this post was submitted on 02 Aug 2023
1 points (100.0% liked)
Interesting
555 readers
1 users here now
- Be respectful to other members Treat others with kindness and courtesy, even if you disagree with their opinions.
- Stay on topic Keep your discussions relevant to the purpose of the forum. Avoid going off-topic or derailing conversations.
- No spamming Avoid posting irrelevant or unnecessary content, advertisements, or links to unrelated websites.
- Use proper language and tone Choose your words carefully when commenting or replying to others. Avoid using profanity or engaging in offensive language and personal attacks.
- Do not share personal information Protect your privacy by refraining from sharing personal details such as addresses, phone numbers, or email addresses on the forum.
- Report any issues If you come across any inappropriate behavior or content, report it to the forum moderators or administrators.
- Have fun and contribute positively Participate actively and add value to the discussions. Engage in meaningful and constructive conversations with fellow members.
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Don’t most systems lock out accounts after a few failed attempts?
This assumes you can obtain the hashed & salted version of the password from the server, or it's a local PDF/ZIP/etc file password. Still, you have 2FA to go through once you guess the plaintext password.
So it becomes a concern when someone steals a bunch of passwords from a server?
No legitimate websites will store passwords as plaintext, instead their salted (mathematically modified) hashes. They do not have your plaintext password but there is a mechanism of checking your password attempt. If the hacker interrupts this mechanism, they can steal plaintext passwords every time they are used. However, most of the time they "just" gain access to the database and get the hashed & salted versions, and can often find out what the hash & salt algorithm is by reverse-engineering their own entries. Then, they obtain a list of top 1B+ common passwords (includes all 4-digit numbers, "password" and curse words in all languages, pretty much every English word imaginable, most given names in the world, every date from the last 100 years in various formats, correct horse battery staple and entries from previous breaches) and for every hash & salt they compute, they check if it matches any known hash & salt of any user they're interested in (could be just a few or all) matches. This dictionary attack will match the weakest passwords, and any matches give the hacker confidence that their method is correct. After that, they either start extending the dictionary (combining words with other words, letters and numbers), or brute forcing every combination of numbers, letters and symbols (with some heuristics: most passwords use way fewer symbols than letters).
So "password breaches" are concerning because the hacker gets any number of retries for anyone's password if they have the time and computing power. Therefore, it is very advisable to change your password after such a breach is discovered. This takes anywhere between 1 day to a month so if your password cannot be cracked in that time, you should be reasonably safe.