# Dictionary Attacks 101 **URL:** \ **Category:** blog\ **Created:** [January 7, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/dictionary-attacks-101/234 "2009-01-07T00:00:00Z")\ **Posts on this page:** 20\ **Page:** 5

**Author:** ![Rob](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/r/838e76/32.png) [@Rob](https://discourse.codinghorror.com/u/Rob)\ **Post date:** [January 8, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/dictionary-attacks-101/234/81 "2009-01-08T00:00:00Z")

@David W: I think you don’t have much of a sense of scale. Let’s assume the 40 character passwords, and that the latency of the network is 40 ms (which is pretty typical for my cable connection), everything is done in 1 packet exchange and no latency for other resources, such as CPU and disk. That is approximately 1x10^62. In what units you ask? Age of the universe. Now add in 39 character, 38, 37… That’s a lot of computers needed to brute force everything. ---

**Author:** ![Olivierd1](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/o/c6cbf5/32.png) [@Olivierd1](https://discourse.codinghorror.com/u/Olivierd1)\ **Post date:** [January 8, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/dictionary-attacks-101/234/82 "2009-01-08T00:00:00Z")

To David W, when you say For answer #2, I would say it shouldn’t take longer than a week or two to go through every single one of those combinations. Buy enough computers, and you could do the crack in one day no matter how obscure the password. With 96 char and a lenth of 40 char, you can have 40^96 passwords… In pratice, it’s big. The univers does have something like 10^80 atoms. In pratice, it will be hard to build enougth computer 😉 ---

**Author:** ![Eugene](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/e/8797f3/32.png) [@Eugene](https://discourse.codinghorror.com/u/Eugene)\ **Post date:** [January 8, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/dictionary-attacks-101/234/83 "2009-01-08T00:00:00Z")

One billion of chinese hackers decided to break a Pentagon server by brute forcing. Each and every hacker decided to try a password ‘MaoZedong’ On the 486,384,485th attempt the server gave up and agreed that its password really is ‘MaoZedong’. ---

**Author:** ![Jack9](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/j/a8b319/32.png) [@Jack9](https://discourse.codinghorror.com/u/Jack9)\ **Post date:** [January 8, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/dictionary-attacks-101/234/84 "2009-01-08T00:00:00Z")

It is my answer to twitter’s lesson: [http://jack.lifegoo.com/fail-to-ban-lesson-from-twitte](http://jack.lifegoo.com/fail-to-ban-lesson-from-twitte) ---

**Author:** ![Steve\_O41](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/s/c37758/32.png) [@Steve\_O41](https://discourse.codinghorror.com/u/Steve_O41)\ **Post date:** [January 8, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/dictionary-attacks-101/234/85 "2009-01-08T00:00:00Z")

@the comments supporting openid The only problem I have with openid (and its proliferation) is that you’re putting all of your bags in one basket. If your openid gets hacked; you’re potentially pooched. If you think well I’ll just get multiple openid accounts well then you’re back to the same problem of having a bunch of name/password combos to have to remember. People have enough trouble remembering the important ones they need to remember now as it is. I guess the benefit is that at least you know the company storing your name/pass. ---

**Author:** ![prng](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/p/4491bb/32.png) [@prng](https://discourse.codinghorror.com/u/prng)\ **Post date:** [January 8, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/dictionary-attacks-101/234/86 "2009-01-08T00:00:00Z")

@ David W. re: old Unix passwords IIRC, the passwords were stored encrypted with a salt. The salt is there to prevent dictionary attacks. A dictionary attack is where the attacker pre-computes a dictionary of encrypted passwords. This is presumed to be the time-consuming task. If the attacker uses the frequency of words or other heuristics, and simply throws them unencrypted at the login service, that is a brute-force attack. If the attacker obtains a file of encrypted salted passwords, then the salt is visible (unencrypted). Searching the dictionary space with a chosen password’s salt and comparing to the encrypted value in the file is, again, a brute-force attack. ---

**Author:** ![Steve](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/s/f19dbf/32.png) [@Steve](https://discourse.codinghorror.com/u/Steve)\ **Post date:** [January 8, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/dictionary-attacks-101/234/87 "2009-01-08T00:00:00Z")

