Hacker News Reader

>I am being serious when I ask this question: does anybody brute force passwords?

Very many people. And not all systems stop them from doing so.

And database leaks happen all the time too...

It wouldn't really matter how good your password was in the leak/breach scenario would it?

It would, if [some fields of] the database is encrypted. Then the attacker could only get the content from accounts with weak passwords, not yours.

I know of almost nowhere that encrypts content with the user password. It means if the user resets the password because they forgot it, they lose content.

A lot of times what's leaked is the passwords themselves (encrypted).

Depends. If the leak or breach reveals actual password, then yes, you're screwed. If it reveals SHA-256 hashes, then you're screwed unless you chose a good high-entropy password (e.g. lBBo1f93XbbKs2hKa8T5pR). If it reveals PBKDF2-hashed, bcrypt- or scrypt-hashed passwords, then you're almost certainly safe, unless you chose a really poor password (e.g., the following is a Base64-encoded PBKDF2 hash, with 100,000 iterations of SHA-256 and a seed of 'QDTGEqi8to9PrkpBgCbnN0': 8h1HO6omVWhusXcQRGS0CcTzSC5AkAIvodC+hT/AoRk=; I contend that you will not be able to guess the password I used for it), since trying passwords with a good key-derivation function is so slow.

I was wondering this as I read it as well. Yes, we know it would be fairly easy to compromise an individual account by guessing common passwords. But that assumes you have one particular account in mind. If you're just looking for bank accounts to access, you first need a list of usernames to try (ideally usernames of non-tech-savvy people) and then you need to run your entire password guessing routine for each one.

I'm no security expert, but I start to wonder if the "practical" entropy of a given password is actually much higher than the theoretical entropy numbers people derive.

Serious question: when is the last time anyone has had an account compromised because of a weak password?

The last time a company had their password hashes exfiltrated. All the common passwords are quickly broken.

And then what? Like sure, you'll be compromised on that one service and that's bad, but it's not anywhere near as bad as re-using passwords across services. My argument is we should be focusing on stopping password re-use far, far more than we should be nit-picking about password entropy.

>Serious question: when is the last time anyone has had an account compromised because of a weak password?

What is your definition of "weak"? I sometimes help my landlord fix their computer when they accumulate too much malware. One time I brought their tower home to do this and didn't get their Windows account password. Instead of calling them I decided to try a few things first, including their kids' names. Lo and behold, the second attempt was correct.

Brute forcing a weak password probably isn't what you have to worry about when it comes to targeted attacks against weak passwords, but social engineering is.

Hah, funny you ask. I was able to siphon off internet quota in my college using a combo of brute-forcing and previously known passwords. Worked quite good until my conscience got the better of me.

My wife had an account hacked years ago. I don't know for sure that it was brute forced (could have been phished or exfiltrated by a keylogger or session jacked with an XSS vulnerability or...), but I also don't know that it wasn't brute forced. She used very short, simple passwords at the time.

Come to think of it, I also had an old account with a very weak password that I hadn't used in years mysteriously hacked one day. The language settings were changed to Russian when I went to reset my password. The fact that no other account of mine appeared to be compromised and I hadn't used the site in years certainly suggests brute forcing.

> I am being serious when I ask this question: does anybody brute force passwords? I posit that using a unique password for every single website is sufficient, because no one brute forces passwords.

Weren't the celebrity iCloud account compromises due to Apple neglecting to rate-limit a certain authentication API endpoint, allowing the hacker to brute force passwords online?

Also, doesn't some of the current crop of IoT malware brute force device passwords as well (after trying the defaults)?

I thought it was due to phishing. I'm not sure where I heard that, though.

If you have a server running SSH, you can try the "lastb" command, which shows failed logins. Or, look in the logfile, often /var/log/secure or similar.

  root     ssh:notty    116.31.116.44    Fri Mar 10 22:27 - 22:27  (00:00)    
  root     ssh:notty    116.31.116.44    Fri Mar 10 22:27 - 22:27  (00:00)    
  ...

My personal server has 153,246 entries from this single IP, from 1 March until now.

did you disable password authentication (to allow only ssh keys) ? If not, why ?

I occasionally use password login, when I'm not using my own computers.

Login using the root account is disabled.

why hadn't you installed fail2ban?

Yes, many bots try to brute force passwords.

Do you run any ssh or email servers? If so, your logs will tell you already. I've got bots brute forcing passwords on my blogs, that nobody even read, but did have account functionality, with email sending. People made the point of adapting their bots for different captcha schemes just so they could send some email.

Absolutely.

There's a difference between random script kiddies and targeted attacks. People do all sorts of wacky things.