4 ms·

I am unconvinced. What about persistent password bruteforcing? Rate limits? OK, bruteforcing is happening within those rate limits. That's how the password rots

I am unconvinced. What about persistent password bruteforcing? Rate limits? OK, bruteforcing is happening within those rate limits. That's how the password rots - it becomes less of a secret as many values are tried. Key material rotation seems to be a sensible practice in general.

whoomp12342 5y ago
if your password is strong, this negates bruteforcing, unless if there is a good reason someone would want to hack you.
q3k 5y ago
With a ratelimit of 60 attempts per minute (which is significantly higher than any user would legitimately ever need) you're looking at thousands of years to bruteforce a random 6 character alphanumeric password.
- new_guy 5y ago
  This seems remarkably unintuitive, but the math checks out. (26+10)⁶ = 2,176,782,336 1,450 minutes a day 2,176,782,336 / (1,450 * 60) = ~25,000 years
  - tejohnso 5y ago
    You went from min per day multiplied by constant per min and ended up with years somehow.
    - q3k 5y ago
      My reasoning: Number of 6-character alphanumeric passwords: (2*26+10)**6 == 56800235584 Number of seconds in a year: 60*60*24*365 == 31536000 Number of years to enumerate all 6-character alphanumeric passwords at one password a second: >>> ((2*26+10)**6)/(60*60*24*365) 1801.1236549974633 (this assumes that alphanumeric is [a-zA-Z0-9], which some might disagree with)
- jffry 5y ago
  Yeah and if your system allows an attacker to sustain one attempt per second into perpetuity, then you need to improve your system. Just be wary of DOS attacks against users when considering things like per-user limits (versus per-IP limits)
- jandrese 5y ago
  The problem is that ratelimiting doesn't work when your password database is leaked. Brute force attacks on the front end system basically don't happen because rate limiting is everywhere. They'll try a handful of default passwords and move on.
thesuitonym 5y ago
What you're saying is true, but you need to consider a regular office drone who doesn't care about security. If you require them to change the password every 90 days, you will end up with the majority of people having passwords like conS0t01, conS0t02, conS0t03... And not only will they have such weak passwords, they will boast about this to anyone who will listen, leading users to actually tell other people their password, and how they arrive at (And remember) the current mutation.
- mmis1000 5y ago
  And when it arrived at the point user themselves are confusing about "wait, is it end at 33 or 34?". They Will Write It Down On Post It. And you end up get the worst security situation you can get normally.
tialaramex 5y ago
> it becomes less of a secret as many values are tried. Not meaningfully. Let's take my Hacker News password and we'll imagine you happen to know (somehow) exactly what the format is, so then you start guessing. And we'll imagine you can make 1 billion login attempts per second, which in fact I'd guess will make dang pretty unhappy 'cos the servers won't like that. And maybe you get to do this on a billion computers, and for a billion seconds, again I'm thinking somebody would notice and stop you, but let's just say... At the end of all that you've still got orders of magnitude less chance of guessing my password, for this web site correctly than a random ticket buyer has of winning the jackpot in a typical state or national lottery game. Get a new hobby. I think people struggle with the numbers involved. Even astronomical numbers are too small, because astronomical numbers involve practical things, like how quickly light travels and maths does not need to be practical.
- notduncansmith 5y ago
  Regarding your last point: "There are 10^11 stars in the galaxy. That used to be a huge number. But it's only a hundred billion. It's less than the national deficit! We used to call them astronomical numbers. Now we should call them economical numbers." - Richard Feynman
- andrey_utkin 5y ago
  Let's take my library account. Sequentially issued card numbers, 4-digit PINs. :(

whoomp12342 5y ago

if your password is strong, this negates bruteforcing, unless if there is a good reason someone would want to hack you.

q3k 5y ago

With a ratelimit of 60 attempts per minute (which is significantly higher than any user would legitimately ever need) you're looking at thousands of years to bruteforce a random 6 character alphanumeric password.

new_guy 5y ago
This seems remarkably unintuitive, but the math checks out. (26+10)⁶ = 2,176,782,336 1,450 minutes a day 2,176,782,336 / (1,450 * 60) = ~25,000 years
- tejohnso 5y ago
  You went from min per day multiplied by constant per min and ended up with years somehow.
  - q3k 5y ago
    My reasoning: Number of 6-character alphanumeric passwords: (2*26+10)**6 == 56800235584 Number of seconds in a year: 60*60*24*365 == 31536000 Number of years to enumerate all 6-character alphanumeric passwords at one password a second: >>> ((2*26+10)**6)/(60*60*24*365) 1801.1236549974633 (this assumes that alphanumeric is [a-zA-Z0-9], which some might disagree with)
jffry 5y ago
Yeah and if your system allows an attacker to sustain one attempt per second into perpetuity, then you need to improve your system. Just be wary of DOS attacks against users when considering things like per-user limits (versus per-IP limits)
jandrese 5y ago
The problem is that ratelimiting doesn't work when your password database is leaked. Brute force attacks on the front end system basically don't happen because rate limiting is everywhere. They'll try a handful of default passwords and move on.

thesuitonym 5y ago

What you're saying is true, but you need to consider a regular office drone who doesn't care about security. If you require them to change the password every 90 days, you will end up with the majority of people having passwords like conS0t01, conS0t02, conS0t03... And not only will they have such weak passwords, they will boast about this to anyone who will listen, leading users to actually tell other people their password, and how they arrive at (And remember) the current mutation.

mmis1000 5y ago
And when it arrived at the point user themselves are confusing about "wait, is it end at 33 or 34?". They Will Write It Down On Post It. And you end up get the worst security situation you can get normally.

tialaramex 5y ago

> it becomes less of a secret as many values are tried. Not meaningfully. Let's take my Hacker News password and we'll imagine you happen to know (somehow) exactly what the format is, so then you start guessing. And we'll imagine you can make 1 billion login attempts per second, which in fact I'd guess will make dang pretty unhappy 'cos the servers won't like that. And maybe you get to do this on a billion computers, and for a billion seconds, again I'm thinking somebody would notice and stop you, but let's just say... At the end of all that you've still got orders of magnitude less chance of guessing my password, for this web site correctly than a random ticket buyer has of winning the jackpot in a typical state or national lottery game. Get a new hobby. I think people struggle with the numbers involved. Even astronomical numbers are too small, because astronomical numbers involve practical things, like how quickly light travels and maths does not need to be practical.

notduncansmith 5y ago
Regarding your last point: "There are 10^11 stars in the galaxy. That used to be a huge number. But it's only a hundred billion. It's less than the national deficit! We used to call them astronomical numbers. Now we should call them economical numbers." - Richard Feynman
andrey_utkin 5y ago
Let's take my library account. Sequentially issued card numbers, 4-digit PINs. :(