Welcome to Software Development on Codidact!
Will you help us build our independent community of developers helping developers? We're small and trying to grow. We welcome questions about all aspects of software development, from design to code to QA and more. Got questions? Got answers? Got code you'd like someone to review? Please join us.
Post History
The assumption of 1k attempts/s is wishful thinking, as is the idea that a hacker will go on mail.google.com and try to guess your login (they would get a captcha after like 5 failed attempts). Pa...
Answer
#6: Post edited
by
matthewsnyder
·
2024-04-25T17:21:07Z (7 months ago)
- The assumption of 1k attempts/s is wishful thinking, as is the idea that a hacker will go on mail.google.com and try to guess your login (they would get a captcha after like 5 failed attempts).
Password security comes into play when someone steals the whole table of all accounts and password hashes from the website operator, and then they start trying to hash different putative passwords to see if any of them match. This is very similar in principle to cryptocurrency mining, so it's probably fair to say that about $1000 can get you hardware that can do about 1 billion password hashes/s.- When the website discovers their hashes are stolen and offered for sale on black market, the reasonable thing to do is invalidate all current passwords so that all users will be forced to reset password (using phone, email...) at next login. This will make the hashes useless. However, it will take some time for the site operator to find out, so if you have a very easy password the cracker could find it very quickly, use it and do some harm. If your password takes at least a few weeks, there's a good chance that by the time the cracker solves it, it will not be valid. I think this is the main reason why they require strong passwords.
- By strong here I am thinking of 16 **random** chars `A-Za-z0-9`. This is about 95 bits, and even if you had a year you would need to try 10^15/s which is not feasible with today's tech. If/when better techs comes out the website admins would switch to a harder hash type, which would still take long even on the newer hardware.
- >companies force us to memorize ridiculously hard to remember passwords
- They assume you will use a password manager, rather than memorizing it.
- >I don't see anyone setting up a brute force operation for that in order to access John Doe's Gmail account or whatever
- A Gmail account is probably very valuable, because it can be used to send a lot of spam that will be treated as legitimate because it's coming from Gmail, and also people usually have Gmail set up for password recovery in other accounts so you can gain access to those from the Gmail. However, Google uses MFA, so just knowing the password won't be enough to gain access to it.
- The assumption of 1k attempts/s is wishful thinking, as is the idea that a hacker will go on mail.google.com and try to guess your login (they would get a captcha after like 5 failed attempts).
- Password security comes into play when someone steals the whole table of all accounts and password hashes from the website operator, and then they start trying to hash different putative passwords to see if any of them match. This is very similar to cryptocurrency mining, so it's probably fair to say that about $1000 can get you hardware that can do about 1 billion password hashes/s.
- When the website discovers their hashes are stolen and offered for sale on black market, the reasonable thing to do is invalidate all current passwords so that all users will be forced to reset password (using phone, email...) at next login. This will make the hashes useless. However, it will take some time for the site operator to find out, so if you have a very easy password the cracker could find it very quickly, use it and do some harm. If your password takes at least a few weeks, there's a good chance that by the time the cracker solves it, it will not be valid. I think this is the main reason why they require strong passwords.
- By strong here I am thinking of 16 **random** chars `A-Za-z0-9`. This is about 95 bits, and even if you had a year you would need to try 10^15/s which is not feasible with today's tech. If/when better techs comes out the website admins would switch to a harder hash type, which would still take long even on the newer hardware.
- >companies force us to memorize ridiculously hard to remember passwords
- They assume you will use a password manager, rather than memorizing it.
- >I don't see anyone setting up a brute force operation for that in order to access John Doe's Gmail account or whatever
- A Gmail account is probably very valuable, because it can be used to send a lot of spam that will be treated as legitimate because it's coming from Gmail, and also people usually have Gmail set up for password recovery in other accounts so you can gain access to those from the Gmail. However, Google uses MFA, so just knowing the password won't be enough to gain access to it.
