32

On all web services that require passwords, like gmail, you are asked to set a long password. Like 8 characters or more.

The reason being higher security.

But the same services limit the number of login attempts to 3-4 tries before locking your account and asking for more info. Something which I find very annoying, but that's another topic.

So how is a short password insecure if they limit login attempts? If the password has 5 characters someone cannot try all combinations in just 3 attempts.

  • 11
    You assume that blindly typing the password into gmail's interface is the only way to log you in. Furthermore, locking an account after X attempts means I could write a script that automatically tries to log in as you and you could never use gmail ever again. – MechMK1 Dec 21 '19 at 10:05
  • 13
    For the record: 8 characters is not a long password today. – Mast Dec 22 '19 at 16:08
  • 17
    3-4 attempts per user. They can set up a botnet that will try easy passwords to millions of accounts. If people use short password the chances of getting one right are extremely high. – Bakuriu Dec 22 '19 at 17:26
  • 2
    You are making an extremely common mistake: you are focusing on attacks that you envision rather than on ones people actually use. Asking the question here is a good step towards learning about the specifics of this instance but please don't neglect the meta-realization. – Jared Smith Dec 23 '19 at 18:32
  • @MechMK1 Most proper lockout systems prevent bots from locking out legitimate users by only blacklisting a user at a specific ip address. That is the way to do it. – kloddant Dec 23 '19 at 23:06
74

The main reason passwords need to be long and random (i.e. high entropy) is to protect against offline brute force attacks.

Passwords are usually not stored in plain text. Instead, they are hashed. If someone steals the database with the hashed passwords (this is surprisingly common), they can not directly read the passwords. Instead, they have to try loads and loads of passwords to find one that matches the hash. Since the password hashes have been stolen, this can be done on the attacker's machine and not via the website itself (hence offline attack). This means that any limits on retries on the webpage do not apply.

Long and random passwords takes more guesses, so they are harder to crack even if the database is ever stolen. That is why they are encouraged on the web.

  • Useful insight, UV, yet does not address the "number of login attempts to 3-4 tries before locking your account" – chux - Reinstate Monica Dec 22 '19 at 23:31
  • 15
    @chux-ReinstateMonica yes, it does address it. It's perfectly clear after reading this answer that the number of allowed login attempts doesn't matter at all if the attacker has stolen password hashes. – ElmoVanKielmo Dec 23 '19 at 0:58
  • 1
    @ElmoVanKielmo Fair enough : restate: Answer does not address why the number of login attempts is limited to the 3-4 range - it only says it should not matter for security. – chux - Reinstate Monica Dec 23 '19 at 5:03
  • 1
    @chux-ReinstateMonica There are two attack vectors being defended. Long passwords defends against offline attacks, password attempt limits defends against online attacks. While it's probably the case that long passwords adequately mitigates online attacks, these limits have become traditional as defense-in-depth. – Barmar Dec 23 '19 at 16:06
  • I think this is wrong. Complexity requirements after not enough to reliably stop offline brute force. Compare to Veracrypt which is designed to stop offline brute force and had much higher requirements than most web passwords. The main reason is password spraying – paj28 Dec 24 '19 at 15:01
35

It's not as simple...

About online bruteforce

If account become completely locked after 3 attempts, it will be easy to make DOS (Deny Of Service) by locking all accounts!

Server have to base locking decision not only on number of bad tries, but will use IP address, Browser ID and include duration for locking, so if someone just use wrong keyboard, they will be able to reconnect in some delay...

From there, considering botnets, an attacker could use a lot of different IP address and make many different tries. With some smooth options and long delays, short passwords become weak.

  • Sample:

    Considering full brute force against 5 characters choosed in a-z, A-Z, 0-9, $+"*/%&()_: 72 characters

    72^5                 => 1'934'917'632 # all possible combination
    72^5 / 300000        =>         6'449 # botnet
    72^5*900/300000/3    =>     1'934'917 # 3 attemps -> 15' penalty
    

    In seconds: this represent ~22 days to test all combinations.

Nota: 300000 machine some arbitrary mean value from Botnet @Wikipedia . If 6M botnet, job will end in less than one day.

About offline bruteforce

Passwords are commonly stored hashed. If someone could stole your password file (by using remote exploit, social engineering or else), they could use brute force against hash stored in password file.

From there, attacker is not more limited to 3 attempts!!

If your passowrd is longer than 12 characters: 72^12 => 2'435'196'222'894'505'984. This become heavy, even through botnet...

But any john like password cracker, will browse stolen password file and extract quickly all common word based password and all short password.

About long password vs passphrases

Because I prefer (whenever possible) to use passphrases instead of passwords, I really like this XKCD's strip:

enter image description here

So there is a small mathematical demo:

  • Considering 12 letters password with 72 characters bunch:

    $ printf "%'.u\n" $[(72**12)]
    2'435'196'222'894'505'984
    
  • Considering 4 words randomly choosen in american dictionary in word containing 5 to 9 plain letters (a-z, no accents):

    $ printf "%'u\n" $[$(
        LANG=C grep '^[a-z]\{5,9\}$' /usr/share/dict/american-english|
            wc -l) ** 4]
    2'945'898'655'785'685'681
    

    near same number of combinations,

    with minimal phrase length: 5x4=20 alphabetical letters:

    $ printf "%'.u\n" $[(26**20)]
    5'350'152'024'406'097'920
    

    (Nota brute force cracking passphrase implie combination of letters, this will reduce total combination, but stay higher than 41'429 ^ 4... 41429 is the result of wc -l in my previous test)

    And you could even add some salt by adding caps, numbers, and/or any special char... while you stay able to remember them!

9

To prevent "password spraying" where someone tries a common password against many accounts.

  • 3
    There are common passwords longer than 8 characters that could be sprayed; I don't think this addresses the question about short passwords. – multithr3at3d Dec 21 '19 at 14:15
  • 1
    @multithr3at3d - Absolutely there are, and good sites will check against breach databases. But password length is the simplest way to try and make users pick a unique password. – paj28 Dec 21 '19 at 17:57
  • @multithr3at3d - Can you please read this – paj28 Dec 22 '19 at 10:35
  • 1
    To clarify my comment, "limited login attempts" may be mitigation for password spraying, but I don't agree that "password length" is necessarily a mitigation for password spraying, since even the password "password123" is not very short (11 chars), yet it probably turns up in a list of sprayable passwords. – multithr3at3d Dec 22 '19 at 22:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.