149 votes

Someone is trying to brute-force(?) my private mail server... very... slowly... and with changing IPs

What's the point of this kind of "attack"? The rate is much too slow to do any efficient brute-forcing, and I really doubt that someone would specifically target my tiny personal server. ...
forest's user avatar
  • 66.6k
136 votes

Script Kiddies - how do they find my server IP?

You can't hide your IP address on the internet. They aren't secret. Pretty much what @DeerHunter said. It's trivial to scan the entire internet. If they want, they can target all-known digital ocean ...
Mark Buffalo's user avatar
  • 22.6k
122 votes

Can secret GET requests be brute forced?

You are essentially asking if it is safe to pass secret parameters in a GET request. This is actually classified as a vulnerability. It is not feasible to brute force a sufficiently long pseudorandom ...
forest's user avatar
  • 66.6k
114 votes

Is it possible make brute-force attacks ineffective by giving false positive answers to failed log-in attempts?

The answer always depends on your threat model. Security is always woven into a balance between security and usability. Your approach inconveniences the hackers trying to break into the account, but ...
Cort Ammon's user avatar
  • 9,256
99 votes

What would be the key size for a picture used as a key?

Your most recent edit indicates that your pictures are procedurally-generated, so your key size will therefore be bounded by the amount of state required to generate an image. Yours seem to be ...
Blender's user avatar
  • 1,406
91 votes

Wrong password - number of retries - what's a good number to allow?

Unless you have separate means of restricting access to the login form itself, a good baseline is don't have a hard limit. That's because it's way too easy for someone to be completely locked out of ...
mattdm's user avatar
  • 2,731
79 votes

How does the attacker know what algorithm and salt to use in a dictionary attack?

How are plaintext and hashes compared? During the brute force attack, words from the dictionary are hashed with the correct hash algorithm and salt, and then compared to the hash in the database dump. ...
Anders's user avatar
  • 65.6k
71 votes

Use multiple computers for faster brute force

Sure it's possible, but it doesn't really help. The number of possibilities is just too large. Consider that a 256-bit key has 2256 possible values. That's 12✕1076, or 12 followed by 76 zeroes. If we ...
Neil Smithline's user avatar
66 votes

Is brute force a probable threat even if you enable CAPTCHA and rate limit logins?

The protections you describe are good ones that you should consider, but there can still be weaknesses: Many CAPTCHAS can be solved by robots, or you can easily pay people to solve them en masse for ...
Anders's user avatar
  • 65.6k
64 votes

Do Veracrypt encrypted volumes have any kind of brute force protection?

Any encryption is vulnerable to brute force attack, for example AES-256 has 2^256 keys, and given enough hardware we can “easily” brute force it. The problem is that there’s not enough silicon on ...
Andrew Morozko's user avatar
63 votes

Am I experiencing a brute force attack?

Yes it looks like you are experiencing a brute force attack. The attacker is in on a class B private address, so it is likely to be someone with access to your organization's network that is ...
TheJulyPlot's user avatar
  • 7,819
62 votes

Randomly generated secrets: encoding the random bytes in base64 vs keeping them

It doesn't matter. A number doesn't change because you change the encoding of it. 1012 and 510 is the same number, and contain the same amount of information. The reason we use base64 is that it is ...
vidarlo's user avatar
  • 16k
61 votes

Could I recover the content of file from its checksum/hash?

A simple answer, NO. It is like asking, if I know, that x%4 = 3, is it possible to find the value of x? No. Surely, there would be infinite values of x satisfying this equation, but you wouldn't ...
pri's user avatar
  • 4,456
61 votes

How practical is it to bruteforce a 10-digit number via URL

About a day If we're lucky: there's no throttling, we can perform each test with a HEAD request, can perform many tests on a single HTTP connection with Keepalive, and can have many concurrent ...
paj28's user avatar
  • 33.4k
58 votes

Script Kiddies - how do they find my server IP?

The IPv4 address space is limited to only 4,294,967,296 addresses.[note 1] Given enough bandwidth, it becomes trivial to scan every single IP address out there, especially if you're the owner of a ...
user2428118's user avatar
  • 2,786
56 votes

How are GPUs used in brute force attacks?

I'm choosing to assume you're asking why it's a risk rather than how to hack. GPUs are very good at parallelising mathematical operations, which is the basis of both computer graphics and ...
Phil Lello's user avatar
  • 1,122
55 votes

When could 256 bit encryption be brute forced?

Most Probably Never Of the currently known quantum algorithms, Grover's algorithm is the one which directly affects symmetric ciphers the most. Essentially, for a cipher that a classical computer can ...
nobody's user avatar
  • 11.5k
53 votes

How to respond to a SSH brute force attack on a single VPS?

Yes, this is a perfectly reasonable and common approach. However, you've reinvented fail2ban. You probably want to switch to using that instead so you don't have to debug issues with your script and ...
Xiong Chiamiov's user avatar
52 votes

How did the brute-forcers get my IP address so quickly?

An IP address is nothing private. Nowadays it's possible to scan the entire IPv4 Internet within minutes. ZMAP, for example, is a tool that can be used for such scans. NMAP can be used on IP addresses ...
Valentin's user avatar
  • 651
51 votes

Is it possible to improve brute-force guessing of a password with a picture of the keyboard used to enter it?

In some cases yes, you can guess the most frequently used keys by the wear marks. That's how I know that apparently I use the L, M, N, A and E keys a lot - the keys are now just black, the letter is ...
LSerni's user avatar
  • 22.8k
51 votes

Should Failed Login Attempts Be Logged

Yes, failed login attempts should be logged: You want to know when people are trying to get in You want to understand why your accounts are getting locked out It's also very important - older ...
gowenfawr's user avatar
  • 72.8k
50 votes

How to know if a file is decrypted or not

You really can't, if you're just encrypting / decrypting text. If you know that the encrypted string is "kdo" and the encryption method is a Caesar shift, the plaintext could just as easily be "IBM" ...
Dan Ambrogio's user avatar
50 votes

SSH - If Eve has the passphrase and public key, can she derive the private key?

The private key is unrelated to the passphrase. So is the public key. The public key is also generally stored unencrypted, even when the private key is protected by a passphrase. (Exceptions may exist ...
user's user avatar
  • 7,785
49 votes

Does it matter if a brute force search for a password returns a collision and not the password?

Steffen's answer covers this perfectly, but I just wanted to add a few more details. Anything that gives a match is usually fine As he says, you generally don't care about finding the actual password, ...
Conor Mancone's user avatar
48 votes

How can I secure MySQL against bruteforce attacks?

The most simple solution would be not to expose MySQL. Usually, MySQL server is accessed only from the same machine, in which case you can set it to listen only on a Unix socket, or on a loopback ...
Ángel's user avatar
  • 18.8k
48 votes

Does password length / complexity make any difference if hashes are leaked?

Say you have a dozen people on a beach. You get each person in turn to pick a grain of sand at random, and without looking at it, write their name on it and throw it back randomly onto the beach. What ...
lynks's user avatar
  • 10.6k
47 votes

Is it possible make brute-force attacks ineffective by giving false positive answers to failed log-in attempts?

Fooling an attacker with false positives isn't a bad idea, and it's not new. The following may interest you. Cryptographic Camouflage CA technologies has patented a technology known as Cryptographic ...
John Wu's user avatar
  • 9,311

Only top scored, non community-wiki answers of a minimum length are eligible