4 ms·
Even if the target system doesn't have explicit login attempt limiting, you still run into the natural limitation of target CPU time. It's common to have login
by phire 4y ago
Even if the target system doesn't have explicit login attempt limiting, you still run into the natural limitation of target CPU time. It's common to have login attempt limiting just to avoid letting remote targets waste all your CPU time with bogus attempts.
The amount of passwords you can try against a single target with an online attack is extremely limited, not even enough for a decent sized dictionary attack. You would have to be using an absolute horrid password for the attacker to get a hit.
Online password attacks are only really viable when you don't care about the target. Just use tiny dictionary of a few thousand common username/passwords pairs and hit every single ip address on the internet.
- Dylan16807 4y agoIf you think the natural limitation of target CPU time is enough to stop a brute force and the best description is "extremely limited", you are massively overestimating the average password. Keep in mind there is one-ish account in this scenario. https://web.archive.org/web/20150327031521/http://research.microsoft.com/pubs/74164/www2007.pdf https://web.archive.org/web/20150327031521/http://research.m... Going by this, a huge fraction of passwords are in the 30 bit range. And lots of basic web servers can do tens of thousands up to a hundred thousand requests per second per core. Which translates to 2^35 - 2^38 attempts per month per core you saturate, if the login implementation is lazy. Let alone the very many passwords in the 20 bit tier. And I think this paper didn't even consider dictionary words in their analysis of password strength, in which case it's giving much too high ratings to lots of passwords.