5

I never use the same password twice and my passwords are always comprised of a long, random string of letters, numbers and symbols. (with an offline password manager to store each password string)

However, I wondered if (even with my strong passwords) leaving IMAP enabled left my Gmail account at risk from brute force password cracking.

Therefore, I was curious if it would be safer to leave IMAP off and only access Gmail via a web browser. (using HTTPS) Or, if such a precaution was unnecessary.

===

Note: The reason that I thought Gmail's website would be more resilient to brute force password cracking, is that Gmail's website requires entering a CAPTCHA code, after a certain number of failed login attempts---while IMAP does not appear to offer that protection.

Improve this question
3
  • 1
    Since you're worried about GMail security, you may want to look at enabling 2-factor authentication. It adds an additional requirement, that any attacker needs to steal your phone before they even start making password attempts. They use an alternate method for IMAP (since there's no challenge/response mechanism), which is extremely long randomly generated single-application passwords (long enough that there's not enough energy in the universe to break them by brute force).
    – Brendan Long
    Commented Dec 6, 2012 at 16:57
  • The one-time rescue codes only function as the physical factor, so it still means someone needs to steal your wallet and guess your password. But yeah, two factor is an additional annoyance (which is why most sites don't do it).
    – Brendan Long
    Commented Dec 6, 2012 at 20:25
  • Well I agree that two-factor authentication (TFA) is superior in keeping people out, compared to just using a password. But because of TFA's smartphone dependency, there is a risk that I will lose access to my phone. (due to battery issues or theft) And resetting my passwords could prove complicated, if there a problem with automatic-login via browser cookies or one-time-rescue codes. === In other words, with an offline password database, it appears that there is much less risk of locking myself out of my account, compared to TFA.
    – Ademos
    Commented Dec 6, 2012 at 22:00

1 Answer 1

Reset to default
6

Based upon your password habits, I don't think it will make a substantial difference.

If you use a long, strong, random password, then it will be infeasible for anyone to crack your password through online guessing (i.e., automated attacks, where the attacker repeatedly connects to Google and tries one guess at your password at a time). This is true even if Google doesn't use a CAPTCHA for the IMAP and even if Google doesn't do any rate-limiting after several erroneous password guesses (which they might). Breaking your password in this way would simply take too long. Consider, for example, a 8-character random password made of alphanumerics. There are 62^8 possible passwords. That's about 10^14. So, to find your password, an attacker would have to try logging into Gmail 10^14 times. At a rate of 1000 login attempts/second, that'll take 10^11 seconds = 3,000 years. Therefore, it's not worth worrying about it.

The weakest link in your security is likely to be something else -- e.g., the security of the client device you use.

In other words, the difficulty of guessing your password is not the weakest link in the chain, so (by Amdahl's law) it's not worth optimizing it: making password guessing harder won't make much of a change to the cost of the cheapest attack, and won't make much of a change to your overall risk.

P.S. I do recommend that you make sure to always use SSL or TLS, to prevent folks from eavesdropping on your password. For instance, use IMAPS (IMAP over SSL/TLS) to connect to Gmail. If your server happens to support both, IMAPS is probably superior to STARTTLS, because STARTTLS will fall back to unencrypted cleartext communications if it cannot negotiate TLS, whereas IMAPS won't.

Improve this answer
8
  • Thank you for the thorough answer. --- However, I wasn't thinking of trial-and-error brute force password cracking. Instead, I was thinking of automated brute force cracking or a dictionary attack. --- I have seen utilities to perform this task via IMAP and it made me worry about enabling IMAP for my Gmail account. ==== Thank you for the advice about SSL/TLS. I will make sure I have them enabled on my email client.
    – Ademos
    Commented Dec 6, 2012 at 3:30
  • @Ademos, sorry for my poorly worded answer. Actually, that kind of automated attack is exactly what I was thinking of, though I did a poor job of expressing myself. I didn't mean to draw a distinction between manual vs automated attacks; rather, I had in mind exactly the sort of automated attack you referred to. I've edited my answer to try to be clearer. Sorry about that.
    – D.W.
    Commented Dec 6, 2012 at 3:40
  • Thank you for clarifying. But I'm curious why you think it would be infeasible for an attacker to use automated attacks against a Gmail account, via IMAP. Is it simply because it would take too much time? Because with the advent of GPU-acceleration, the speed of password cracking has increased. (which is why I thought the threat had also increased)
    – Ademos
    Commented Dec 6, 2012 at 3:49
  • 1
    It's because it would take too much time (the attacker has to try logging into Gmail too many times). GPU acceleration doesn't help the attacker: without knowing the hash of your password, the attacker can only do online attacks, not offline attacks, and GPU acceleration only speeds up offline attacks. Consider a 8-character random password made of alphanumerics. There are 62^8 ~= 10^14 possible passwords. An attacker would have to try logging into Gmail 10^14 times. At a rate of 1000 login attempts/second, that'll take 10^13 seconds = 300,000 years.
    – D.W.
    Commented Dec 6, 2012 at 3:55
  • Wow, 300,000 years!? (additionally, my passwords are always much longer than 8 characters) Alright, you've convinced me. Thank you for your help. === Also, I hadn't considered the difference between offline and online attacks. Thanks for the additional information.
    – Ademos
    Commented Dec 6, 2012 at 3:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .