Hacker News Reader

Comment by andrey_utkin | Hacker News Reader

I am unconvinced. What about persistent password bruteforcing? Rate limits? OK, bruteforcing is happening within those rate limits. That's how the password rots - it becomes less of a secret as many values are tried.

Key material rotation seems to be a sensible practice in general.

View on HN

> it becomes less of a secret as many values are tried.

Not meaningfully. Let's take my Hacker News password and we'll imagine you happen to know (somehow) exactly what the format is, so then you start guessing.

And we'll imagine you can make 1 billion login attempts per second, which in fact I'd guess will make dang pretty unhappy 'cos the servers won't like that.

And maybe you get to do this on a billion computers, and for a billion seconds, again I'm thinking somebody would notice and stop you, but let's just say...

At the end of all that you've still got orders of magnitude less chance of guessing my password, for this web site correctly than a random ticket buyer has of winning the jackpot in a typical state or national lottery game. Get a new hobby.

I think people struggle with the numbers involved. Even astronomical numbers are too small, because astronomical numbers involve practical things, like how quickly light travels and maths does not need to be practical.

Regarding your last point:

"There are 10^11 stars in the galaxy. That used to be a huge number. But it's only a hundred billion. It's less than the national deficit! We used to call them astronomical numbers. Now we should call them economical numbers." - Richard Feynman

Let's take my library account. Sequentially issued card numbers, 4-digit PINs. :(

With a ratelimit of 60 attempts per minute (which is significantly higher than any user would legitimately ever need) you're looking at thousands of years to bruteforce a random 6 character alphanumeric password.

This seems remarkably unintuitive, but the math checks out.

(26+10)⁶ = 2,176,782,336

1,450 minutes a day

2,176,782,336 / (1,450 * 60) = ~25,000 years

You went from min per day multiplied by constant per min and ended up with years somehow.

My reasoning:

Number of 6-character alphanumeric passwords: (2*26+10)**6 == 56800235584

Number of seconds in a year: 60*60*24*365 == 31536000

Number of years to enumerate all 6-character alphanumeric passwords at one password a second:

  >>> ((2*26+10)**6)/(60*60*24*365)
  1801.1236549974633

(this assumes that alphanumeric is [a-zA-Z0-9], which some might disagree with)

Yeah and if your system allows an attacker to sustain one attempt per second into perpetuity, then you need to improve your system. Just be wary of DOS attacks against users when considering things like per-user limits (versus per-IP limits)

The problem is that ratelimiting doesn't work when your password database is leaked. Brute force attacks on the front end system basically don't happen because rate limiting is everywhere. They'll try a handful of default passwords and move on.

What you're saying is true, but you need to consider a regular office drone who doesn't care about security. If you require them to change the password every 90 days, you will end up with the majority of people having passwords like conS0t01, conS0t02, conS0t03... And not only will they have such weak passwords, they will boast about this to anyone who will listen, leading users to actually tell other people their password, and how they arrive at (And remember) the current mutation.

And when it arrived at the point user themselves are confusing about "wait, is it end at 33 or 34?". They Will Write It Down On Post It. And you end up get the worst security situation you can get normally.

if your password is strong, this negates bruteforcing, unless if there is a good reason someone would want to hack you.

Reply on news.ycombinator.com