Quantcast
Viewing all articles
Browse latest Browse all 5

Answer by dhasenan for If a password is compromised, is a "similar" password also compromised?

This depends on what you are worried about. For a wide-scale, automated attack using credentials from one site on others, the attacker will go after the easiest portion first -- people using exactly the same password. Once that has been exhausted, if the attack is still unnoticed, the attacker will look for what he thinks are common patterns -- probably something like base password + site.

A clever attacker who is certain that her original attack (the one that got your passwords) went unnoticed would do this processing before using the passwords she mined. In that case, any predictable modification is dangerous, according to how obvious it is to the attacker.

If your password is, say, a prefix plus a random element, and the attacker suspects this, and the attacker has your password hash on another site, they can get your other password slightly sooner.

You can create your passwords by hashing something predictable, but if this practice becomes at all common or you're receiving personal attention from your attacker, that won't save you. In some ways, password strength is a matter of popularity arbitrage.

tl;dr don't do anything deterministic.


Viewing all articles
Browse latest Browse all 5

Trending Articles