. Second, the password, which is amusingly only 8 characters long... go figure. No wonder they were so worried about the password... in fact, using the password strength checker shown earlier in the video, the password for the original file is WEAKER than the password for the decoy! Third, the two things the password was used for. Since it was originally for their email account, it makes sense why it was so worrying. But with that changed, it's a lot safer now. Dinnerbone wasn't kidding when he said that. And fourth, the fact that when many people are curious, nothing can stop them. This was probably the craziest thing that could have happened... but I'm glad that there's finally a concrete end to this saga. (Let's not go trying to crack any more files unless given advance knowledge that it's for an ARG or something.)

just boxpig41? that'd be literally the 41st thing I would've tried

i remember watching the original video on this,its good to see it come to completion

Jeez. I too would've want to encrypt this version if it was that troublesome.

hey thanks for this video this is super cool! im part of the RGN community and thought it was cool that you were the one who kinda was behind it popping up again!

I thought it was weird how RGN tried to imply that it was impossible to crack in his follow up videos after the first video blew up. I mean, weirder and more difficult things have been achieved before. It seemed like a matter of time and boy that was fast

This episode of MCBYT was brought to you by the number 16.

whats shader are you using

Dude this is AWESOME! I heard about the update from Dinnerbone, but I had no idea the password itself was actually cracked shortly after!

I was wondering about it just now

if only someone brought this to my attention way earlier...

I was hoping it would have some secret art that would be used in minecon

Good video, I'm glad youtube just randomly recommended this

Pls stop the clickbait, it's not a "great mystery" or "some mystical code", is just Minecraft 1.0 in password-protected archive with a lame password. A great mystery would be if someone reverse-engeneered the Minecraft binaries and found some advanced and complicated code that send encrypted data to Mojang servers for example. That would 100x more interesting than this nonsense.

such chill folks at mojang. and the interesting part is that, while the skills and methods may have malicious applications, by publically stating and engaging with the process they effectively give permission for users to try. as if its a challenge to them. ergo, while the tools may potentially be questionable, the act is not considered in violation of the law than if you added a randomised password to an empty file and then tried to get into it. it goes from an illegal act to one of grey legality.

Another classic MCBYT banger .

Finally! Always suprised what a community can do if everyone shows enough interest :)

Everyone involved in the search: This file will take years to be cracked, due to its- Doge: I solve this in 1 day

0:05 Is that ren-diggidy-dog on the right?

we could see whats inside even faster if someone used android unpack feature😭

Well done , everyone. I wasnt expecting this to be solved yet it was.

wow, I didn't expect it to be cracked!

this is so absolutely insane, EPIK!

I guess that some things need 13 years to be solved lol

I love how the first password was a Dune reference

TLDR: Dinnerbone said the pw was used for other thing in Mojang years ago and Doge just happen to have a list of old passwords used by Mojang

now its wifies turn to make a vid about tominecon being solved XD

IMO Minecraft's greatest mystery that has already been solved will forever be the seed for the pack.png image

But there are a few other questions, for example when you are in .minecraft/bin, there is a file that contains all the md5 hashes of the .jar files First, this file mentions a file called windows_natives.jar.lzma, which I couldn't find Second, all hashes match the hash of the file, except for minecraft.jar

mans with that JSRF tune

Cool, a great file for my endless data hoarding base

I wouldn't call a few digits of code the "Minecraft Greatest Mystery"...

8:44 we cracked **continues to add the lock sound**

how did people tried harshly to crack the password without any results if it was only 8 characters??

Thank goodness that version of the game was never released. Our multiplayer data could have been in so much danger!

This is a very well and incredibly made video! Very informative

so i remember being on a trying be on a server back in right after minecraft got it's 1.0 release, some friends and i was trying to get in to a server, kept giving us errors trying to join but invalid server key kept popping up, I believe somebody got it fixed during that time, sk89q released a class file, are you saying we actually might've had this issue right after the 1.0 release? it was quickly fixed, but still that was annoying trying to join a server.

getting an ad at 8:48 sucks bro 😭😭

Always a great day when MCBYT posts

0:24 Good music choice ! A bit nostalgic.

What a high quality video! I wonder why so little views

Well, Mojang must be pissed

4:10 Tonight, RGN (and his followers) join the hunt

Shit like this makes me wonder what other mysteries could be solved if the right person stumbled across it.

They accually got it

RIP Doge and hooray other Doge!

I heard the actual file wasn't able to be brute-forced like the decoy because it didn't use a common password, but "boxpig41" looks even more simple than the decoy's password???

what shader are you using in your footage?

I feel so good right now Finally - after ten years - inner peace 🙏

Minecraft mysteries are lowkey fun again!

Been waiting for this

The video starts at 8:48

mr. lahey?? oh god

lol its just minecraft 1.0 but with an authenication bug

i like the way your minecraft looks

wait, so it was all a Dune reference? Always was.

When I saw the notification first I thought this was RetroGamingNow

I still feel as if pack.png was a larger mystery

Soo we new that its the password they used for something else, we has a list of their leaked old passwords and no one before dodge thought abut using it?

Bro I rember this

What's funny is (at least my interpretation of it is) that dinnerbone essentially says it's fine to pirate this single instance of minecraft 1.0.0, like, that's just funny to me.

so what did Dinnerbone say about the discovery?