1

I'm curious, to what extent are passwords exploitable if the underlying password comparison is vulnerable to timing attacks. My main concern is that internet speed continuously varies, webserver response times change depending on server load, etc.

1

If the timing difference is in plaintext password comparison, it is not really feasible to do this over the Internet. However, it is often possible for the attacker to get access to a computer in the same network, or even to a VM on the same hardware, by hosting his attack with the same hosting provider as the target web site.

If the site uses hashed passwords and compares the hashes instead of the plaintext password, this timing attack scenario doesn't apply anymore.

| improve this answer | |
  • The last sentence is not entirely true. Beware of comparing hashes with '===' as it is still sensitive to timing attack However having a comparison that always takes the same amount of time to compare the two strings is safe against timing attacks – Tofandel Feb 11 at 13:03

Not the answer you're looking for? Browse other questions tagged or ask your own question.