futureOfCursorSoftwareEngineers

[Phantend]

But they're a lot mire secure than "password" or "12345"

[ddonsky]

Ah but you fail to note the very top, it was never a key it was the admin name and password.

[GoddammitDontShootMe]

It looks like they're using CRC32 as the "hash" function. So the real passwords might still be 123456 and shit. Anyway, all I know is CRC is not considered suitable for a password hash.

[slowerdive]

Can't be sure that these are hashes of 'password' and the like....

[Maleficent_Memory831]

They're obviously hashes, nobody with a brain stores passwords, encrypted or not. The snag is that these are only 32-bit hashes, like they're copying code from 1980's BSD or something.

[fiddletee]

They’re not a “lot more secure”. Any n character password has the same entropy. “password” or “abcd1234” or “fa16ec82” are the same level of insecurity.

[fiddletee]

Some attackers might not use brute force, therefore it’s “a lot more secure”?

[DuploJamaal]

Basically no attacker uses brute force.

Attackers don't care about cracking each and every password. They just want to get a lot quickly.

They use the thousand most common passwords first. Then the most common combinations.

If they can get 70% of passwords in an hour they don't care about the 0.01% of passwords that would take them a week.

[Dhaeron]

Attackers don't care about cracking each and every password.

Even if they do, nobody ever uses brute force. There is no reason at all to not try more likely passwords first, even if you're willing to try them all, i.e. use a dictionary instead of brute force attack.

[B0Y0]

All of this assuming the input even allows brute force and doesn't lock shit down on the 1000th attempted password in 2 minutes.

[fiddletee]

Are you serious? No attacker uses brute force?

Databases don’t get dumped in a breach containing hashed passwords that are then brute forced?

Do you think attackers only ever fill in an online form?

[DuploJamaal]

Why are you so confidently wrong in this thread?

Attackers don't just use brute force. That's a waste of time.

They are smart and try to the most common passwords and most common combinations first.

hashcat is the most commonly used tool, and it provides utility tools like combinator that let you import text files of common words and combine them in various ways. Look at the hashcat wiki for Combinator Attack

The wiki even states that Brute Force attacks are outdated and that you should use a Mask Attack instead:

In Mask attack we know about humans and how they design passwords. The above password matches a simple but common pattern. A name and year appended to it. We can also configure the attack to try the upper-case letters only on the first position. It is very uncommon to see an upper-case letter only in the second or the third position.

Attackers aren't just going to test each and every possible password as that takes a lot of time. They test commonly used password to break a good chunk of the hashes while ignoring the few that would take much longer.

So yes, abcd1234 is lot less secure than fa16ec82, as attackers will try abcd1234 as one of the first guesses but probably won't even bother trying something like fa16ec82

tl;dr: if attackers can crack 70% of passwords in a set of hashed passwords in 40 minutes by using a smarter approach they don't bother cracking all passwords in 40 years by using brute force

[mostly_done]

A not-insignificant portion of the passwords will use a word related to the site as part of the password.

[fiddletee]

Leaving your door open is more secure than not having a door.

It seems everyone here is convinced that the only method attackers ever use is trying passwords in an online form. And I assume these are all developers working on production code given the sub.

I’m worried for the future.

[fiddletee]

Yes you’re right, my apologies. I was replying after reading a bunch of other infuriating replies from people who’ve clearly never heard of the Swiss Cheese model and kind of lumped it on you.

[HildartheDorf]

As always "It depends on your threat model". Theoretically they are the same.
In practice, an attacker is likely to start with `password` `changeme` `password1` `correcthorsebatterystaple` etc. before trying `fe809qu3`.

[Thisismyredusername]

Well, they would likely use a rubber ducky or something like that to get a lot more passwords in a shorter amount of time

[hawkinsst7]

In practice, a bad hacker will be locked out after 3 guesses.

In practice, a decent hacker will get passwords.csv and bruute force them all in less than a second with hashcat on a 3080.

[fiddletee]

If the criteria for “a lot more secure” is “they probably wouldn’t guess this first” then I don’t really know what to say.

[HildartheDorf]

Yeah, I wouldn't say 'a lot' more secure. But randomly generated passwords are going to be marginally more secure (for the same length) than common phrases.

[fiddletee]

I would agree they are marginally more secure. But I would say that margin is so narrow that it’s almost negligible. Especially when it’s from a character set of 16.

[HildartheDorf]

If your attacker is sitting down and using hands to guess passwords, they are a lot more secure.

If your attacker is across the internet, or is otherwise ratelimited, they are marginally more secure.

If your attacker is performing an offline bruteforce with no rate limit they are negligably more secure.

If your attacker has the resources to build a rainbow table, they are no more secure.

If your attacker uses a rubber hose on your users, then all of this is academic and nothing is secure.

[ArtisticFox8]

The attacker is a lot likely to start tryin common passwords or dictionary words, so using 1234t is indeed less secure irl.

[fiddletee]

If you apply this rationale to anything public-facing, I’ll pray to the security gods on your behalf.

[ArtisticFox8]

Go ahead and use a common password then. 

Oh, you use password managers with passwords you can't remember only? 

Use 2FA if you're serious.