Thanks for replying!
I think you might of slightly misunderstood me though, assume that a database is compromised, along with the hashing algorithm, and along with all your user records. Pretty much everything, which is something that should probably be assumed when an attack has taken place.
I think it's quite important to still protect peoples user names and password even in this circumstance, as quite often people use common user names/passwords across multiple web accounts, say for example Paypal, or a poker site.
So if someone gained access to you database, either because they failed to set it up properly on the website, or because a rogue web host decided to copy it over, or the webmaster made an error at some point, or for any other reason, you have a breach which could potentially be damaging to users on other websites, without the users knowledge of the source of the compromise.
Now assume the minimum password requirement was 5 chars, allowing any alphanumeric chars. The minimum search space is:
35^5 = ~52,000,000 possible passwords
and lets say we want to crack all passwords < 8 chars:
35^7 = 64,000,000,000 possible passwords
Now if I write a script to iterate through every combination of password, 64 billion of them, at a rate of 1 billion per second (conservative rate), it would take a maximum of 60 seconds for me to uncover a single users password. So a database with 5,000 users, I can brute force all their passwords within worst case 4 days, as long as all their passwords are <8 chars. I can then try logging in with their details across lots of different sites to see if I can gain access.
If the password is stored rehashed, say 2,000 times, a brute force attack on a single users password would take worst case 34 hours to crack a single users password, it would then take worst case 20 years to crack everyone's passwords. It would render such an attack pretty difficult and unachievable/unworthwhile for most hackers. They could cherry pick users and spend 30 hours brute forcing the password but the majority of users will be safe.
This way, if I operated a site and the database was exposed at some point, I would still alert users they should change their passwords, but I wouldn't send out a message saying it's VERY important they change their passwords as they are easily brute forceable.
I'm acutely aware I haven't been on these forums for a long time, so I hope you aren't taking this as negative criticism, I'm fully aware that you are very security concious and have written WWF excellently, this is just a suggestion to improve security if ever a database was compromised, which I think is more likely to happen on freely distributed software.
Edited by Gullanian - 21 March 2011 at 12:16pm
Topic Options
Post Options
Thanks(0)
