3 ms·
Not so sure about #3 (random password generator). This might be true in the case of a true brute force where each attempt is almost free, such as somebody getti
by jiggy2011 14y ago
Not so sure about #3 (random password generator).
This might be true in the case of a true brute force where each attempt is almost free, such as somebody getting your password from a database secured by a single round of md5.
In reality, most brute force attacks are attempted remotely where there is a bottleneck in terms of bandwidth and many services are rate limited.
In such a case it would always make sense to try the most common passwords first.
The problem with letting people choose their own passwords is that most people just aren't that good at it and will choose stuff like p4ssw0rd1982, because people's minds are somewhat similar they will tend to converge on similar "good" passwords.
I ran an IMAP service for a time. We would constantly get bots attempting to brute force email accounts, we had fail2ban set to ban them after 5 attempts but they could get more guesses simply by having a lot of IP addresses.
When I looked at the sort of passwords they would try they didn't start with aaaa and move on from there, they would start with stuff that looked like it had been pulled from a common password list.
About once every 3 months we got a call from somebody who's email had been hacked. They all insisted that they were using strong passwords that nobody could have possibly guessed, however when I enforced a strong password policy on the server and offered a random password generator these problems went away.
- rquantz 14y agoCorrect me if I'm wrong, but aren't you describing a dictionary attack, not brute force?
- jiggy2011 14y agoI guess I just see a dictionary attack as a subset of brute force in that it's still a pretty naive attack, but it's not raw brute force. OTOH I don't see why anyone would bother using a raw brute force attack against a password rather than just grabbing a dictionary of the most common passwords and exhausting those first. In reality you are likely to run out of guesses before you hit the end of a common password list anyway.
- ams6110 14y agoA good system should take a significant but not intolerable amount of time to reject a bad password. Just a few seconds will impose a huge burden on a remote dictionary attack, while not diminishing the experience for a user who legitimately fat-fingers a password. Also use fail2ban to impose a lockout after a certain number of failures. The lockout does not have to be permanent, it just has to make a remote dictionary attack so time-consuming as to be infeasible (of course this does open up a DOS vector, depending on how you implement the lockout).
- ams6110 14y agoWhen I looked at the sort of passwords they would try they didn't start with aaaa and move on from there, they would start with stuff that looked like it had been pulled from a common password list. That's because they were. I'm sure that in the "underground" community of crackers there circulate lists of passwords that have been successfully cracked, because a) people tend to use the same passwords for everything, so if it worked for one account it will probably work for others, and b) the point you mande in your third paragraph. These lists are continually updated and used as input to the "brute force" cracking tools.