148
votes
Accepted
Someone is trying to brute-force(?) my private mail server... very... slowly... and with changing IPs
What's the point of this kind of "attack"? The rate is much too slow to do any efficient brute-forcing, and I really doubt that someone would specifically target my tiny personal server.
...
- 67.3k
121
votes
Can secret GET requests be brute forced?
You are essentially asking if it is safe to pass secret parameters in a GET request. This is actually classified as a vulnerability. It is not feasible to brute force a sufficiently long pseudorandom ...
- 67.3k
99
votes
Accepted
What would be the key size for a picture used as a key?
Your most recent edit indicates that your pictures are procedurally-generated, so your key size will therefore be bounded by the amount of state required to generate an image. Yours seem to be ...
- 1,416
90
votes
Wrong password - number of retries - what's a good number to allow?
Unless you have separate means of restricting access to the login form itself, a good baseline is don't have a hard limit. That's because it's way too easy for someone to be completely locked out of ...
- 2,721
79
votes
Accepted
How does the attacker know what algorithm and salt to use in a dictionary attack?
How are plaintext and hashes compared?
During the brute force attack, words from the dictionary are hashed with the correct hash algorithm and salt, and then compared to the hash in the database dump. ...
- 65.8k
66
votes
Accepted
Is brute force a probable threat even if you enable CAPTCHA and rate limit logins?
The protections you describe are good ones that you should consider, but there can still be weaknesses:
Many CAPTCHAS can be solved by robots, or you can easily pay people to solve them en masse for ...
- 65.8k
63
votes
Do Veracrypt encrypted volumes have any kind of brute force protection?
Any encryption is vulnerable to brute force attack, for example AES-256 has 2^256 keys, and given enough hardware we can “easily” brute force it. The problem is that there’s not enough silicon on ...
- 1,749
62
votes
Accepted
Randomly generated secrets: encoding the random bytes in base64 vs keeping them
It doesn't matter. A number doesn't change because you change the encoding of it.
1012 and 510 is the same number, and contain the same amount of information.
The reason we use base64 is that it is ...
- 17.6k
56
votes
Accepted
When could 256 bit encryption be brute forced?
Most Probably Never
Of the currently known quantum algorithms, Grover's algorithm is the one which directly affects symmetric ciphers the most. Essentially, for a cipher that a classical computer can ...
- 11.6k
53
votes
Accepted
How to respond to a SSH brute force attack on a single VPS?
Yes, this is a perfectly reasonable and common approach. However, you've reinvented fail2ban. You probably want to switch to using that instead so you don't have to debug issues with your script and ...
- 9,462
51
votes
Should Failed Login Attempts Be Logged
Yes, failed login attempts should be logged:
You want to know when people are trying to get in
You want to understand why your accounts are getting locked out
It's also very important - older ...
- 73.3k
51
votes
SSH - If Eve has the passphrase and public key, can she derive the private key?
The private key is unrelated to the passphrase. So is the public key. The public key is also generally stored unencrypted, even when the private key is protected by a passphrase. (Exceptions may exist ...
- 7,835
51
votes
How did the brute-forcers get my IP address so quickly?
An IP address is nothing private. Nowadays it's possible to scan the entire IPv4 Internet within minutes. ZMAP, for example, is a tool that can be used for such scans.
NMAP can be used on IP addresses ...
- 651
49
votes
Accepted
Does it matter if a brute force search for a password returns a collision and not the password?
Steffen's answer covers this perfectly, but I just wanted to add a few more details.
Anything that gives a match is usually fine
As he says, you generally don't care about finding the actual password, ...
- 31.7k
48
votes
How can I secure MySQL against bruteforce attacks?
The most simple solution would be not to expose MySQL. Usually, MySQL server is accessed only from the same machine, in which case you can set it to listen only on a Unix socket, or on a loopback ...
- 19.1k
47
votes
Accepted
Does password length / complexity make any difference if hashes are leaked?
Say you have a dozen people on a beach. You get each person in turn to pick a grain of sand at random, and without looking at it, write their name on it and throw it back randomly onto the beach.
What ...
- 10.7k
44
votes
Accepted
Is this what a brute force SSH attack looks like?
Is this a bruteforce attack
This looks like the background scanning that any server on the internet will experience.
Should I be worried
Not really, background scanning is completely normal, as long ...
- 3,197
38
votes
Is brute force a probable threat even if you enable CAPTCHA and rate limit logins?
Maybe.
it depends on how you define "brute force".
A lockout after X incorrect attempts is great for protecting an account where an attacker is going after a single target.
There's another ...
- 5,160
34
votes
Can secret GET requests be brute forced?
This is a common approach to share public things restricted to the ones who know the URL. An example is Google Docs:
The second option, "Anyone with the link", creates a link similar to yours. Same ...
- 9,096
31
votes
Accepted
After a password leak, is there a Levenshtein distance from which one a newly derivated password can be considered safe?
Levenshtein distance as a proxy for password strength is extremely limited, for the reasons that schroeder has outlined. And the user experience will probably be poor.
But the question is still ...
- 9,717
27
votes
What local resources are used when bruteforcing a remote service?
Well, unless the site you are bruteforcing is potato, it will have rate limits locking you out after a few attempts. So the biggest resource will be the number of IP addresses you can get, to ...
- 7,858
26
votes
Does password length / complexity make any difference if hashes are leaked?
there could potentially be a collision with a very short / not complex string
That's true.
It's possible that your password happens to have a collision with a much shorter string under the specific ...
- 59.3k
26
votes
After a password leak, is there a Levenshtein distance from which one a newly derivated password can be considered safe?
You explicitly want to know if one can calculate a "safe" Levenshtein distance for a password. The answer is "maybe" but the answer would be irrelevant.
whether in targeted ...
- 132k
26
votes
Accepted
Is a randomly generated 80-bit password strong enough nowadays?
A random password with 80 bits of entropy is probably out of reach of most brute-force attackers in 2024, except those that are very well funded (e.g. cybergangs, 3-letter agencies, nation states, etc)...
- 24.1k
24
votes
SSH - If Eve has the passphrase and public key, can she derive the private key?
The passphrase guards against accessing the private key
The passphrase is meant to guard the private key in the event of physical access. If the hacker can sign on to your server and can access your ...
- 9,361
23
votes
How to respond to a SSH brute force attack on a single VPS?
The most effective way to secure SSH system is to login using ssh private key only. You should disable password authentication and disallow direct root login. After that, you will still get many ...
- 31.6k
23
votes
Accepted
Brute force prevention: where and when?
Client side measures are only a partial (and mostly cosmetic) solution, this can only limit non-serious attempts. Any serious attempt will either hit your server directly because a login URL/API was ...
- 8,147
22
votes
What would be the key size for a picture used as a key?
A picture is far too large to use as an encryption key directly, you'll want to run it through a KDF first.
It also depends entirely on the picture whether it will have enough entropy to be useful. ...
- 15.8k
Only top scored, non community-wiki answers of a minimum length are eligible