6 ms·
if you use the same password on multiple sites and any one of them gets hacked, hackers can brute force against the stored hash to "recover" your original passw
by mindstab 15y ago
if you use the same password on multiple sites and any one of them gets hacked, hackers can brute force against the stored hash to "recover" your original password, which is probably tied to an email address.
- tlrobinson 15y agoTrue, but the article makes it sound like the systems themselves are vulnerable to brute forcing, whereas the vulnerability you describe is with the user (plus a vulnerable unrelated system). I'd like to know what the author really meant.
- mkjones 15y agoNot sure what he meant, but it's usually possible to brute force even decent online auth systems. Since most of these systems are rate-limited per-account, instead of iterating over passwords for a given account, you can iterate over accounts for a given (common) password. This won't work for a targeted attack, but if you have thousands of valid email addresses, trying them all with e.g. "password" as the password will likely yield a few for which it works.
- tlrobinson 15y agoRate-limiting by IP address seems like a pretty obvious defense, is that really not common?
- mkjones 15y agoThis becomes hard when you have many users behind one IP (corporate NATs, schools, entire countries, etc), and when attackers can hop proxies fairly easily.
- JonnieCache 15y agoBotnets are cheap to rent.