I’m especially appalled at banks that have card PIN numbers where they are: 1. only numbers 2. must be exactly four digits long Then there are the websites where you try to use a secure password and they respond by saying: You cannot use the ‘#’ in your password. This is a bad sign in so many ways. ---

**Author:** ![Joossbs](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/j/df705f/32.png) [@Joossbs](https://discourse.codinghorror.com/u/Joossbs)\ **Post date:** [January 8, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/dictionary-attacks-101/234/88 "2009-01-08T00:00:00Z")

Who cares? It’s twitter. ---

**Author:** ![Ryan\_R](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/r/e47c2d/32.png) [@Ryan\_R](https://discourse.codinghorror.com/u/Ryan_R)\ **Post date:** [January 8, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/dictionary-attacks-101/234/89 "2009-01-08T00:00:00Z")

The one thing I do not and will never understand is _maximum_ password requirements. Why do we put such terrible limits on what a password can be? For instance, my bank (of all people) requires my password be no longer than 12 characters and cannot contain any symbols. It’s a bank people! If a password is all I have between my financial information and someone trying to steal it, why can I not make my password 30 characters longer, upper case, lower case, numbers and any symbol under the sun? I’ve resulted to using a password manager and now I try to use a different password for _every_ site I need to log in to. And if they site lists the password req’s on the registration page, I generate a password that will meet their max requirements. You know what else kills me? Sites that make me register but do not tell me what my password can and cannot include. They make me submit the page just to find out in size 36 bolded red text that my password is in-fucking-correct. Thanks a lot! ---

I meant to add… If you’re looking for a killer password manager setup - look no further than Dropbox and Keepass. Keepass has a client for virtually every platform (although their iPhone client is still in beta, that is slowly driving me insane). When I had a Blackberry, my passwords were always at my fingertips. ---

**Author:** ![Ben](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/b/df788c/32.png) [@Ben](https://discourse.codinghorror.com/u/Ben)\ **Post date:** [January 8, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/dictionary-attacks-101/234/91 "2009-01-08T00:00:00Z")

It’s a good thing the [ASP.NET](http://ASP.NET) built in membership provider has a passwordAttemptThreshold and passwordAtttemptWindow. It locks the account after passing the threshold. a href=[http://msdn.microsoft.com/en-us/library/system.web.configuration.membershipsection.aspxhttp://msdn.microsoft.com/en-us/library/system.web.configuration.membershipsection.aspx/a](http://msdn.microsoft.com/en-us/library/system.web.configuration.membershipsection.aspxhttp://msdn.microsoft.com/en-us/library/system.web.configuration.membershipsection.aspx/a) ---

**Author:** ![GaetanoM](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/g/e56c9b/32.png) [@GaetanoM](https://discourse.codinghorror.com/u/GaetanoM)\ **Post date:** [January 8, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/dictionary-attacks-101/234/92 "2009-01-08T00:00:00Z")

Delay a login attempt response means use more server resources, a connection open for example and this can lead to a DOS… ---

**Author:** ![Dan](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/d/eada6e/32.png) [@Dan](https://discourse.codinghorror.com/u/Dan)\ **Post date:** [January 8, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/dictionary-attacks-101/234/93 "2009-01-08T00:00:00Z")

…i’ve always been a fan of the password ‘password’… 😉 ---

**Author:** ![passwordy](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/p/dec6dc/32.png) [@passwordy](https://discourse.codinghorror.com/u/passwordy)\ **Post date:** [January 8, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/dictionary-attacks-101/234/94 "2009-01-08T00:00:00Z")

