Brute force can be used to crack passwords by trying a large number of passwords. Why does no one try the brute force approach on every single character of the password instead?
-
8You need to look at how password hashing works - for most modern storage methods, you can't check a part of the password as a separate step. It's either the whole password correct, or you don't know how wrong you are.– MatthewCommented Feb 17, 2017 at 13:55
-
3You can't brute force parts of a password because you only get a confirmation whether the entire password is correct -- not for a selected part or a single character.– ArminiusCommented Feb 17, 2017 at 13:56
-
I edited the title to make it clearer. I hope my edits were in line with what you wanted to ask?– AndersCommented Feb 17, 2017 at 14:29
-
3You can only crack passwords a character at a time in movies or tv shows.– TTTCommented Feb 17, 2017 at 17:06
-
1@matthew could you elaborate?– AwnCommented Feb 17, 2017 at 17:16
|
Show 3 more comments
2 Answers
Because most operating systems hash passwords once entered (and store them in a database). This means that the entire password is converted into a collection of cryptographic hashes, random-looking strings of characters into which the passwords have been mathematically transformed to prevent them from being misused.
So, once a password is hashed for a well defined hash, there is no way to attack each character. That is circular logic. To attack each character you must know each character. To know each character you must attack each character.
-
2And one of the attributes of a good cryptographic hash function is that a small change results in a very different hash, so you can't tell if you're close. Commented Feb 17, 2017 at 15:18
-
I think you should add "for a well designed hash" to the last statement. The Lanman hash, for instance could attack sub-sections of the password at one time, which significantly weakened the hash. Not character by character, but the concept is the same. Commented Feb 17, 2017 at 20:41
-
Your point is noted, and I agree. Thanks for the suggestion. Commented Feb 17, 2017 at 22:11
If by cracking you mean breaking a given hash of password(s) then it isn't possible since hash functions are built to have seemingly random outputs, so for example: The SHA-1 hash of 'Password' is:
SHA-1(Password) = 8be3c943b1609fffbfc51aad666d0a04adf83c9d
but change only the first character ('Sassword') and you get:
SHA-1(Sassword) = 1243263916a8d81369235831d5a224bbae87a86a
As others have mentioned, hash functions are made to appear this way just for this purpose; to thwart attempts to 'crack' them.
If by cracking you mean brute forcing a user's login credientials to a site, then it is even more clear why it wouldn't work - you won't get feedback from the site saying "The first letter was correct, but the rest wasn't", etc.
answered Feb 17, 2017 at 19:34
