2 ms·
The existence of password breach databases means that attackers are already attempting other people's passwords against your accounts. We should honestly move
by geofft 8y ago
The existence of password breach databases means that attackers are already attempting other people's passwords against your accounts.
We should honestly move to the world where typical consumers are using password managers that generate passwords randomly. I think it is pretty reasonable to expect the typical consumer to install and use a password manager; I think it's pretty unreasonable to expect the typical consumer to generate memorable, strong, and unique passwords for each website and store them in their head.
- AmericanChopper 8y agoEven putting online attacks aside, breached password lists make fantastic dictionaries for cracking hashes.
- blackflame7000 8y agoRealistically even a dictionary attack for a login service should have some sort of flag after repeated incorrect passwords or at least be rate limited to some degree. It would really only be bad if they gained access to your hashed passwords database table because then the dictionary attack would immediately hit for some weak passwords. I argue that access to the hashes shouldn’t be allowed in the first place.