(a) Several sites have password too weak, try again on the register section, but in the options section on the change password page, it is simply - old password, new password, confirm new password. What’s the use? (b) This struck me as usable (after modification): We (people who do not crack) could make a updated list of IPs and publish ranges and _patterns_ of IPs from where mass-logging attempts originate - use spam-fighting methods to identify IPs. Drawbacks: 1. IPs can be spoofed. 2. IPs change frequently (as much as per minute or faster) 3. Botnets are used, effectively framing clueless users on the basis of IPs Each of these can be taken into account and have been thought about well by spam fighting software. (I haven’t read much about OpenID so these are raw ideas) For example, webmaster1 tells webmaster2: From UTC 20090109.010644 to UTC 20090109.022755, my server got this list of multiple login attempts: 1.2.3.x | 3.67 times per login 3.x.4.5 | 4.58 times per login … etc It can be done, parameterized properly, and he has a program that filters out important IPs (again a local or shared list) It becomes a cat-and-mouse/hide-and-seek game. That makes them work much harder. Reduces the Noise in the cracker attacks - only the really intelligent crackers will be able to work. If this is not incorporated into OpenID, then it should be. Because we cannot afford to overload the network with DDoS-style data from script kiddies. The big bad guys do enough damage, as it is. Maybe we should cut out the noise and make life easier by getting a narrower range of attackers. Any W3 recommendations for Security Audit Standards? Hackersafe exists, but I’ve heard it isn’t all that reliable. ---

[http://www.google.com/search?q=howto+strong+password](http://www.google.com/search?q=howto+strong+password) ---

Many folks above talk of the anguish of maximum length for passwords. Possible reasons: 1. Some managers (or Finance MBA types) wanted to micromanage/nitpick the password system and all they were comfortable with were alphanumeric passwords. 2. These sites have databases designed back then, when computing power was expensive and database sizes were crucial to cost-cutting or ROI - these need rewrites, but nobody dares touch running code and the audit requirements are fixed, although the world has changed to elect Obama, and the audits are passed successfully every year! Customers? who cares, we’ll see that case-by-case, when we reach there. 3. Conspiracy theory: The site _wants_ that some people have access to your data with no strings attached - at all. But given the way the village idiot worked things out (of order) this is not necessary. In cases 1 and 2, Change must come to America! Let’s Hope! ---

**Author:** ![giorgian](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/g/2acd7d/32.png) [@giorgian](https://discourse.codinghorror.com/u/giorgian)\ **Post date:** [January 9, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/dictionary-attacks-101/234/97 "2009-01-09T00:00:00Z")

I was also concerned about delay, but your suggestion to store the time at which one user will be able to log in on server side seems interesting. Are you already doing it somewhere? I’d like to see an implementation of this. ---

**Author:** ![J\_D\_\_Meier4](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/j/59ef9b/32.png) [@J\_D\_\_Meier4](https://discourse.codinghorror.com/u/J_D__Meier4)\ **Post date:** [January 9, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/dictionary-attacks-101/234/98 "2009-01-09T00:00:00Z")

I wondered why Barack was trying to tweet me … I was like come on man, don’t you have to be working on that presidential gig you’re doing? Good run through of the tips. I figured most social sites should know the key patterns and practices by now, especially for dictionary attacks. I can understand getting some of the more advanced stuff wrong – it is complicated. I was working on a threats and countermeasures KB a while back ([http://www.guidanceshare.com/wiki/Threats\_and\_Countermeasures](http://www.guidanceshare.com/wiki/Threats_and_Countermeasures) ), and it has a lot of the basics, but it would be worth elaborating some day. ---

**Author:** ![Atario](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/a/97f17d/32.png) [@Atario](https://discourse.codinghorror.com/u/Atario)\ **Post date:** [January 9, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/dictionary-attacks-101/234/99 "2009-01-09T00:00:00Z")

eBay needs to read this. My account there got cracked into last year, and my password was definitely not dictionary-attack-vulnerable – they have to be lacking throttling too. I only found out about it because the crackers used it to send out spam messages to other members, recording the outgoing messages in my outbox. ---

**Author:** ![Dave](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/d/ee7513/32.png) [@Dave](https://discourse.codinghorror.com/u/Dave)\ **Post date:** [January 9, 2009, 12:00am UTC](https://discourse.codinghorror.com/t/dictionary-attacks-101/234/100 "2009-01-09T00:00:00Z")

If you can get a list of usernames, it would be funny to try to pick a random password like happiness at a time and test it against all usernames. With a login delay per user this could still get you some hits. Already been done, against Norwegian banks, which have predictable numeric user IDs. You keep the password constant and change the user ID, since each account only gets one password attempt recorded against it per given time unit the usual lockout doesn’t get triggered. [Previous page](https://discourse.codinghorror.com/t/dictionary-attacks-101/234.md?page=4) [Next page](https://discourse.codinghorror.com/t/dictionary-attacks-101/234.md?page=6)