I am being serious when I ask this question: does anybody brute force passwords? I posit that using a unique password for every single website is sufficient, because no one brute forces passwords.
What attack vector is a password with high entropy protecting against? The only one I can think of is an unreported database leak. The attacker may be able to more easily reverse the password hash and use your account on that particular service, at least until the leak becomes discovered and the service does a full password reset.
While it would be ideal to defend against that attack, I think it's far more important to stress that users have a different password for every website. The real attack vector that we see every day is a DB leak from a poorly secured website, passwords cracked, and then reused on important services. That's where the problem lies, not in the user's password entropy.
Jeff isn't wrong here, he's just attacking a relatively unimportant problem.
Depends. If the leak or breach reveals actual password, then yes, you're screwed. If it reveals SHA-256 hashes, then you're screwed unless you chose a good high-entropy password (e.g. lBBo1f93XbbKs2hKa8T5pR). If it reveals PBKDF2-hashed, bcrypt- or scrypt-hashed passwords, then you're almost certainly safe, unless you chose a really poor password (e.g., the following is a Base64-encoded PBKDF2 hash, with 100,000 iterations of SHA-256 and a seed of 'QDTGEqi8to9PrkpBgCbnN0': 8h1HO6omVWhusXcQRGS0CcTzSC5AkAIvodC+hT/AoRk=; I contend that you will not be able to guess the password I used for it), since trying passwords with a good key-derivation function is so slow.
I know of almost nowhere that encrypts content with the user password. It means if the user resets the password because they forgot it, they lose content.
I was wondering this as I read it as well. Yes, we know it would be fairly easy to compromise an individual account by guessing common passwords. But that assumes you have one particular account in mind. If you're just looking for bank accounts to access, you first need a list of usernames to try (ideally usernames of non-tech-savvy people) and then you need to run your entire password guessing routine for each one.
I'm no security expert, but I start to wonder if the "practical" entropy of a given password is actually much higher than the theoretical entropy numbers people derive.
Serious question: when is the last time anyone has had an account compromised because of a weak password?
My wife had an account hacked years ago. I don't know for sure that it was brute forced (could have been phished or exfiltrated by a keylogger or session jacked with an XSS vulnerability or...), but I also don't know that it wasn't brute forced. She used very short, simple passwords at the time.
Come to think of it, I also had an old account with a very weak password that I hadn't used in years mysteriously hacked one day. The language settings were changed to Russian when I went to reset my password. The fact that no other account of mine appeared to be compromised and I hadn't used the site in years certainly suggests brute forcing.
>Serious question: when is the last time anyone has had an account compromised because of a weak password?
What is your definition of "weak"? I sometimes help my landlord fix their computer when they accumulate too much malware. One time I brought their tower home to do this and didn't get their Windows account password. Instead of calling them I decided to try a few things first, including their kids' names. Lo and behold, the second attempt was correct.
Brute forcing a weak password probably isn't what you have to worry about when it comes to targeted attacks against weak passwords, but social engineering is.
And then what? Like sure, you'll be compromised on that one service and that's bad, but it's not anywhere near as bad as re-using passwords across services. My argument is we should be focusing on stopping password re-use far, far more than we should be nit-picking about password entropy.
Hah, funny you ask. I was able to siphon off internet quota in my college using a combo of brute-forcing and previously known passwords. Worked quite good until my conscience got the better of me.
> I am being serious when I ask this question: does anybody brute force passwords? I posit that using a unique password for every single website is sufficient, because no one brute forces passwords.
Weren't the celebrity iCloud account compromises due to Apple neglecting to rate-limit a certain authentication API endpoint, allowing the hacker to brute force passwords online?
Also, doesn't some of the current crop of IoT malware brute force device passwords as well (after trying the defaults)?
If you have a server running SSH, you can try the "lastb" command, which shows failed logins. Or, look in the logfile, often /var/log/secure or similar.
Do you run any ssh or email servers? If so, your logs will tell you already. I've got bots brute forcing passwords on my blogs, that nobody even read, but did have account functionality, with email sending. People made the point of adapting their bots for different captcha schemes just so they could send some email.
What attack vector is a password with high entropy protecting against? The only one I can think of is an unreported database leak. The attacker may be able to more easily reverse the password hash and use your account on that particular service, at least until the leak becomes discovered and the service does a full password reset.
While it would be ideal to defend against that attack, I think it's far more important to stress that users have a different password for every website. The real attack vector that we see every day is a DB leak from a poorly secured website, passwords cracked, and then reused on important services. That's where the problem lies, not in the user's password entropy.
Jeff isn't wrong here, he's just attacking a relatively unimportant problem.