157 votes
Accepted

How critical is it to keep your password length secret?

Well, let's start with math: If we assume that your password consists of lowers, uppers, and numbers, that's 62 characters to choose from (just to keep the math easy, real passwords use symbols too). ...
148 votes
Accepted

Someone is trying to brute-force(?) my private mail server... very... slowly... and with changing IPs

What's the point of this kind of "attack"? The rate is much too slow to do any efficient brute-forcing, and I really doubt that someone would specifically target my tiny personal server. ...
  • 65k
136 votes
Accepted

Script Kiddies - how do they find my server IP?

You can't hide your IP address on the internet. They aren't secret. Pretty much what @DeerHunter said. It's trivial to scan the entire internet. If they want, they can target all-known digital ocean ...
  • 22.5k
122 votes

Can secret GET requests be brute forced?

You are essentially asking if it is safe to pass secret parameters in a GET request. This is actually classified as a vulnerability. It is not feasible to brute force a sufficiently long pseudorandom ...
  • 65k
115 votes
Accepted

Is it possible make brute-force attacks ineffective by giving false positive answers to failed log-in attempts?

The answer always depends on your threat model. Security is always woven into a balance between security and usability. Your approach inconveniences the hackers trying to break into the account, but ...
  • 9,206
99 votes
Accepted

What would be the key size for a picture used as a key?

Your most recent edit indicates that your pictures are procedurally-generated, so your key size will therefore be bounded by the amount of state required to generate an image. Yours seem to be ...
  • 1,406
91 votes

Wrong password - number of retries - what's a good number to allow?

Unless you have separate means of restricting access to the login form itself, a good baseline is don't have a hard limit. That's because it's way too easy for someone to be completely locked out of ...
  • 2,741
74 votes
Accepted

How does the attacker know what algorithm and salt to use in a dictionary attack?

How are plaintext and hashes compared? During the brute force attack, words from the dictionary are hashed with the correct hash algorithm and salt, and then compared to the hash in the database dump. ...
  • 64.9k
71 votes
Accepted

Use multiple computers for faster brute force

Sure it's possible, but it doesn't really help. The number of possibilities is just too large. Consider that a 256-bit key has 2256 possible values. That's 12✕1076, or 12 followed by 76 zeroes. If we ...
66 votes
Accepted

Is brute force a probable threat even if you enable CAPTCHA and rate limit logins?

The protections you describe are good ones that you should consider, but there can still be weaknesses: Many CAPTCHAS can be solved by robots, or you can easily pay people to solve them en masse for ...
  • 64.9k
64 votes

Do Veracrypt encrypted volumes have any kind of brute force protection?

Any encryption is vulnerable to brute force attack, for example AES-256 has 2^256 keys, and given enough hardware we can “easily” brute force it. The problem is that there’s not enough silicon on ...
63 votes

Am I experiencing a brute force attack?

Yes it looks like you are experiencing a brute force attack. The attacker is in on a class B private address, so it is likely to be someone with access to your organization's network that is ...
  • 7,699
61 votes

How critical is it to keep your password length secret?

Apart from the maths detailed by @Mike, consider also that the password length leaks all over the place: When it is typed, a sneaky bystander can learn it, either by counting the '*' on the screen, ...
  • 169k
61 votes
Accepted

Could I recover the content of file from its checksum/hash?

A simple answer, NO. It is like asking, if I know, that x%4 = 3, is it possible to find the value of x? No. Surely, there would be infinite values of x satisfying this equation, but you wouldn't ...
  • 4,448
61 votes
Accepted

How practical is it to bruteforce a 10-digit number via URL

About a day If we're lucky: there's no throttling, we can perform each test with a HEAD request, can perform many tests on a single HTTP connection with Keepalive, and can have many concurrent ...
  • 32.8k
58 votes
Accepted

Would allowing shorter passwords sometimes be more secure?

One related question that you missed in your list is this one: How critical is it to keep your password length secret? The accepted answer there (disclaimer: mine) shows that if you have a password ...
58 votes

Script Kiddies - how do they find my server IP?

The IPv4 address space is limited to only 4,294,967,296 addresses.[note 1] Given enough bandwidth, it becomes trivial to scan every single IP address out there, especially if you're the owner of a ...
  • 2,778
56 votes
Accepted

How are GPUs used in brute force attacks?

I'm choosing to assume you're asking why it's a risk rather than how to hack. GPUs are very good at parallelising mathematical operations, which is the basis of both computer graphics and ...
  • 1,122
54 votes
Accepted

How to respond to a SSH brute force attack on a single VPS?

Yes, this is a perfectly reasonable and common approach. However, you've reinvented fail2ban. You probably want to switch to using that instead so you don't have to debug issues with your script and ...
52 votes

How did the brute-forcers get my IP address so quickly?

An IP address is nothing private. Nowadays it's possible to scan the entire IPv4 Internet within minutes. ZMAP, for example, is a tool that can be used for such scans. NMAP can be used on IP addresses ...
  • 651
52 votes
Accepted

When could 256 bit encryption be brute forced?

Most Probably Never Of the currently known quantum algorithms, Grover's algorithm is the one which directly affects symmetric ciphers the most. Essentially, for a cipher that a classical computer can ...
  • 11.3k
51 votes
Accepted

Is it possible to improve brute-force guessing of a password with a picture of the keyboard used to enter it?

In some cases yes, you can guess the most frequently used keys by the wear marks. That's how I know that apparently I use the L, M, N, A and E keys a lot - the keys are now just black, the letter is ...
  • 22.6k
51 votes

Should Failed Login Attempts Be Logged

Yes, failed login attempts should be logged: You want to know when people are trying to get in You want to understand why your accounts are getting locked out It's also very important - older ...
  • 72.1k
50 votes
Accepted

How to know if a file is decrypted or not

You really can't, if you're just encrypting / decrypting text. If you know that the encrypted string is "kdo" and the encryption method is a Caesar shift, the plaintext could just as easily be "IBM" ...
50 votes

SSH - If Eve has the passphrase and public key, can she derive the private key?

The private key is unrelated to the passphrase. So is the public key. The public key is also generally stored unencrypted, even when the private key is protected by a passphrase. (Exceptions may exist ...
  • 7,670
49 votes
Accepted

Does it matter if a brute force search for a password returns a collision and not the password?

Steffen's answer covers this perfectly, but I just wanted to add a few more details. Anything that gives a match is usually fine As he says, you generally don't care about finding the actual password, ...
48 votes

How can I secure MySQL against bruteforce attacks?

The most simple solution would be not to expose MySQL. Usually, MySQL server is accessed only from the same machine, in which case you can set it to listen only on a Unix socket, or on a loopback ...
  • 17.9k
48 votes
Accepted

Does password length / complexity make any difference if hashes are leaked?

Say you have a dozen people on a beach. You get each person in turn to pick a grain of sand at random, and without looking at it, write their name on it and throw it back randomly onto the beach. What ...
  • 10.6k

Only top scored, non community-wiki answers of a minimum length are eligible