4 ms·
With a ratelimit of 60 attempts per minute (which is significantly higher than any user would legitimately ever need) you're looking at thousands of years to br
by q3k 5y ago
With a ratelimit of 60 attempts per minute (which is significantly higher than any user would legitimately ever need) you're looking at thousands of years to bruteforce a random 6 character alphanumeric password.
- new_guy 5y agoThis seems remarkably unintuitive, but the math checks out. (26+10)⁶ = 2,176,782,336 1,450 minutes a day 2,176,782,336 / (1,450 * 60) = ~25,000 years
- tejohnso 5y agoYou went from min per day multiplied by constant per min and ended up with years somehow.
- q3k 5y agoMy reasoning: Number of 6-character alphanumeric passwords: (2*26+10)**6 == 56800235584 Number of seconds in a year: 60*60*24*365 == 31536000 Number of years to enumerate all 6-character alphanumeric passwords at one password a second: >>> ((2*26+10)**6)/(60*60*24*365) 1801.1236549974633 (this assumes that alphanumeric is [a-zA-Z0-9], which some might disagree with)
- jffry 5y agoYeah and if your system allows an attacker to sustain one attempt per second into perpetuity, then you need to improve your system. Just be wary of DOS attacks against users when considering things like per-user limits (versus per-IP limits)
- jandrese 5y agoThe problem is that ratelimiting doesn't work when your password database is leaked. Brute force attacks on the front end system basically don't happen because rate limiting is everywhere. They'll try a handful of default passwords and move on.