How can a hacker try all possible passwords if the system keeps locking me
out after I get it wrong a couple of times?
Hi, everyone. Leo Notenboom.
Here for Askleo.com.
Here's the question.
It's a common one.
I understand that my password,
especially if it's not very strong, can likely be figured out by computer
driven program using trial and error, for example, all permutations combinations
of numbers, letters and special characters.
What I don't understand is this. Would the hacker, be it a person or a machine,
have to actually try every one of these computer derived guesses on the sign
in screen of the website they are trying to access to see if they get lucky?
My experience tells me that after just a few failed attempts at entering
a password, the website will not allow any more tries.
So how in the heck are they able to try
all of the thousands of possible passwords that they come up with?
What you've described is called a brute force attack.
It is literally brute force.
You try everything you possibly can
against whatever it is you're trying to break into.
And indeed, it is a rare system that will allow a brute force attack to proceed
against its login screen after just a couple of times of getting it wrong.
As you can imagine, that's not quite what hackers are doing.
There are some that are definitely doing
that, but in reality, the bigger risk is from something else entirely.
There are two separate ways that hackers deal with this.
One, if we stick with the login screen and they just try logging in,
like you or I would, they don't really try every possible password.
What they do is they work from a list of the most popular passwords.
We've all seen these.
They get published once or twice a year.
These are the worst passwords because they're so common.
And as you might imagine, they tend to be fairly simple.
Regardless of the fact that you and I see
these lists and we know not to use those passwords.
Not everybody does, obviously.
That's why they're so popular.
As a result, hackers will try the most popular passwords first.
That way they stand a higher chance of just being able to log in.
In fact, the ability to log in using one
of those bad passwords probably gets them in most of the time.
Yeah, they might
get it wrong a few times and have to wait a little while while they'll go off
and try a different account while they're waiting for the first account.
But you get the idea eventually, with enough persistence,
one of the passwords on those lists of really bad passwords is going to kick
in, it's going to be right and they're going to get into somebody's account.
So that's one approach.
That approach, of course,
doesn't affect you because you and I are using really good passwords.
We're not using any kind of password
that's on one of those really bad password lists.
For the other approach,
the more common approach, the riskier approach for you and me,
we have to understand how passwords are stored.
When you enter your password, when you create a password for an account,
what is stored is not the password, but what's called the hash of a password.
It's a mathematical function
that generates a number, a really big number, but it's a number.
It is easy to take a password and generate that number.
It is virtually impossible to take
that number and reverse engineer whatever password generated it.
What that means is when you create the password, the system stores the number.
When you come back later to sign in, you enter your password,
that number is calculated and compared against the stored number.
If those two numbers match, well, you must have typed the same thing both
times when you created the password and now when you try to log in.
But the important thing is that there's a number.
Now, what hackers are doing,
and you hear this again also all the time, is they breach online systems and what
they do is they steal the database, the user database, if they at all,
can of all the user accounts that are stored or available on that system.
What that typically includes are things
like user names, email addresses, and this stored number.
Now, what's interesting is
that the hackers have this database on their computer
and they can now start trying all possible passwords against that database.
So they'll take a password,
generate the number, and see if that number appears anywhere
in the database as one of the numbers for any of the accounts in that database.
If it matches, then they know the password that they just tried,
that calculated that number that matched somebody in the database.
That password is that user's password, and they've broken in.
Now, all possible passwords is an interesting phrase.
When we talk about eight character
passwords, it is literally possible within a quote unquote reasonable amount of time,
to actually try every possible eight character password.
So you've got a database and you just start running through all
possible eight character passwords, and eventually you will have tried them
all, and any of them that appear in that database will be discovered.
The trick for you and I? Not use eight character passwords.
It's not been the standard for a long time, right?
We've been recommending twelve character or 16 character.
Personally, I use 20 character passwords.
And the reason is simply this, that when you try all possible passwords,
eight characters, yeah, that's in the realm of possibility.
Twelve characters, not so much.
It would take years to try them all, 16 centuries or more.
20 characters.
20 characters doesn't even show up on the charts of how long it would take anymore.
So that password length is one of the most important things you can do to ensure
that your password is not susceptible to these brute force attacks.
But to answer your question,
it's not that the brute force attack is happening online.
It's happening offline with a copy
of the user database that has somehow been stolen in a breach.
Now, there's one last thing I need to add
to this, and it's something I'll just say it's relatively recent.
As it turns out, long, complicated passwords aren't immune from problems.
Here's the issue.
If a hacker has successfully used a password, any password, for any reason,
however they got it, they remember that password.
They're doing more than brute forcing, right?
They could be using a keylogger to capture what you type in.
They could be using a phishing attack to fool you to type in your password
into something that isn't the real system you think it is.
In both of those cases,
they could capture your password no matter how good a password it is.
Once they have a password that works, they remember.
In addition to this database of the most popular passwords,
they also have a database of passwords that have ever been discovered.
Especially if you're doing an offline try all sorts of passwords attack.
Rather than trying every possible
password, it is more effective for the hackers to say, okay,
let's take our database of all the passwords we've ever discovered
anywhere, at any time and just start trying those.
That is surprisingly effective.
Why?
To put it bluntly, people are lazy.
I'm lazy.
I have used the same password in more than one place.
If the first place gets hacked,
if the first place somehow exposes my password, that password then goes
into the database of passwords that have ever been seen.
And hackers may eventually then go to this
other account, which has had great security,
but I happen to reuse the password they can get in.
So don't
reuse passwords is the big takeaway from that.
Regardless of whether they are doing brute force attacks or whether or not you've got
long and strong passwords, make sure to never reuse passwords.
And of course, I will throw in the plug that says if you enable two factor
authentication on your accounts, even if the hacker knows your password,
good or bad, short or long, whatever, they still can't get in.
Because it's that second factor,
then that protects you from them being able to simply sign in as you.
You should get a notification, and you'll probably understand that, yes,
your password has been breached and you probably want to change the password.
But the bottom line is the hacker will have been unable to get into your account.
So that's the big takeaway.
Brute force attacks don't happen online.
They tend to happen offline to stolen databases.
And there are things that you can and should do to protect yourself,
like not reusing passwords and using long, strong passwords wherever possible.
And of course, turning on two factor authentication.
Hope that helps understand the situation.
For comments, for updates, for links,
related to this topic and more, visit Askleo.com 14547 I'm
Leo Notenboom.
This is Askleo.com. Thanks for watching.