3 ms·
If I know that I'm going to try to compromise a system and access its username/password lists, is there an advantage to creating a number of accounts to which I
by venning 10y ago
If I know that I'm going to try to compromise a system and access its username/password lists, is there an advantage to creating a number of accounts to which I know the password prior to the break-in?
Does this make it easier to break the other accounts once I have access to them encrypted? As in, I know that the account with username X has an unencrypted password Y, so now I have guideposts to tell if my cracking attempts are pointing in the right direction, trying to get back to password Y from the hashes. I imagine there would be something of an advantage to already knowing, say, 10,000 plaintext-encrypted pairs in a big list.
If this is the case, should one be concerned in managing a system that sees a dramatic uptick in new user registrations as a precursor to an attack?
- snowwrestler 10y agoOnly if you are not able to characterize the hashing scheme, or if you think the app uses a static salt that you don't know. Then having a known plaintext would help figure it out. But I think you would only need one, not a ton of them. It seems like if someone hacks a system so badly that they get the whole DB, they can probably also figure out the hashing scheme while they are in there. I doubt that a dramatic uptick in new user registrations is a useful precursor signal.