4 ms·
"For reasons too complex to explain here, even some systems, like Gmail's, that don't allow intruders to make millions of random guesses at a password can still
by pw 15y ago
"For reasons too complex to explain here, even some systems, like Gmail's, that don't allow intruders to make millions of random guesses at a password can still be vulnerable to brute-force attacks."
Anyone care to explain?
- deleted 15y ago[deleted]
- noahc 15y agoI don't know what he means here, but one possible way to brute force would be to iterate the username and not the password. It depends on what you're trying to do, but if you just want accounts you pick the top X number of passwords used then get a list of usernames and a healthy collection of proxies. As long as your list of usernames and proxies are long enough you should be able to brute force your way into a lot of accounts.
- biot 15y agoDistributed password guessing via a botnet with tens to hundreds of thousands of IP addresses would be one possibility. Keep the guessing below the ban threshold and you can brute force an account's password given enough time. This assumes Gmail only does IP rate limiting for login failures and doesn't impose any per-account restrictions, which could lock the legitimate account owner out in the event of an attack on their account.