3 ms·
Even a bad password can be immune to brute force if the attacker never gets their hands on the password hash. People always forget that there are two steps to
by phire 4y ago
Even a bad password can be immune to brute force if the attacker never gets their hands on the password hash.
People always forget that there are two steps to a password brute force attack. First the attacker needs to somehow get their hands on the password hashes (usually from a database hack or leak) and then they can brute force it offline.
The only thing a high-quality password does is make the second step harder.
- Dylan16807 4y agoGetting the hash makes brute force faster, but it's not in general necessary. How important it is depends on the password quality and how often you can try to login. If a system let you try one password per minute, and the password is in the dictionary, you could break it in a day or two with no hashes. And if the system isn't configured to limit login attempts, you could try orders of magnitude more passwords.
- phire 4y agoEven if the target system doesn't have explicit login attempt limiting, you still run into the natural limitation of target CPU time. It's common to have login attempt limiting just to avoid letting remote targets waste all your CPU time with bogus attempts. The amount of passwords you can try against a single target with an online attack is extremely limited, not even enough for a decent sized dictionary attack. You would have to be using an absolute horrid password for the attacker to get a hit. Online password attacks are only really viable when you don't care about the target. Just use tiny dictionary of a few thousand common username/passwords pairs and hit every single ip address on the internet.
- Dylan16807 4y agoIf you think the natural limitation of target CPU time is enough to stop a brute force and the best description is "extremely limited", you are massively overestimating the average password. Keep in mind there is one-ish account in this scenario. https://web.archive.org/web/20150327031521/http://research.microsoft.com/pubs/74164/www2007.pdf https://web.archive.org/web/20150327031521/http://research.m... Going by this, a huge fraction of passwords are in the 30 bit range. And lots of basic web servers can do tens of thousands up to a hundred thousand requests per second per core. Which translates to 2^35 - 2^38 attempts per month per core you saturate, if the login implementation is lazy. Let alone the very many passwords in the 20 bit tier. And I think this paper didn't even consider dictionary words in their analysis of password strength, in which case it's giving much too high ratings to lots of passwords.