Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Website security breaches seem to be a common occurrence, giving the attacker password hashes that he can conduct a brute force attack against, often given him a list of passwords that will work on other sites since users commonly reuse passwords.

Would it improve overall security by making the hashing algorithm slightly weaker and more prone to collisions, so even if the attacker does brute force a password that works on the hacked site, it's not likely to work at any other site?

So if, for example, some hash algorithm were 1000 times more likely to have a collision than some other hash algorithm, it makes the attacker's work 1000 times easier on that site, but any password he brute forces has only a 1 in 1000 chance of working on another site. He could continue to brute force and come up with all 1000 passwords that collide with the hash, but if he tried to cycle through all 1000 passwords on other sites, hopefully that site would shut him down before he got through all passwords.

Would this lead to better overall security by reducing the ability of a hacker to exploit passwords shared with other sites, or would it just weaken security by deliberately making it much easier to brute force a single site's password?

share|improve this question

1 Answer 1

The "1000" factors cancel out. By making collisions much probable so that each password has on average 999 brother passwords which equally grant access to site A, you make entering site A 1000 times easier. Due to the vast choice of possible passwords, that "easy-site-A" password has only 1/1000 probability of being good for site B (where the user reused his password), but that extra 1000 difficulty factor is over the difficulty of entering site A -- which has just been made 1000 times easier. So entry in site B has not been made harder.

One other way to see it is to imagine the attacker trying to attack site B. He then creates site A himself -- with an extremely collision-happy hash function so that every possible password grants access to A: it suffices to have a hash function which always return the same value. The attacker can certainly implement a site with no access restriction, i.e. that kind of "site A". Does it change anything to the difficulty of entering site B ? Since it is something that the attacker can build from scratch independently of site B and its users, it cannot.

In the situation you envision, you can imagine site A as a filter for site B. Sure, site A won't tell you which password is the right one for site B; but it will reduce the list of candidates to 1000 (out of a few billions). This can only help attacking site B, and will certainly not protect site B.

share|improve this answer
1  
(Edit: this was originally in reply to a comment which has now been deleted) You've missed the point. Making collisions more probable on your own site makes it easier to attack your site, but fundamentally does not increase the difficulty of cracking passwords on another site. The attacker can simply generate all 1,000 possible collisions and test them against the second site. –  Stephen Touset May 2 '13 at 18:36
1  
Right, but if the attacker doesn't have the hashes for the second site, then he has to test them one by one through the site's normal login form, giving site B the ability to lock out the account after X wrong password attempts, possibly alerting the user and forcing him to set a new password to unlock his account. –  Johnny May 2 '13 at 18:38
1  
@Johnny - I bet that you would be able to pick the real password in 99% of all cases, because most people do not choose absolutely random passwords. It may be more difficult for a computer to choose the right one, but i'm sure one could write software that can do a rating and find the most probable ones. –  martinstoeckli May 2 '13 at 18:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.