3 ms·
When has an online service been compromised by brute forcing a password? Are there any records of this ever taking place? I don't mean when someone guesses tha
by con5ole 15y ago
When has an online service been compromised by brute forcing a password? Are there any records of this ever taking place?
I don't mean when someone guesses that the password is "123456" or "passw0rd", or when the password was revealed to a crook by mistake.
I mean situations where say, "gr8shoes" was not secure enough but "h43&22981gTddB%&$!" would have been.
- dspillett 15y agoI've seen bots try thousands of passwords for a single account on services that I've had access to the logs for. I can't name any instance when a password has been found by brute force rather than human engineering (or by bypassing authentication completely due to exploiting a software bug), and I've not seen it often, but there is code out there actively trying. Tools like fail2ban help a little here, but can't do much against a large botnet. Adding artificial delays into the authentication process can slow down a brute-force attempt without inconveniencing real users at all, but that botnet has a lot of time on its hands. It might not happen often, but attempts are made often enough (i.e. more than never) for keeping strong passwords to be worthwhile.
- con5ole 15y agoThanks, that is interesting and kind of matches my reasoning. I have a feeling the debate is a bit colored by leftover paranoia from the times when several users shared one computer and the password database was easy to get hold of. Unless the attacker somehow manages to grab your password database (and not your content, which would be an interesting setup in itself) he won't be able to brute force you. He will only be able to lucky-guess you. And you don't need 24 random characters to block a lucky guess scheme. :)
- Hyena 15y agoThis was my thought as well, I've never heard of a brute force attempt working in the real world.