#5: Post edited
by
matthewsnyder
·
2024-04-25T17:20:47Z (7 months ago)
- The assumption of 1k attempts/s is wishful thinking, as is the idea that a hacker will go on mail.google.com and try to guess your login (they would get a captcha after like 5 failed attempts).
- Password security comes into play when someone steals the whole table of all accounts and password hashes from the website operator, and then they start trying to hash different putative passwords to see if any of them match. This is very similar in principle to cryptocurrency mining, so it's probably fair to say that about $1000 can get you hardware that can do about 1 billion password hashes/s.
When the website discovers their hashes are stolen and offered for sale on black market, the reasonable thing to do is invalidate all current passwords so that all users will be forced to reset password (using phone, email...) at next login. This will make the hashes useless. However, it will take some time for them to find out, so if you have a very easy password the cracker could find it very quickly, use it and do some harm. If your password takes at least a few weeks, there's a good chance that by the time the cracker solves it, it will not be valid. I think this is the main reason why they require strong passwords.- By strong here I am thinking of 16 **random** chars `A-Za-z0-9`. This is about 95 bits, and even if you had a year you would need to try 10^15/s which is not feasible with today's tech. If/when better techs comes out the website admins would switch to a harder hash type, which would still take long even on the newer hardware.
- >companies force us to memorize ridiculously hard to remember passwords
- They assume you will use a password manager, rather than memorizing it.
- >I don't see anyone setting up a brute force operation for that in order to access John Doe's Gmail account or whatever
- A Gmail account is probably very valuable, because it can be used to send a lot of spam that will be treated as legitimate because it's coming from Gmail, and also people usually have Gmail set up for password recovery in other accounts so you can gain access to those from the Gmail. However, Google uses MFA, so just knowing the password won't be enough to gain access to it.
- The assumption of 1k attempts/s is wishful thinking, as is the idea that a hacker will go on mail.google.com and try to guess your login (they would get a captcha after like 5 failed attempts).
- Password security comes into play when someone steals the whole table of all accounts and password hashes from the website operator, and then they start trying to hash different putative passwords to see if any of them match. This is very similar in principle to cryptocurrency mining, so it's probably fair to say that about $1000 can get you hardware that can do about 1 billion password hashes/s.
- When the website discovers their hashes are stolen and offered for sale on black market, the reasonable thing to do is invalidate all current passwords so that all users will be forced to reset password (using phone, email...) at next login. This will make the hashes useless. However, it will take some time for the site operator to find out, so if you have a very easy password the cracker could find it very quickly, use it and do some harm. If your password takes at least a few weeks, there's a good chance that by the time the cracker solves it, it will not be valid. I think this is the main reason why they require strong passwords.
- By strong here I am thinking of 16 **random** chars `A-Za-z0-9`. This is about 95 bits, and even if you had a year you would need to try 10^15/s which is not feasible with today's tech. If/when better techs comes out the website admins would switch to a harder hash type, which would still take long even on the newer hardware.
- >companies force us to memorize ridiculously hard to remember passwords
- They assume you will use a password manager, rather than memorizing it.
- >I don't see anyone setting up a brute force operation for that in order to access John Doe's Gmail account or whatever
- A Gmail account is probably very valuable, because it can be used to send a lot of spam that will be treated as legitimate because it's coming from Gmail, and also people usually have Gmail set up for password recovery in other accounts so you can gain access to those from the Gmail. However, Google uses MFA, so just knowing the password won't be enough to gain access to it.
#4: Post edited
by
matthewsnyder
·
2024-01-11T04:31:32Z (11 months ago)
- The assumption of 1k attempts/s is wishful thinking, as is the idea that a hacker will go on mail.google.com and try to guess your login (they would get a captcha after like 5 failed attempts).
