5 ms·

can't you design your software to prevent brute force logins? i.e. lockout for x seconds if y unsuccessful login attempts are made?

city41 15y ago
That doesn't matter if someone has a dump of the database. Which as Sony can tell you, is becoming more common.
- brianbreslin 15y ago
  good point. i'll have to read up on how sony's db got extracted first then.
  - bonzoesc 15y ago
    SQL injection, social engineering a password, somebody's crappy "secret question," insecure PHP, and hundreds of other ways. Closing off known avenues of attack and still mitigating against a leak with peer-reviewed math is what you have to do.
- pragmatic 15y ago
  Yes, but once you are in to the point where you have the db...what else are you going after? If you can dump the db then (most likely) you also have the credit cards, other information that is useful to you? This assumes a hacker has a financial motivation.
  - city41 15y ago
    I would hope the db didn't store credit card info or at least encrypted it somehow. Granted that's a pretty big hope. But if you can crack the passwords in the db you have, chances are those passwords will work on other sites. People often use one password for everything.
  - ceejayoz 15y ago
    > Yes, but once you are in to the point where you have the db...what else are you going after? There are many conceivable attacks that would result in a read-only dump of password hashes. An administrator's account would be useful in such an administration, turning your read-only access to read-write access.
  - barrkel 15y ago
    Passwords are frequently reused.
ndl 15y ago
Hopefully, the hashes are physically secure and accessed in a way that would require a great deal of human effort to steal. If that is the case, then yes, you can control the login process. The technique in the article is relevant when one has the hashes and wants the plaintext (and according to some here, still easy to mitigate then) - if you're guessing a web login, different game.

city41 15y ago

That doesn't matter if someone has a dump of the database. Which as Sony can tell you, is becoming more common.

brianbreslin 15y ago
good point. i'll have to read up on how sony's db got extracted first then.
- bonzoesc 15y ago
  SQL injection, social engineering a password, somebody's crappy "secret question," insecure PHP, and hundreds of other ways. Closing off known avenues of attack and still mitigating against a leak with peer-reviewed math is what you have to do.
pragmatic 15y ago
Yes, but once you are in to the point where you have the db...what else are you going after? If you can dump the db then (most likely) you also have the credit cards, other information that is useful to you? This assumes a hacker has a financial motivation.
- city41 15y ago
  I would hope the db didn't store credit card info or at least encrypted it somehow. Granted that's a pretty big hope. But if you can crack the passwords in the db you have, chances are those passwords will work on other sites. People often use one password for everything.
- ceejayoz 15y ago
  > Yes, but once you are in to the point where you have the db...what else are you going after? There are many conceivable attacks that would result in a read-only dump of password hashes. An administrator's account would be useful in such an administration, turning your read-only access to read-write access.
- barrkel 15y ago
  Passwords are frequently reused.

ndl 15y ago

Hopefully, the hashes are physically secure and accessed in a way that would require a great deal of human effort to steal. If that is the case, then yes, you can control the login process. The technique in the article is relevant when one has the hashes and wants the plaintext (and according to some here, still easy to mitigate then) - if you're guessing a web login, different game.