3 ms·
I believe he meant the will try the top 100 most common passwords on each account on the website directly, resulting on "82% of users at risk", assuming 82% of
by MasterScrat 10y ago
I believe he meant the will try the top 100 most common passwords on each account on the website directly, resulting on "82% of users at risk", assuming 82% of users use one of these 100 passwords.
Strong brute-force protection (eg block account for exponential times) could mitigate this attack vector.
- user5994461 10y agoWhy are you guys talking about live site and rainbow table??? The attackers have the salts and the hashes, they can brute force the hashes offline with [ocl]hashcat as they wish. Top 100 passwords * 43M accounts is only ~4B hashes to compute. We don't know what bcrypt parameters they used but we're probably talking a few hours here, maybe only a few minutes.
- novaleaf 10y agoto brute force the top 100 passwords, only the usernames were really required. can easily bruteforce the top 100 passwords on a live site. you are right that it's now very easy to use dictionary attacks now, on all the credentials offline. and those with super weak passwords will have their accounts compromised.