Password security comes into play when someone steals the whole table of all accounts and password hashes from the website operator, and then they start trying to hash different putative passwords to see if any of them match. This is very similar in principle to cryptocurrency mining, so it's probably fair to say that about $1000 can get you hardware that can do about 1 billion password hashes/s, especially if we consider rainbow tables.- When the website discovers their hashes are stolen and offered for sale on black market, the reasonable thing to do is invalidate all current passwords so that all users will be forced to reset password (using phone, email...) at next login. This will make the hashes useless. However, it will take some time for them to find out, so if you have a very easy password the cracker could find it very quickly, use it and do some harm. If your password takes at least a few weeks, there's a good chance that by the time the cracker solves it, it will not be valid. I think this is the main reason why they require strong passwords.
- By strong here I am thinking of 16 **random** chars `A-Za-z0-9`. This is about 95 bits, and even if you had a year you would need to try 10^15/s which is not feasible with today's tech. If/when better techs comes out the website admins would switch to a harder hash type, which would still take long even on the newer hardware.
- >companies force us to memorize ridiculously hard to remember passwords
- They assume you will use a password manager, rather than memorizing it.
- >I don't see anyone setting up a brute force operation for that in order to access John Doe's Gmail account or whatever
- A Gmail account is probably very valuable, because it can be used to send a lot of spam that will be treated as legitimate because it's coming from Gmail, and also people usually have Gmail set up for password recovery in other accounts so you can gain access to those from the Gmail. However, Google uses MFA, so just knowing the password won't be enough to gain access to it.
- The assumption of 1k attempts/s is wishful thinking, as is the idea that a hacker will go on mail.google.com and try to guess your login (they would get a captcha after like 5 failed attempts).
- Password security comes into play when someone steals the whole table of all accounts and password hashes from the website operator, and then they start trying to hash different putative passwords to see if any of them match. This is very similar in principle to cryptocurrency mining, so it's probably fair to say that about $1000 can get you hardware that can do about 1 billion password hashes/s.
- When the website discovers their hashes are stolen and offered for sale on black market, the reasonable thing to do is invalidate all current passwords so that all users will be forced to reset password (using phone, email...) at next login. This will make the hashes useless. However, it will take some time for them to find out, so if you have a very easy password the cracker could find it very quickly, use it and do some harm. If your password takes at least a few weeks, there's a good chance that by the time the cracker solves it, it will not be valid. I think this is the main reason why they require strong passwords.
- By strong here I am thinking of 16 **random** chars `A-Za-z0-9`. This is about 95 bits, and even if you had a year you would need to try 10^15/s which is not feasible with today's tech. If/when better techs comes out the website admins would switch to a harder hash type, which would still take long even on the newer hardware.
- >companies force us to memorize ridiculously hard to remember passwords
- They assume you will use a password manager, rather than memorizing it.
- >I don't see anyone setting up a brute force operation for that in order to access John Doe's Gmail account or whatever
- A Gmail account is probably very valuable, because it can be used to send a lot of spam that will be treated as legitimate because it's coming from Gmail, and also people usually have Gmail set up for password recovery in other accounts so you can gain access to those from the Gmail. However, Google uses MFA, so just knowing the password won't be enough to gain access to it.
#3: Post edited
by
matthewsnyder
·
2024-01-07T01:27:24Z (11 months ago)
- The assumption of 1k attempts/s is wishful thinking, as is the idea that a hacker will go on mail.google.com and try to guess your login (they would get a captcha after like 5 failed attempts).
- Password security comes into play when someone steals the whole table of all accounts and password hashes from the website operator, and then they start trying to hash different putative passwords to see if any of them match. This is very similar in principle to cryptocurrency mining, so it's probably fair to say that about $1000 can get you hardware that can do about 1 billion password hashes/s, especially if we consider rainbow tables.
- When the website discovers their hashes are stolen and offered for sale on black market, the reasonable thing to do is invalidate all current passwords so that all users will be forced to reset password (using phone, email...) at next login. This will make the hashes useless. However, it will take some time for them to find out, so if you have a very easy password the cracker could find it very quickly, use it and do some harm. If your password takes at least a few weeks, there's a good chance that by the time the cracker solves it, it will not be valid. I think this is the main reason why they require strong passwords.
