Known password length, brute force character in place?

Question

We all know that brute forcing is a very slow process and trying all unnecessary possibilities is dumb. By knowing the password length, we can skip trying possibilities of other password lengths and saves us huge amounts of time. Still this change is insignificant for very long passwords. So I was wondering if we can brute force every character in place. It would be like cracking a combination for a mechanical lock. We try every character in place until it "clicks" into place, then we move on to the next character, and so on.

Answer 1

If you have a password verification mechanism which lets you know, in any way, whether a given letter is correct or not, independently of the others, then you have an awfully weak, stupidly designed password verification mechanism. That's what happens when you let Hollywood scenarists deal with reality.

This board game is an illustration of how bad it is: if a letter "clicks into place", as you put it, then your password can be beaten by an 8 years old kid from the early 70s (and without any computer at all). I strongly hope that login screen security has increased a bit beyond the Disco kid security level.

Answer 2

You could if the password verification is done very badly. Namely if the password verifier does all of the following:

1. The password verifier stores the passwords in the clear (and not hashed as they should be)
2. The password verifier compares the guess and the password directly (and not a hash of the guess and the password)
3. The password verifier behaves differently depending on which character the password check fails on
4. The password verifier doesn't limit the number of bad attempts

The first condition is the most important. If the implementer of a password verifier stores clear passwords, it's unlikely that they've gone to the trouble to implement a secure password comparison algorithm.

It's sad to say, but there are a surprisingly large number of Internet sites that store passwords in the clear. PlainTextOffenders.com is a (Tumblr) blog dedicated to "outing" such sites and contains many hundreds of such sites.

If a service stores passwords in the clear then it is likely that it is susceptible to a form of side channel attack called a "timing attack". If the password verifier checks one character at a time and returns a password failure message when it encounters the first non-matching character then you can guess one character at a time (starting from the first) and based on the timing of the failure message identify each character. Due to the inherent noisiness of Internet communication timing you would need to try each possibility more than once, but it still would be substantially faster than a simple brute force attack.