Hacker News Reader

Comment by q3k | Hacker News Reader

With a ratelimit of 60 attempts per minute (which is significantly higher than any user would legitimately ever need) you're looking at thousands of years to bruteforce a random 6 character alphanumeric password.

View on HN

This seems remarkably unintuitive, but the math checks out.

(26+10)⁶ = 2,176,782,336

1,450 minutes a day

2,176,782,336 / (1,450 * 60) = ~25,000 years

You went from min per day multiplied by constant per min and ended up with years somehow.

My reasoning:

Number of 6-character alphanumeric passwords: (2*26+10)**6 == 56800235584

Number of seconds in a year: 60*60*24*365 == 31536000

Number of years to enumerate all 6-character alphanumeric passwords at one password a second:

  >>> ((2*26+10)**6)/(60*60*24*365)
  1801.1236549974633

(this assumes that alphanumeric is [a-zA-Z0-9], which some might disagree with)

Yeah and if your system allows an attacker to sustain one attempt per second into perpetuity, then you need to improve your system. Just be wary of DOS attacks against users when considering things like per-user limits (versus per-IP limits)

The problem is that ratelimiting doesn't work when your password database is leaked. Brute force attacks on the front end system basically don't happen because rate limiting is everywhere. They'll try a handful of default passwords and move on.

Reply on news.ycombinator.com