- By strong here I am thinking of 16 **random** chars `A-Za-z0-9`. This is about 95 bits, and even if you had a year you would need to try 10^15/s which is not feasible with today's tech. If/when better techs comes out the website admins would switch to a harder hash type, which would still take long even on the newer hardware.
- >companies force us to memorize ridiculously hard to remember passwords
- They assume you will use a password manager, rather than memorizing it.
- >I don't see anyone setting up a brute force operation for that in order to access John Doe's Gmail account or whatever
A Gmail account is probably very valuable, because it can be used to send a lot of spam that will be treated as legitimate because it's coming from Gmail, and also people usually have Gmail set up for password recovery in other accounts so you can gain access to those from the Gmail. However, Google uses MFA now so just knowing the password won't be enough to gain access to it.
- The assumption of 1k attempts/s is wishful thinking, as is the idea that a hacker will go on mail.google.com and try to guess your login (they would get a captcha after like 5 failed attempts).
- Password security comes into play when someone steals the whole table of all accounts and password hashes from the website operator, and then they start trying to hash different putative passwords to see if any of them match. This is very similar in principle to cryptocurrency mining, so it's probably fair to say that about $1000 can get you hardware that can do about 1 billion password hashes/s, especially if we consider rainbow tables.
- When the website discovers their hashes are stolen and offered for sale on black market, the reasonable thing to do is invalidate all current passwords so that all users will be forced to reset password (using phone, email...) at next login. This will make the hashes useless. However, it will take some time for them to find out, so if you have a very easy password the cracker could find it very quickly, use it and do some harm. If your password takes at least a few weeks, there's a good chance that by the time the cracker solves it, it will not be valid. I think this is the main reason why they require strong passwords.
- By strong here I am thinking of 16 **random** chars `A-Za-z0-9`. This is about 95 bits, and even if you had a year you would need to try 10^15/s which is not feasible with today's tech. If/when better techs comes out the website admins would switch to a harder hash type, which would still take long even on the newer hardware.
- >companies force us to memorize ridiculously hard to remember passwords
- They assume you will use a password manager, rather than memorizing it.
- >I don't see anyone setting up a brute force operation for that in order to access John Doe's Gmail account or whatever
- A Gmail account is probably very valuable, because it can be used to send a lot of spam that will be treated as legitimate because it's coming from Gmail, and also people usually have Gmail set up for password recovery in other accounts so you can gain access to those from the Gmail. However, Google uses MFA, so just knowing the password won't be enough to gain access to it.
#2: Post edited
by
matthewsnyder
·
2024-01-07T01:27:06Z (11 months ago)
- The assumption of 1k attempts/s is wishful thinking, as is the idea that a hacker will go on mail.google.com and try to guess your login (they would get a captcha after like 5 failed attempts).
- Password security comes into play when someone steals the whole table of all accounts and password hashes from the website operator, and then they start trying to hash different putative passwords to see if any of them match. This is very similar in principle to cryptocurrency mining, so it's probably fair to say that about $1000 can get you hardware that can do about 1 billion password hashes/s, especially if we consider rainbow tables.
- When the website discovers their hashes are stolen and offered for sale on black market, the reasonable thing to do is invalidate all current passwords so that all users will be forced to reset password (using phone, email...) at next login. This will make the hashes useless. However, it will take some time for them to find out, so if you have a very easy password the cracker could find it very quickly, use it and do some harm. If your password takes at least a few weeks, there's a good chance that by the time the cracker solves it, it will not be valid. I think this is the main reason why they require strong passwords.
- By strong here I am thinking of 16 **random** chars `A-Za-z0-9`. This is about 95 bits, and even if you had a year you would need to try 10^15/s which is not feasible with today's tech. If/when better techs comes out the website admins would switch to a harder hash type, which would still take long even on the newer hardware.
- >companies force us to memorize ridiculously hard to remember passwords
- They assume you will use a password manager, rather than memorizing it.
