Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am familiar with how offline brute-force attacks work. But for online accounts, assuming no social engineering, how feasible is it to brute-force attack a password? For example, is this dependent upon password complexity, or possibly some other vulnerability, like eavesdropping on SSL/TLS handshakes?

share|improve this question
1  
it seems the question is too broad. Online account has different password policy on different platform. Every platform has it own policy on password retry. –  neo Jun 10 '13 at 4:12
    
I edited it down. Hopefully it looks like a coherent question now. –  mathStudent Jun 10 '13 at 5:12
1  
To answer your last question (I'm surprised that it's coming up a lot recently). How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it? –  Adnan Jun 10 '13 at 5:24
    
I edited again to make title match question. –  mathStudent Jun 10 '13 at 5:30
add comment

closed as not a real question by TildalWave, Adnan, Terry Chia, NULLZ, Scott Pack Jun 10 '13 at 13:18

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer

Online bruteforce attacks against a properly designed system is probably unfeasible against all but the weakest passwords.

This is due to the fact that online systems can implement a wide array of rate limiting techniques that will limit the number of attempts the attacker has to guess the password of a single account.

Of course there are some techniques available to try and circumvent the rate limiting techniques such as trying a single password against multiple user accounts or distributing the login attempts among multiple IP addresses to try and get past IP bans. However, I'm not sure about the effectiveness of such techniques.

There is another factor that limits the effectiveness of online bruteforce attacks. The limiting factor in such attacks usually isn't the processing power that can benefit from large GPU farms. The limiting factor usually is the network. Each individual network interface can only send out that many packets per second. Even if you can afford to have thousands of network interfaces sending out the necessary packets for an online bruteforce attack, the server your target is hosted on probably cannot handle the millions of packets bombarding it. At this point, your online bruteforce attack has turned into a denial-of-service attack.

Assuming that you are talking about a web application, it is probably easier for attackers to exploit other flaws such as SQL injections to get a database dump and perform offline attacks using clusters of dedicated hardware.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.