4 ms·

For a login situation with extreme rate limiting (say 3 tries a day) "high entropy" might not involve a lot of randomness. A random 8 character password handed

For a login situation with extreme rate limiting (say 3 tries a day) "high entropy" might not involve a lot of randomness. A random 8 character password handed out to a user is overkill. Two random words is overkill. Heck, a single diceware word would take 7 years to guess in that environment. For 100 years you only need something like 4 base32 characters.

__ryan__ 3y ago
This isn’t the attack vector to be concerned about. More concerning is when there’s a data breach and an attacker gains access to hashed passwords. At that point, you attack the hash not the API. This comment is an example of why I wouldn’t want any given website to choose my password.
- upofadown 3y ago
  That assumes the situation where the password hashes are stored in a way that is less secure than the actual data that the attacker ultimately wants access to. That must not be a very common situation. The passwords will not be of any use on any other system. This would eliminate password reuse.
  - __ryan__ 3y ago
    Accessing a users data is not the only reason for hacking their account. Performing actions on behalf of a user is just as much of a threat. Edit: also, if an attacker dumps all the data today then loses access to the data tomorrow, having access to my password hashes means they can access my account and data later.
codetrotter 3y ago
That’s all fun and nice until someone decides to antagonise you and they intentionally make three failed login attempts for your username into the website every n hours, keeping you unable to sign into your account.
- upofadown 3y ago
  I think that most people can come up with more effective ways to annoy someone.
  - hollerith 3y ago
    They do this to the accounts you use to communicate simultaneous with an attack on your reputation, i.e., when being able to to communicate suddenly becomes critical (for defending yourself against the allegations).
    - upofadown 3y ago
      An interesting attack I have never heard of up to now. Do you have a reference?
sjadoinqwoeihad 3y ago
You can't ratelimit someone you have not yet identified. Unless their username is also a password. But then you just have 2 passwords. And the ID password would have to be sufficiently high entropy to not be hit by bots.

__ryan__ 3y ago

This isn’t the attack vector to be concerned about. More concerning is when there’s a data breach and an attacker gains access to hashed passwords. At that point, you attack the hash not the API. This comment is an example of why I wouldn’t want any given website to choose my password.

upofadown 3y ago
That assumes the situation where the password hashes are stored in a way that is less secure than the actual data that the attacker ultimately wants access to. That must not be a very common situation. The passwords will not be of any use on any other system. This would eliminate password reuse.
- __ryan__ 3y ago
  Accessing a users data is not the only reason for hacking their account. Performing actions on behalf of a user is just as much of a threat. Edit: also, if an attacker dumps all the data today then loses access to the data tomorrow, having access to my password hashes means they can access my account and data later.

codetrotter 3y ago

That’s all fun and nice until someone decides to antagonise you and they intentionally make three failed login attempts for your username into the website every n hours, keeping you unable to sign into your account.

upofadown 3y ago
I think that most people can come up with more effective ways to annoy someone.
- hollerith 3y ago
  They do this to the accounts you use to communicate simultaneous with an attack on your reputation, i.e., when being able to to communicate suddenly becomes critical (for defending yourself against the allegations).
  - upofadown 3y ago
    An interesting attack I have never heard of up to now. Do you have a reference?

sjadoinqwoeihad 3y ago

You can't ratelimit someone you have not yet identified. Unless their username is also a password. But then you just have 2 passwords. And the ID password would have to be sufficiently high entropy to not be hit by bots.