157 votes
Accepted

How critical is it to keep your password length secret?

Well, let's start with math: If we assume that your password consists of lowers, uppers, and numbers, that's 62 characters to choose from (just to keep the math easy, real passwords use symbols too). ...
user avatar
148 votes
Accepted

Someone is trying to brute-force(?) my private mail server... very... slowly... and with changing IPs

What's the point of this kind of "attack"? The rate is much too slow to do any efficient brute-forcing, and I really doubt that someone would specifically target my tiny personal server. ...
user avatar
  • 63.8k
136 votes
Accepted

Script Kiddies - how do they find my server IP?

You can't hide your IP address on the internet. They aren't secret. Pretty much what @DeerHunter said. It's trivial to scan the entire internet. If they want, they can target all-known digital ocean ...
user avatar
  • 22.5k
122 votes

Can secret GET requests be brute forced?

You are essentially asking if it is safe to pass secret parameters in a GET request. This is actually classified as a vulnerability. It is not feasible to brute force a sufficiently long pseudorandom ...
user avatar
  • 63.8k
115 votes
Accepted

Is it possible make brute-force attacks ineffective by giving false positive answers to failed log-in attempts?

The answer always depends on your threat model. Security is always woven into a balance between security and usability. Your approach inconveniences the hackers trying to break into the account, but ...
user avatar
  • 9,206
99 votes
Accepted

What would be the key size for a picture used as a key?

Your most recent edit indicates that your pictures are procedurally-generated, so your key size will therefore be bounded by the amount of state required to generate an image. Yours seem to be ...
user avatar
  • 1,406
91 votes

Wrong password - number of retries - what's a good number to allow?

Unless you have separate means of restricting access to the login form itself, a good baseline is don't have a hard limit. That's because it's way too easy for someone to be completely locked out of ...
user avatar
  • 2,721
75 votes
Accepted

How does the attacker know what algorithm and salt to use in a dictionary attack?

How are plaintext and hashes compared? During the brute force attack, words from the dictionary are hashed with the correct hash algorithm and salt, and then compared to the hash in the database dump. ...
user avatar
  • 64.2k
71 votes
Accepted

Use multiple computers for faster brute force

Sure it's possible, but it doesn't really help. The number of possibilities is just too large. Consider that a 256-bit key has 2256 possible values. That's 12✕1076, or 12 followed by 76 zeroes. If we ...
user avatar
66 votes
Accepted

Is brute force a probable threat even if you enable CAPTCHA and rate limit logins?

The protections you describe are good ones that you should consider, but there can still be weaknesses: Many CAPTCHAS can be solved by robots, or you can easily pay people to solve them en masse for ...
user avatar
  • 64.2k
64 votes

Do Veracrypt encrypted volumes have any kind of brute force protection?

Any encryption is vulnerable to brute force attack, for example AES-256 has 2^256 keys, and given enough hardware we can “easily” brute force it. The problem is that there’s not enough silicon on ...
user avatar
63 votes

Am I experiencing a brute force attack?

Yes it looks like you are experiencing a brute force attack. The attacker is in on a class B private address, so it is likely to be someone with access to your organization's network that is ...
user avatar
  • 7,639
61 votes

How critical is it to keep your password length secret?

Apart from the maths detailed by @Mike, consider also that the password length leaks all over the place: When it is typed, a sneaky bystander can learn it, either by counting the '*' on the screen, ...
user avatar
  • 168k
61 votes
Accepted

Could I recover the content of file from its checksum/hash?

A simple answer, NO. It is like asking, if I know, that x%4 = 3, is it possible to find the value of x? No. Surely, there would be infinite values of x satisfying this equation, but you wouldn't ...
user avatar
  • 4,438
61 votes
Accepted

How practical is it to bruteforce a 10-digit number via URL

About a day If we're lucky: there's no throttling, we can perform each test with a HEAD request, can perform many tests on a single HTTP connection with Keepalive, and can have many concurrent ...
user avatar
  • 32.6k
58 votes
Accepted

Would allowing shorter passwords sometimes be more secure?

One related question that you missed in your list is this one: How critical is it to keep your password length secret? The accepted answer there (disclaimer: mine) shows that if you have a password ...
user avatar
58 votes

Script Kiddies - how do they find my server IP?

The IPv4 address space is limited to only 4,294,967,296 addresses.[note 1] Given enough bandwidth, it becomes trivial to scan every single IP address out there, especially if you're the owner of a ...
user avatar
  • 2,768
56 votes
Accepted

How are GPUs used in brute force attacks?

I'm choosing to assume you're asking why it's a risk rather than how to hack. GPUs are very good at parallelising mathematical operations, which is the basis of both computer graphics and ...
user avatar
  • 1,122
54 votes
Accepted

How to respond to a SSH brute force attack on a single VPS?

Yes, this is a perfectly reasonable and common approach. However, you've reinvented fail2ban. You probably want to switch to using that instead so you don't have to debug issues with your script and ...
user avatar
52 votes

How did the brute-forcers get my IP address so quickly?

An IP address is nothing private. Nowadays it's possible to scan the entire IPv4 Internet within minutes. ZMAP, for example, is a tool that can be used for such scans. NMAP can be used on IP addresses ...
user avatar
  • 651
52 votes
Accepted

When could 256 bit encryption be brute forced?

Most Probably Never Of the currently known quantum algorithms, Grover's algorithm is the one which directly affects symmetric ciphers the most. Essentially, for a cipher that a classical computer can ...
user avatar
  • 10.8k
51 votes
Accepted

How to know if a file is decrypted or not

You really can't, if you're just encrypting / decrypting text. If you know that the encrypted string is "kdo" and the encryption method is a Caesar shift, the plaintext could just as easily be "IBM" ...
user avatar
51 votes
Accepted

Is it possible to improve brute-force guessing of a password with a picture of the keyboard used to enter it?

In some cases yes, you can guess the most frequently used keys by the wear marks. That's how I know that apparently I use the L, M, N, A and E keys a lot - the keys are now just black, the letter is ...
user avatar
  • 22.5k
51 votes

Should Failed Login Attempts Be Logged

Yes, failed login attempts should be logged: You want to know when people are trying to get in You want to understand why your accounts are getting locked out It's also very important - older ...
user avatar
  • 71.7k
50 votes

SSH - If Eve has the passphrase and public key, can she derive the private key?

The private key is unrelated to the passphrase. So is the public key. The public key is also generally stored unencrypted, even when the private key is protected by a passphrase. (Exceptions may exist ...
user avatar
  • 7,660
49 votes
Accepted

Does it matter if a brute force search for a password returns a collision and not the password?

Steffen's answer covers this perfectly, but I just wanted to add a few more details. Anything that gives a match is usually fine As he says, you generally don't care about finding the actual password, ...
user avatar
48 votes

How can I secure MySQL against bruteforce attacks?

The most simple solution would be not to expose MySQL. Usually, MySQL server is accessed only from the same machine, in which case you can set it to listen only on a Unix socket, or on a loopback ...
user avatar
  • 17.3k
48 votes
Accepted

Does password length / complexity make any difference if hashes are leaked?

Say you have a dozen people on a beach. You get each person in turn to pick a grain of sand at random, and without looking at it, write their name on it and throw it back randomly onto the beach. What ...
user avatar
  • 10.6k

Only top scored, non community-wiki answers of a minimum length are eligible