3

I always wonder about the generic statements about the security of passwords. Isn't it a huge difference if the password is used for an online account or for local data encryption? For example an ebay account or some local ZIP file encryption?

Some 8 digit password with upper- and lowercase plus numbers is having an entropy of around 47 and not considered as very safe. But if some online account is secured by such password, isn't it completely different? Because for some Bruteforce attack with even hundreds of machines trying to log in, the bandwith is your limit and you're much slower I think. And if the account is locked for a few minutes after some failed logins, it becomes even harder to brute force I guess? We're talking about 628 combinations...

So, why are statements regarding password security so generic? Isn't some 8 digit password to be considered secure for an online account (given that it does not appear in any word book)?

Of course, if the online service database is leaked, the efforts is for finding the password from the hash. But that is a different story...

0
4

If one sets security parameters assuming that the database will never be leaked, and then it is, then the security is breached.

If one assumes that the database will be leaked and sets parameters accordingly then it can be secure.

Since a database can always be leaked (e.g. via rogue employee or law enforcement warrant with subsequent carelessness) it is irresponsible to assume that it can't be. Thus guidelines like NIST's recommend security for the case of a leaked password database.

4
  • Basically you're saying that all is about trying to crack the hash from the database (which is for sure a local attack with all possibilities like rainbow tables etc). So in the light of my question, all is about a leaked database and not really about the possibility to hack into the online account? I understand. So all people talking about passwords assume leaked database. But also for accounts like Facebook? I hear such password advise so many times, but noone is talking about a database leaked by facebook. It's all about securing online login...
    – Kukulkan
    Oct 13 '20 at 12:16
  • You don't know that Facebook is doing things securely. Assume they're saving all passwords in plaintext to a log file. They've (supposedly accidentally) done that before. Even if the database is secure, the passwords might not be. That's why you need unique passwords per account. And you want those passwords to all be as high-entropy as possible, so long passphrases. Use a password manager. Oct 13 '20 at 14:59
  • I already use a password manager since years and I know about this. I was wondering why people always rate passwords the same for online and offline usage. But assuming all databases leaked, it makes sense. Thanks!
    – Kukulkan
    Oct 14 '20 at 13:53
  • "Hope for the best, plan for the worst." As users, we hope they never leak, we plan for them to leak in plaintext. As developers, we hope users don't re-use passwords, we plan for them to do so and thus use strong "password hashing" functions with per-user salts. Good general principle. Oct 14 '20 at 20:41
3

Any secure system is as secure as its weakest link. If you create a database password taking into account only the difficulty of online bruteforce and defending it with rate-limits, CAPTCHA and temporary account suspension, you are planning for failure.

Online bruteforce is not as used the way most people think. Rarely someone will throw hundreds of thousands of passwords against one user, but instead throw hundreds of users against one password (password spraying attack). If you take into account that a lot of people use the top-10 worst used passwords, that makes the attacker job a lot easier.

Offline attacks have another methodology. With a high speed computer, it's possible to throw many billions of passwords per second at the database, so anything you intended to protect against an online attack makes no difference. No rate limit, no CAPTCHA, no account locks can save the passwords.

So plan for the worst case: a database leak and an attacker with lots of resources, and employ a good password hashing algorith like Argon2, for example.

3
  • Like @SAI Peregrinus above, you're also projecting the passwords security question to a leaked database. But in the light of securing the online account, some 8 digits passwords seems save? Of cource, a leaked database is a bad thing then...
    – Kukulkan
    Oct 13 '20 at 12:19
  • 1
    Always assume that the database will leak, the ones managing the database will use unsalted MD5, and plan your password around that. I don't care if AmericanExpress or one guy writing PHP in the basement is taking care of my passwords, they are always 64-byte or the max allowed size and managed by the password manager.
    – ThoriumBR
    Oct 13 '20 at 12:22
  • I already use a password manager since years, too. I was wondering why people always rate passwords the same for online and offline usage. But assuming all databases leaked, it makes sense. Thanks!
    – Kukulkan
    Oct 14 '20 at 13:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.