Confused about breaking passwords

Tringa

Tringa

Numpty of the Day'
Suspended / Banned
Messages
6,133
Name
Dave
Edit My Images
Yes
I think I posted this - https://www.itsecurityguru.org/2023/05/18/time-taken-for-hackers-to-crack-passwords-revealed/ - here before which has a table of how long it would take to break a password.

What I'm confused about is it relevant?

On the odd times I've forgotten a password I get, I think at most, three goes and after that I have to ask for it to be reset, usually by way of an email and a code to my phone.

With even the simplest eight character password, which the table suggests can be broken instantly, there are thousands of possible combinations so the chances of a hacker hitting on the correct one in three goes seems vanishingly small.

Am I missing something?

Dave
 
The issue is that people use the same password on multiple sites. For example if the back-end facebook database gets hacked giving access to the hashed passwords, they can then be cracked offline and used to access other sites. Generally the hackers don't care who's account they have, just one that works.

We have seen that on here.
 
sirch said:
The issue is that people use the same password on multiple sites.
Click to expand...
I agree.

You should use a different password for each site and beware of falling into the trap of using a skeketon like "{clever password}name of site", which happens all too often. Once a cracker has that "clever password", your data is theirs.
 
sirch said:
The issue is that people use the same password on multiple sites. For example if the back-end facebook database gets hacked giving access to the hashed passwords, they can then be cracked offline and used to access other sites. Generally the hackers don't care who's account they have, just one that works.

We have seen that on here.
Click to expand...
Thanks, I think I understand now. I'd thought a hacker breaking a password would get thousands of possible combinations and have to try each one in an attempt to access data(which would not work), but I see now if they do manage to hack the passwords stored on website they will get the actual password.

Therefore, having a long password with a combination of letters, numbers and symbols, makes the time needed to hack it impossibly long.

Cheers

Dave
 
I'll add that even with your password they have to find a site of interest for which they have the correct username or email. Hackers generally don't want to impersonate you on some general information site, they can't make money from that. Typically what they have is a username/password combination, they search the web for the username and then impersonate you on sites where they can make money. So having different usernames, particularly for financially significant sites, as well as passwords can prevent exploitation.
 
just use google to generate complex passwords for each site and let google manage them for you
 
Just don't do anything "valuable" on the web.
 
Mr Bump said:
everything is now on the web though
Click to expand...
Exactly.

For most people, advice like "Just don't do anything "valuable" on the web" is much the same as "don't go out after dark" - both boil down to "let the criminals rule your life".
 
AndrewFlannigan said:
Exactly.

For most people, advice like "Just don't do anything "valuable" on the web" is much the same as "don't go out after dark" - both boil down to "let the criminals rule your life".
Click to expand...

one of the tings i raised a while ago is protecting access to your phone with SIM lock
most crims will compromise stuff using your phone number as this is often the way to reset your password with a text code to your phone
 
Mr Bump said:
everything is now on the web though
I have 2x Cash ISA's that are actually web only.
Click to expand...

No, it's not. ALL my banking is done in person and my dealings with my stockbroker are done face to face, including the ISA.
 
Nod said:
No, it's not. ALL my banking is done in person and my dealings with my stockbroker are done face to face, including the ISA.
Click to expand...

but that is your choice though
the world has moved on a lot of services are online only like the best banks
I now bank with Revolut
 
Last edited:
Tringa said:
I think I posted this - https://www.itsecurityguru.org/2023/05/18/time-taken-for-hackers-to-crack-passwords-revealed/ - here before which has a table of how long it would take to break a password.

What I'm confused about is it relevant?

On the odd times I've forgotten a password I get, I think at most, three goes and after that I have to ask for it to be reset, usually by way of an email and a code to my phone.

With even the simplest eight character password, which the table suggests can be broken instantly, there are thousands of possible combinations so the chances of a hacker hitting on the correct one in three goes seems vanishingly small.

Am I missing something?

Dave
Click to expand...
These tables start from the premise that hacker already has an MD5 hash of the password by compromising the site and taking its data, and tell you how long it will then take to find the password that hashes to that value (and assumes there is no salt in use, or the hacker knows it).
 
Mr Bump said:
but that is your choice though
the world has moved on a lot of services are online only like the best banks
I now bank with Revolut
Click to expand...


Yes but YOUR assertion was that "EVERYTHING is now on the web". It's not, as I showed.
 
Nod said:
Yes but YOUR assertion was that "EVERYTHING is now on the web". It's not, as I showed.
Click to expand...
You didn't show anything you just declared you went to see a man in a smelly suit in a dimly lit office because you choose to.
Every service the normal person needs is now online from banks, savings investments, gas, leccy mobile phone.

Tell me a service out there you cannot access online?
 
sirch said:
What when your google account gets compromised?
Click to expand...
I trust the technology more than i trust remembering or writing down or what?
 
Mr Bump said:
You didn't show anything you just declared you went to see a man in a smelly suit in a dimly lit office because you choose to.
Every service the normal person needs is now online from banks, savings investments, gas, leccy mobile phone.

Tell me a service out there you cannot access online?
Click to expand...


Your bank might have smelly suits and dark offices - mine don't.

I can't access any services online because I have opted out of it. Never had my details compromised.
 
Mr Bump said:
You didn't show anything you just declared you went to see a man in a smelly suit in a dimly lit office because you choose to.
Every service the normal person needs is now online from banks, savings investments, gas, leccy mobile phone.

Tell me a service out there you cannot access online?
Click to expand...

You can really be a most snarky person at times, when someone points out that you are not correct. Just climb down off that high horse.
 
You must log in or register to reply here.
Back
Top