3 ms·
By your own argument, if no one is going to bruteforce your password, what then is the issue with a weak password?
by einr 2y ago
By your own argument, if no one is going to bruteforce your password, what then is the issue with a weak password?
- Jnr 2y agoPassword lists are full of weak passwords. You don't brute-force the password, you use a password list instead.
- notpushkin 2y agoPotato, potato. Does anybody really say “bruteforce” not meaning a dictionary attack?
- janalsncm 2y agoThe author of the article, apparently.
- Krutonium 2y agoYes, plenty. It's not great for passwords, (but sometimes it still is! Sometimes sites using MD5 still get popped) but there's plenty of other problem spaces where brute forcing still means brute forcing.
- notpushkin 2y agoSorry, forgot to clarify! Yeah, the context matters here: if you’re cracking something like a numeric PIN, or looking for something like a hash collision, you might want to iterate through all possible solutions, randomly or sequentially.
- giantrobot 2y agoCredentials stuffing. Attackers can spam a site with logins with common passwords. Too few sites implement good mitigations against this because it's easy to block/lock legitimate users that typoed a password.
- tracker1 2y agoThis is why I isolate authentication to a separate application. I also implement max attempts per N minutes for IP and User. Most users once authenticated are good for the work day. Auth going down doesn't (generally) affect the work.