Dismiss Notice
Join Physics Forums Today!
The friendliest, high quality science and math community on the planet! Everyone who loves science is here!

Hacking passwords

  1. Sep 13, 2003 #1
    I have been told to change alphanumeric passwords every so often to avoid someone hacking into a website. Suppose hacking occurs only by trying randomly sequences of numbers and letters to break into the site. Would my changing passwords have any effect, on average, of the site being hacked sooner or later?
     
  2. jcsd
  3. Sep 14, 2003 #2

    selfAdjoint

    User Avatar
    Staff Emeritus
    Gold Member
    Dearly Missed

    Assuming you picked a random sequence and the hacker just kept trying combinations no. whether he's attacking yesterday's pw or today's he has the same problem.

    But suppose some hacker a month ago succeeded in cracking your password. And he passed it around to his friends, and they passed it to their friends, and by now every hacker in the freeping world knows it. So change it frequently if you care about being hacked.
     
  4. Sep 14, 2003 #3

    Eh

    User Avatar

    You have to remember that websites have certain limitations. For instance, a hacker could write a program to randomly guess the password until getting it correct, but the server is likely to have a limit on how frequently the bot can guess it. If the server gets 1 million requests for the script every second, the alarm bell has rung and the admin will shut off access to the site, assuming that many requests doesn't overload the site outright. If we assume that the password only includes case sensitive letters and numbers, with let's say, a maximum of 8 characters, you've still got a countless amount of possible combinations. So unless, the hacker has a million or so years to spare, he/she isn't getting in.

    This issue has come up before, because there was such a program developed to hack UBB boards. UBB was at one time the most popular bulletin board software out there, and most sites with big forums had one installed. In one version, the bonehead programmers decided to do away with the case sensitive passwords. In other words, the password letmein and LeTmEiN are the same. Since 99% of users use simple words as their passwords, this gave some access to virtually any UBB on the net.
     
  5. Sep 15, 2003 #4
    As has been said already, a hacker employing a "brute force" attack, where they simply try every single permutation of the same length as your password, they are no more likely to break todays password as next months password.

    However lets assume the hacker somehow succeeded in breaking your password last month. Then when you change your password this month, they must go through the process all over again, and the hacking process will take just as long.... Or will it? Suppose that the hacker has broken your password a few times in the past, the hard way. Usually they don't succeed, but sometimes they do. An intelligent hacker will look at all these passwords and look for patterns. Now most of us will more than likely end up producing patterns in our passwords, especially if we have to produce one once or twice a week, or maybe more often in some jobs? These patterns won't be blindingly obvious, perhaps you have a slight tendancy to use characters from the right side of the keyboard slightly more than characters from the left side, maybe 49.9% of characters come from the left side and 51.1% come from the right side. This information will slowly leak out of your passwords, and the more of your previous passwords the hacker has the more information they will likely obtain.

    This information could be used to search a particular region of the permutation search space first, then simply searching the remaining space at random if the original search fails. This search will probably not hasten the cracking of your passwords by huge amounts, but it does none the less increase the probability that a hacker will crack your password within the time frame you use that password.

    The above is really simple stuff, and in reality i have no idea whether it will be in any way practical, I've never tried it. But it does show how an intelligent hacker could theoretically start cracking your passwords, and that an intelligent hacker won't simply use a random search. It also goes to show that you should probably use some form of respected random number generator to produce a password, one that is respected among cryptographers wouold be a good choice.
     
  6. Feb 6, 2008 #5
    I wonder if, at this moment, hackers are getting new ideas from this.
     
  7. Feb 6, 2008 #6

    chroot

    User Avatar
    Staff Emeritus
    Science Advisor
    Gold Member

    Please don't resurrect ancient threads.

    - Warren
     
Know someone interested in this topic? Share this thread via Reddit, Google+, Twitter, or Facebook

Have something to add?



Similar Discussions: Hacking passwords
  1. Password Combination (Replies: 18)

  2. Keyspace of a password (Replies: 4)

Loading...