Hacker News Reader

Comment by pfooti | Hacker News Reader

I don't get it. The vulnerability sounds like the cyphertext having the same length as the plain text in transit, but then they go on to say they were able to attack 1 in 10 Gmail users with their attack? I must be misreading it. Maybe 1 in 10 Gmail users is on QUIC?

View on HN

Probably something like 1 in 10 of the Gmail users examined have weak / short enough passwords that by knowing the length the dictionary used becomes small enough that a brute force attack becomes feasible.

The other link posted here confirms they use the length to select popular passwords of that length. See "step 2": http://www.cerias.purdue.edu/site/blog/post/purdue_cerias_re...

It doesn't say how they get the Gmail address to correlate back to the known length password though.

I see the "light on details" reasoning, but it doesn't go well with the sensationalist "1 in 10 Gmail users."

Surely Google doesn't allow high rate guessing, they must throttle or temporarily disable targeted accounts.

That doesn't really make sense. Gmail has a minimum password length of 8 characters. I bet 50% of users have an 8 character password. This bug hardly gives you any information at all.

Since gmail has minimum password length of 8, my random guess is that 90% of the users have passwords between 8 and 15. Does knowing the precise length of the password buys the attacker so much that they can now guess the passwords of 10% users? Also, note that they do not know the username that corresponds to the given password length. Without more details, I seriously doubt this claim.

Reply on news.ycombinator.com