Tag Info

New answers tagged

4

The basic port knocking method uses a fixed sequence of ports. This method is not protected cryptographically so there are the following attacks possible: brute-force — If you use the full range of possible ports 1—65535 then even very short knocking sequences give impressive number of combinations to test. For example for 3 knocks with randomly generated ...


2

Given the constraints in your question, yes, it can be predicted. For symmetric-key encryption algorithms, the answer is "never". Assuming Moore's Law is valid for the next century (an extremely optimistic assumption -- such a computer would be drawing much of the energy output of the Sun to power itself) and that current computers can test a million keys ...


0

I assume in my answer that the OP talks about online attacks, since its not quite possible to use OTPs for offline encryption or harddrives. For the first question, it depends on if you use time-based, event-based or challenge-based OTPs. Im going to talk about the standarized method of 6 digits OTP (HOTP, TOTP, OCRA) variants of authentication now: ...


0

Yes. Assuming the offline bruteforcing is successful and they have discovered your password, they still cannot log into the system without the one-time auth token. They will not have the opportunity to bruteforce the one-time auth token. N/A because of the 'if not'


2

You have two different questions. To answer your first question... Does a One-Time-Password like Google Authenticator or YubiKey protect against brute force attacks with unlimited computer power? When talking about brute force attacks you have to differentiate between online and offline attacks. When considering online brute force attacks, I refer you ...


0

Nothing in this world is invulnerable to unlimited computer power. Good to know that does not exist such a system. On a real attack scenario, the attack on a OTP protected system depends on how much attempts the attacker can make in the timeframe of the OTP token (generally one minute). If you employ rate limiting on your authentication scheme, employing a ...


0

Most brute force attacks now a days use combo lists rather than a password or dictionary attack. A combo list is a users username and their password in this format username:password. They get them through hacking databases with SQL injection, phishing pages, key loggers and even using Google dorks to find website dumps on the net. Take the scenario that you ...


0

You should use crunch or john the ripper. If you know the length and possible combinations of your password you can make a pretty good dictionary. For example you know your password was something like p@$$w0rd123 or maybe P@s$word1@3 etc.. you can do crunch 8 11 pPa@s$wW0oOrd123 -o list.txt This will make a list with a minimum length of 8 ...


1

Blowfish has known key-weaknesses that can lead to the discovery of your plaintext if you happen to pick a vulnerable key. Mark's answer is also fairly accurate, smaller keys equals easier cracking time, and with larger keys it is almost impossible to brute-force. Since Blowfish has key-vulnerabilities, it has been replaced with newer versions (Twofish and ...


1

The difficulty of brute-forcing your ciphertext depends on what key size you used when encrypting: Blowfish has an adjustable key size, ranging from 32 bits to 448 bits; this size is independent of the complexity of your password. At the 32-bit end of things, your ciphertext could be decrypted in a matter of minutes, while at 128 bits or larger, it would ...


2

crunch 10 10 0123456789 -t 760%%%%%%% | aircrack-ng ........... where 760 are the first three characters and the percents are any possible number. Meaning % stands for any number after 760 for lower-case letters replace % with @ for upper-case letters replace % with ' for symbols replace % with ^


2

Apple has quite a comprehensive whitepaper on iOS security. According to the whitepaper: Every time a file on the data partition is created, Data Protection creates a new 256-bit key (the “per-file” key) and gives it to the hardware AES engine Assuming an attacker had a file and nothing else then this would be quite secure. According to ...


3

Brute-forcing is normally used in the context of an offline-attack, where the attacker already knows the password-hashes and can use the full power of his system (GPU) to find a matching passwords. You are talking about online-attacks, an increasing delay would indeed make brute-forcing unpracticable, though it is not so easy to implement as it may sound. ...


3

Generally locking accounts as proposed by raz is a very bad thing - it leads to helpdesk load, annoyed customers, and is not needed to actually prevent brute force attacks. Temporary suspensions are used by more and more systems, often some delay that foils brute force, like 5 or 30 minutes, or by using an escalating scale, eg doubling the timeout each ...



Top 50 recent answers are included