Communities

Writing
Writing
Codidact Meta
Codidact Meta
The Great Outdoors
The Great Outdoors
Photography & Video
Photography & Video
Scientific Speculation
Scientific Speculation
Cooking
Cooking
Electrical Engineering
Electrical Engineering
Judaism
Judaism
Languages & Linguistics
Languages & Linguistics
Software Development
Software Development
Mathematics
Mathematics
Christianity
Christianity
Code Golf
Code Golf
Music
Music
Physics
Physics
Linux Systems
Linux Systems
Power Users
Power Users
Tabletop RPGs
Tabletop RPGs
Community Proposals
Community Proposals
tag:snake search within a tag
answers:0 unanswered questions
user:xxxx search by author id
score:0.5 posts with 0.5+ score
"snake oil" exact phrase
votes:4 posts with 4+ votes
created:<1w created < 1 week ago
post_type:xxxx type of post
Search help
Notifications
Mark all as read See all your notifications »
Q&A

Welcome to Software Development on Codidact!

Will you help us build our independent community of developers helping developers? We're small and trying to grow. We welcome questions about all aspects of software development, from design to code to QA and more. Got questions? Got answers? Got code you'd like someone to review? Please join us.

Comments on Are "strong passwords" at all meaningful?

Parent

Are "strong passwords" at all meaningful?

+18
−0

Whenever registering to diverse sites on the net, you are often forced to enter a so called "strong password", which would ideally contain both upper case letters, lower case letters, digits, and some other character like punctuation. As hard to remember as possible.

What I don't understand from a software development point of view is how these characters would make that much of a difference.

All of it seems to assume that a hacker trying to break a password would utilize so-called brute force. That is: try "A", try "B" ... "try AA" and so on. The more variations, the longer it takes to execute the brute force algorithm.

If I have a password of up to 10 capital letters A to Z plus "empty", that's 27 combinations, for a total of 2710 combinations.

As opposed to having a 10 letter password in the whole UTF8/ASCII 7 bit range, 127 combinations - 32 non-printable + 1 empty = 96, for a total of 9610 combinations.

Sure, a significant difference, astronomical even. But... if they would execute a brute force across TCP/IP they can maybe try one combination every millisecond or something, assuming great bandwidth. Worst case scenario for the 2710 scenario is then 57 days. Some 4 weeks on average. Assuming there's no big latency or packet drop for a significant lower bandwidth, in which case this isn't really feasible at all.

I don't see anyone setting up a brute force operation for that in order to access John Doe's Gmail account or whatever... it is already too much of an obstacle. Unless they hope to get lucky on the initial bunch permutations, which can of course happen.

Assuming that brute force is actually what's used, which sounds quite unlikely to me. Instead of something else entirely: keyword logging, packet sniffing, the human factor ("Hi this is your bank please send us your password") etc etc.

So is the usefulness of this whole "strong password" thing just an urban legend, where companies force us to memorize ridiculously hard to remember passwords for no real gain? Why is the number of symbol table combinations in the password oh so important on almost any Internet site these days?

History
Why does this post require attention from curators or moderators?
You might want to add some details to your flag.
Why should this post be closed?

5 comment threads

Security theater (3 comments)
Relevant XKCD: https://xkcd.com/936/ (3 comments)
See also: SE thread "What is your way to create good passwords that can actually be remembered?" (1 comment)
I think the question becomes more interesting in the context of most popular services (and most workp... (1 comment)
Off-topic (5 comments)
Post
+5
−0

The assumption of 1k attempts/s is wishful thinking, as is the idea that a hacker will go on mail.google.com and try to guess your login (they would get a captcha after like 5 failed attempts).

Password security comes into play when someone steals the whole table of all accounts and password hashes from the website operator, and then they start trying to hash different putative passwords to see if any of them match. This is very similar to cryptocurrency mining, so it's probably fair to say that about $1000 can get you hardware that can do about 1 billion password hashes/s.

When the website discovers their hashes are stolen and offered for sale on black market, the reasonable thing to do is invalidate all current passwords so that all users will be forced to reset password (using phone, email...) at next login. This will make the hashes useless. However, it will take some time for the site operator to find out, so if you have a very easy password the cracker could find it very quickly, use it and do some harm. If your password takes at least a few weeks, there's a good chance that by the time the cracker solves it, it will not be valid. I think this is the main reason why they require strong passwords.

By strong here I am thinking of 16 random chars A-Za-z0-9. This is about 95 bits, and even if you had a year you would need to try 10^15/s which is not feasible with today's tech. If/when better techs comes out the website admins would switch to a harder hash type, which would still take long even on the newer hardware.

companies force us to memorize ridiculously hard to remember passwords

They assume you will use a password manager, rather than memorizing it.

I don't see anyone setting up a brute force operation for that in order to access John Doe's Gmail account or whatever

A Gmail account is probably very valuable, because it can be used to send a lot of spam that will be treated as legitimate because it's coming from Gmail, and also people usually have Gmail set up for password recovery in other accounts so you can gain access to those from the Gmail. However, Google uses MFA, so just knowing the password won't be enough to gain access to it.

History
Why does this post require attention from curators or moderators?
You might want to add some details to your flag.

2 comment threads

When done right, password hashing is nothing like hashing in cryptomining (1 comment)
Rainbow tables become useless if every password is hashed with its own random hash. (4 comments)
When done right, password hashing is nothing like hashing in cryptomining
celtschk‭ wrote 2 months ago

If the password hashing scheme is reasonable (simply storing an SHA256 of the password is not reasonable!) then the password hashing rate is in no way comparable to Bitcoin hashing rates (which, indeed, are SHA256 hashes).

A good password hashing implementation is tuned to need at least about half a second on the production system to hash one password (generally, longer is better, but it has to be short enough that the users still accept it). Now even if the attacker's system is 100 times as powerful as the host system, that means about 200 hashes per second. But I doubt that you can get such a system for $1000.

However one should also take Moore's law into account. Basically, a password gets less secure over time simply because the computers get better. Even if the difficulty factor in the password hash gets adapted, you won't profit from that until you change your password.