4 ms·

I mean how weak are they really? These guys knew the algo and still struggled and pestered the user over and over for the other parameters. They also had what I

I mean how weak are they really? These guys knew the algo and still struggled and pestered the user over and over for the other parameters. They also had what I would describe as an extreme motivation to crack this.

GrantMoyer 2y ago
The fact that a password could be cracked at all means it was very weak. Strong passwords can't be cracked with any realistic amount of resources or motivation.
- loa_in_ 2y ago
  There's a small chance that your password will be my first roll in a random generator.
  - GrantMoyer 2y ago
    I used the absolute language "can't" intentionally, because frankly, in most contexts outside pure math it's more misleadling to state guessing a sufficiently long truely random password is possible than to say it's impossible. Humans can't really intuitively handle probabilities so small. It's the same reason we say heat "always" flows from higher to lower temerature.
arp242 2y ago
Hard to say without details; but now that the weakness is known it may become a lot easier. It's one thing if you think it may work if you have the correct parameters but aren't sure, and quite another if you know it will work. Password managers are kind of a "defence in depth" thing; practical speaking, a passwords.txt opened with notepad is probably fine for many people. No one is in your computer checking your files. You have a password manager for when that does happen, just in case. And usually this tends to be a targetted attack, which can range from some country's secret service to a jealous spouse to a trolling sibling. If that extra protection is ineffective ... yeah, that's not great. This really is "better safe than sorry" type territory. Password managers (including Roboform) already do this by notifying users a password may be insecure after a leak. A lot of the time that's not really needed if your password is sufficiently secure, but "better safe than sorry". This is not all that different.
boomboomsubban 2y ago
If it had a default creation setting, it would be much easier to crack most user's passwords. There's still a motivation issue, but that's not a solid defense.
- manquer 2y ago
  > Motivation issue i.e threat model. A lot of security processes are not designed for say state actors with library of 0- days or monopoly on violence(i.e. $5 wrench) that doesn’t make them bad. Security is a spectrum, perhaps some subset users needed a more secure system most probably still benefited from this tool ?
ipython 2y ago
The constraint is knowing when the password was created. If you know that within a day or so, that makes the problem much more tractable and you can instead focus on number of characters and the other parameters. Sniffing traffic (yes even encrypted) would be enough to see if you’re going through the login or initial user establishment flow, and that would give you a precise time when the password was generated. This is a serious flaw.
- Gigachad 2y ago
  Security people overusing the words serious and critical have really watered down the terms. At this point when I get told something is a serious risk, I file it next to being hit by lightning or eaten by sharks.
  - ipython 2y ago
    sorry to hear that. I don't exaggerate, but the unfortunate part is there is a lot of FUD out there- I just had a friend install nordvpn because someone sent her a gift card scam email to her business email address. So there's a lot of misinformation out there, mostly from folks selling product. Password management is one of those fundamental security foundations- essentially serving as the 'root of trust' for your own personal digital life. If you mess that up, you're in for a world of hurt. I don't mess around with passwords. Taking your analogy, would you intentionally stand outside under a tree in a thunderstorm, figuring that the risk of getting hit by lightning is so small?
    - Gigachad 2y ago
      In this situation, the attacker had to know you were using this particular password manager, know roughly when the password was generated, reverse engineer and replicate the password generation algorithm, and make millions of login attempts somehow (almost never possible other than on crypto wallets). Yes it’s obviously not good that they used the date as a seed, but the realistic risk is pretty much non existent. Even in this case where literal millions of dollars were on the line the “attackers” still had to collaborate heavily with the owner to narrow down the search space. On their own they likely would never crack it. Absolutely no one is going through all this to get in to your Facebook account when they can just call up some grandma and ask them to transfer a $1000.
nitwit005 2y ago
You can often learn when people create online accounts. Sometimes to the second or millisecond. It commonly shows on people's profiles. You can then try to log into every account, with passwords generated with the default settings.

GrantMoyer 2y ago

The fact that a password could be cracked at all means it was very weak. Strong passwords can't be cracked with any realistic amount of resources or motivation.

loa_in_ 2y ago
There's a small chance that your password will be my first roll in a random generator.
- GrantMoyer 2y ago
  I used the absolute language "can't" intentionally, because frankly, in most contexts outside pure math it's more misleadling to state guessing a sufficiently long truely random password is possible than to say it's impossible. Humans can't really intuitively handle probabilities so small. It's the same reason we say heat "always" flows from higher to lower temerature.

arp242 2y ago

Hard to say without details; but now that the weakness is known it may become a lot easier. It's one thing if you think it may work if you have the correct parameters but aren't sure, and quite another if you know it will work. Password managers are kind of a "defence in depth" thing; practical speaking, a passwords.txt opened with notepad is probably fine for many people. No one is in your computer checking your files. You have a password manager for when that does happen, just in case. And usually this tends to be a targetted attack, which can range from some country's secret service to a jealous spouse to a trolling sibling. If that extra protection is ineffective ... yeah, that's not great. This really is "better safe than sorry" type territory. Password managers (including Roboform) already do this by notifying users a password may be insecure after a leak. A lot of the time that's not really needed if your password is sufficiently secure, but "better safe than sorry". This is not all that different.

boomboomsubban 2y ago

If it had a default creation setting, it would be much easier to crack most user's passwords. There's still a motivation issue, but that's not a solid defense.

manquer 2y ago
> Motivation issue i.e threat model. A lot of security processes are not designed for say state actors with library of 0- days or monopoly on violence(i.e. $5 wrench) that doesn’t make them bad. Security is a spectrum, perhaps some subset users needed a more secure system most probably still benefited from this tool ?

ipython 2y ago

The constraint is knowing when the password was created. If you know that within a day or so, that makes the problem much more tractable and you can instead focus on number of characters and the other parameters. Sniffing traffic (yes even encrypted) would be enough to see if you’re going through the login or initial user establishment flow, and that would give you a precise time when the password was generated. This is a serious flaw.

Gigachad 2y ago
Security people overusing the words serious and critical have really watered down the terms. At this point when I get told something is a serious risk, I file it next to being hit by lightning or eaten by sharks.
- ipython 2y ago
  sorry to hear that. I don't exaggerate, but the unfortunate part is there is a lot of FUD out there- I just had a friend install nordvpn because someone sent her a gift card scam email to her business email address. So there's a lot of misinformation out there, mostly from folks selling product. Password management is one of those fundamental security foundations- essentially serving as the 'root of trust' for your own personal digital life. If you mess that up, you're in for a world of hurt. I don't mess around with passwords. Taking your analogy, would you intentionally stand outside under a tree in a thunderstorm, figuring that the risk of getting hit by lightning is so small?
  - Gigachad 2y ago
    In this situation, the attacker had to know you were using this particular password manager, know roughly when the password was generated, reverse engineer and replicate the password generation algorithm, and make millions of login attempts somehow (almost never possible other than on crypto wallets). Yes it’s obviously not good that they used the date as a seed, but the realistic risk is pretty much non existent. Even in this case where literal millions of dollars were on the line the “attackers” still had to collaborate heavily with the owner to narrow down the search space. On their own they likely would never crack it. Absolutely no one is going through all this to get in to your Facebook account when they can just call up some grandma and ask them to transfer a $1000.

nitwit005 2y ago

You can often learn when people create online accounts. Sometimes to the second or millisecond. It commonly shows on people's profiles. You can then try to log into every account, with passwords generated with the default settings.