4 ms·

So Microsoft blocks password attacks. A blocked password attack will never be successful. And they have to block a measly 7,000 of such attacks per second acro

So Microsoft blocks password attacks. A blocked password attack will never be successful. And they have to block a measly 7,000 of such attacks per second across the entire organization. Wow ... how not to convince me that passwords are a problem.

hyeonwho4 2y ago
I wonder how the internal metrics even define "password attacks". I have a 15 year old Skype account (with a long password) which I lost access to because Microsoft suddenly started requesting verification, insisting on 2FA via SMS to a 10-year-old phone number. Are all ten of my attempted logins counted in that statistic?
- kazinator 2y ago
  I imagine it has to be a certain number of attempts, because it's counting the password attacks that are stopped. You don't identify and stop a password attack after just two or three attempts. Let's say that the threshold is 20 attempts. So that's 7,000 * 20 = 140,000 password attempts per second. That's not very fast. It will not uncover strong passwords in any reasonable timeframe.
jsnell 2y ago
False negatives are a thing. If they've got a 99.9% success rate at blocking password attacks, it means there's 7 qps of successes. That's 500k hijacked accounts per day, 200M per year. That is a very large number. And not a lot of systems have 99.9% recall, without trading away absurd amounts of precision...
- kazinator 2y ago
  If they suspend an account after, say, 20 password attempts, they're success rate at stopping password guessing will be vanishingly close to 100%. Especially if they've instigated strong passwords. If passwords cannot contain dictionary words and must be mixed case with at least one special character in digit, there's no freaking way anybody's going to guess their way in, with a small number of tries before the account is frozen. The number of penetrations from that is going to be so tiny, it's not worth worrying about. The bigger worry are stolen password hashes being cracked surreptitiously, where the attacker has an unlimited number of tries whose rate is only limited by their hardware.

hyeonwho4 2y ago

I wonder how the internal metrics even define "password attacks". I have a 15 year old Skype account (with a long password) which I lost access to because Microsoft suddenly started requesting verification, insisting on 2FA via SMS to a 10-year-old phone number. Are all ten of my attempted logins counted in that statistic?

kazinator 2y ago
I imagine it has to be a certain number of attempts, because it's counting the password attacks that are stopped. You don't identify and stop a password attack after just two or three attempts. Let's say that the threshold is 20 attempts. So that's 7,000 * 20 = 140,000 password attempts per second. That's not very fast. It will not uncover strong passwords in any reasonable timeframe.

jsnell 2y ago

False negatives are a thing. If they've got a 99.9% success rate at blocking password attacks, it means there's 7 qps of successes. That's 500k hijacked accounts per day, 200M per year. That is a very large number. And not a lot of systems have 99.9% recall, without trading away absurd amounts of precision...

kazinator 2y ago
If they suspend an account after, say, 20 password attempts, they're success rate at stopping password guessing will be vanishingly close to 100%. Especially if they've instigated strong passwords. If passwords cannot contain dictionary words and must be mixed case with at least one special character in digit, there's no freaking way anybody's going to guess their way in, with a small number of tries before the account is frozen. The number of penetrations from that is going to be so tiny, it's not worth worrying about. The bigger worry are stolen password hashes being cracked surreptitiously, where the attacker has an unlimited number of tries whose rate is only limited by their hardware.