4 ms·
For reasons too complex to explain here, even some systems, like Gmail’s, that don’t allow intruders to make millions of random guesses at a password can still
by mixmax 15y ago
For reasons too complex to explain here, even some systems, like Gmail’s, that don’t allow intruders to make millions of random guesses at a password can still be vulnerable to brute-force attacks.
I'm curios as to what the reasons are? How do you bruteforce a gmail account? Surely Google will not allow you millions of tries?
- Joakal 15y agoIt's seemingly infinite amount of tries because after 2-3 failed password attempts, you get a captcha to do.
- rdl 15y agoPassword reuse by end users puts even a relatively well secured site like gmail at risk of user passwords being brute forced. Break into a less-well-secured site, steal the password file, which may use something like md5. Brute force offline. Then, try that password and username on a more secure site like gmail.
- sausagefeet 15y agoI'm glad I switched to 1Password and switched all of my accounts to a different randomly generated password. I'm sure I'm using it in some insecure way but at least all of my passwords are different.
- ajross 15y agoThis. I continue to be saddened at the extent to which "DON'T REUSE PASSWORDS EVER" isn't the first sentence and summary to any discussion of this stuff. Even people who should know better (c.f. posters right here on this site) don't, and those who do get distracted talking about more "interesting" stuff like GPU hashing algorithms instead. Just don't do it. And tell all your friends.
- sukuriant 15y agoBut it's so hard to. Really. Most people aren't willing to spend the time (I know I'm not). It takes more memorization (unless you use exploitable tricks) and most people think they're mostly safe, so "what's the point?", they think.
- ajross 15y agoPick one good pass phrase and use it an the encryption key to a gpg-locked file where your auto-generated passwords are stored. This is what I do. There are commercial products that are isomorphic to this process, though I haven't used any of them. Even a web browser will do this for you (sans the auto-generation part), though they're not good at archival or replication of the passwords.
- jaylevitt 15y agoI'm kinda shocked that of all the "experts" the reporter talked to, nobody used more than a dozen passwords. I'm no crypto geek, I don't force SSL everywhere, I've never used TOR or anonymous VPNs or anything - but I have a few different password systems that allow me to use and remember semi-unique, word-free passwords on any site I care about. If you were targeting me personally, and you obtained the plaintext of a few dozen passwords, you could probably figure one of them out; if you're running a typical automated attack, you're going to miss me. I can't possibly be the fastest runner from this bear.
- itsnotvalid 15y agoWhat password systems are you using?
- jaylevitt 15y ago1. Stick non-alpha characters in the middle of words. Not 31337 substitutions; additions. Now your dictionary word isn't a dictionary word anymore. 2. Use the first letter of each word in a phrase. Again, now it's easy to remember but not a dictionary word. 3. Find a way to customize the password for each site in such a way that you can remember the pattern. Use letters from the stock symbol, the dominant color, the domain name, or some other word you associate with that site. Boom - now your password is unique per site.
- pyre 15y ago> "DON'T REUSE PASSWORDS EVER" You can reuse your password as long as it's for an account that you don't care about. The more secure the account needs to be the more secure that password needs to be. I.e. use the same password for all crap accounts, use a pattern for semi-secure accounts, and use separate, secure passwords for all secure accounts.
- runn1ng 15y agoThat's not possible. If you use the internet a little bit, you are almost constantly required to chose more and more new passwords. To newspapers sites to comment, to registration forms, to buy tickets to some concert, etc etc. You cannot use different password for each of them. And password systems are overkill for most people (certainly is for me). Really, what IS sensible is having sensitive sites with different passwords and "who cares" sites with simillar ones. As the author actally says in the end of the article.
- tlrobinson 15y agoSure it's possible. Use a mentally computable one-way "hash" when creating your passwords, such that you (and only you) can generate a unique password based on some attribute of the system you're creating the password for (name, domain name, etc). Of course that's also too much work for the average user. I think single sign-on systems with two factor authentication and other advanced security are a step in the right direction.
- mindstab 15y agoif you use the same password on multiple sites and any one of them gets hacked, hackers can brute force against the stored hash to "recover" your original password, which is probably tied to an email address.
- tlrobinson 15y agoTrue, but the article makes it sound like the systems themselves are vulnerable to brute forcing, whereas the vulnerability you describe is with the user (plus a vulnerable unrelated system). I'd like to know what the author really meant.
- mkjones 15y agoNot sure what he meant, but it's usually possible to brute force even decent online auth systems. Since most of these systems are rate-limited per-account, instead of iterating over passwords for a given account, you can iterate over accounts for a given (common) password. This won't work for a targeted attack, but if you have thousands of valid email addresses, trying them all with e.g. "password" as the password will likely yield a few for which it works.
- tlrobinson 15y agoRate-limiting by IP address seems like a pretty obvious defense, is that really not common?
- mkjones 15y agoThis becomes hard when you have many users behind one IP (corporate NATs, schools, entire countries, etc), and when attackers can hop proxies fairly easily.
- JonnieCache 15y agoBotnets are cheap to rent.