- >I don't see anyone setting up a brute force operation for that in order to access John Doe's Gmail account or whatever
A Gmail account is probably very valuable, because it can be used to send a lot of spam that will be treated as legitimate because it's coming from Gmail, and also people usually have Gmail set up for password recovery in other accounts so you can gain access to those from the Gmail. However, Gmail uses MFA now so just knowing the password won't be enough to gain access to it.
- The assumption of 1k attempts/s is wishful thinking, as is the idea that a hacker will go on mail.google.com and try to guess your login (they would get a captcha after like 5 failed attempts).
- Password security comes into play when someone steals the whole table of all accounts and password hashes from the website operator, and then they start trying to hash different putative passwords to see if any of them match. This is very similar in principle to cryptocurrency mining, so it's probably fair to say that about $1000 can get you hardware that can do about 1 billion password hashes/s, especially if we consider rainbow tables.
- When the website discovers their hashes are stolen and offered for sale on black market, the reasonable thing to do is invalidate all current passwords so that all users will be forced to reset password (using phone, email...) at next login. This will make the hashes useless. However, it will take some time for them to find out, so if you have a very easy password the cracker could find it very quickly, use it and do some harm. If your password takes at least a few weeks, there's a good chance that by the time the cracker solves it, it will not be valid. I think this is the main reason why they require strong passwords.
- By strong here I am thinking of 16 **random** chars `A-Za-z0-9`. This is about 95 bits, and even if you had a year you would need to try 10^15/s which is not feasible with today's tech. If/when better techs comes out the website admins would switch to a harder hash type, which would still take long even on the newer hardware.
- >companies force us to memorize ridiculously hard to remember passwords
- They assume you will use a password manager, rather than memorizing it.
- >I don't see anyone setting up a brute force operation for that in order to access John Doe's Gmail account or whatever
- A Gmail account is probably very valuable, because it can be used to send a lot of spam that will be treated as legitimate because it's coming from Gmail, and also people usually have Gmail set up for password recovery in other accounts so you can gain access to those from the Gmail. However, Google uses MFA now so just knowing the password won't be enough to gain access to it.
#1: Initial revision
by
matthewsnyder
·
2024-01-07T01:26:15Z (11 months ago)
The assumption of 1k attempts/s is wishful thinking, as is the idea that a hacker will go on mail.google.com and try to guess your login (they would get a captcha after like 5 failed attempts). Password security comes into play when someone steals the whole table of all accounts and password hashes from the website operator, and then they start trying to hash different putative passwords to see if any of them match. This is very similar in principle to cryptocurrency mining, so it's probably fair to say that about $1000 can get you hardware that can do about 1 billion password hashes/s, especially if we consider rainbow tables. When the website discovers their hashes are stolen and offered for sale on black market, the reasonable thing to do is invalidate all current passwords so that all users will be forced to reset password (using phone, email...) at next login. This will make the hashes useless. However, it will take some time for them to find out, so if you have a very easy password the cracker could find it very quickly, use it and do some harm. If your password takes at least a few weeks, there's a good chance that by the time the cracker solves it, it will not be valid. I think this is the main reason why they require strong passwords. By strong here I am thinking of 16 **random** chars `A-Za-z0-9`. This is about 95 bits, and even if you had a year you would need to try 10^15/s which is not feasible with today's tech. If/when better techs comes out the website admins would switch to a harder hash type, which would still take long even on the newer hardware. >companies force us to memorize ridiculously hard to remember passwords They assume you will use a password manager, rather than memorizing it. >I don't see anyone setting up a brute force operation for that in order to access John Doe's Gmail account or whatever A Gmail account is probably very valuable, because it can be used to send a lot of spam that will be treated as legitimate because it's coming from Gmail, and also people usually have Gmail set up for password recovery in other accounts so you can gain access to those from the Gmail. However, Gmail uses MFA now so just knowing the password won't be enough to gain access to it.