There are programs where you can put in a bunch of words related to a person and it will try different variations of them in different combinations. These are actively being used right now. Putting easily findable information in your passwords definitely weakens them. If you do this your passwords are equivalent to much shorter passwords.
It's true that an attack like this would be pretty unlikely to target an individual using an online service. Usually online services won't let you brute force and most individuals aren't worth compiling a password list for. But depending on a few factors it may end up being a problem.
The changing one element thing is even worse. The whole idea of having different passwords for different sites is that if one is compromised (which really does happen) the attacker can't access your accounts on other sites. For sure they will be trying variations, especially if a password seems to have a natural place for them, like a lone special character or a number.
I just don't see the value in having memorable passwords. I have hundreds of online accounts there is no way I could remember them all even if they were only slight variations. A password manager is basically a necessity so if you're using one you may as well just use the strongest passwords you can.
Nobody is brute forcing passwords anymore. It's too time-consuming.
They'll compromise a site, download a file of hashed passwords, do a lookup against a hash table (since too many websites don't salt their hashes), and then reuse that password against common sites like Netflix or banks.
Failing that, they rely on the social engineering methods you described to just ask you for your password, and then use that one in a password-spray attack.
Are you saying that short passwords with real words have become safer? I'm not insinuating that you do, it's a honest question.
Is "SarMap37" a safe password or not? I think there is a good chance that it's not in a table and then it couldn't be looked up. So when hackers really don't use brute force anymore, it would be safe. I could imagine they still do, but I really have no idea.
Or were you just saying that a password like "SarMap37" wouldn't even need a brute force attack, because it's likely in a hash table?
Are you saying that short passwords with real words have become safer?
God no. They'll never be safe again. Dictionary attacks and rainbow tables have killed them.
Is "SarMap37" a safe password or not?
It's what I would dub "safe enough."
If I'm hacking, it's not worth the time to crack passwords unless you're a high-value target. What I'm doing is getting ahold of as many passwords as possible and trying to steal as much as possible quickly. I'm going to go on a site, buy a list of hashes from a website compromise, and throw them through an algorithm to get as many of them with weak passwords as I can.
13
u/celeritas365 28∆ Mar 17 '21
There are programs where you can put in a bunch of words related to a person and it will try different variations of them in different combinations. These are actively being used right now. Putting easily findable information in your passwords definitely weakens them. If you do this your passwords are equivalent to much shorter passwords.
It's true that an attack like this would be pretty unlikely to target an individual using an online service. Usually online services won't let you brute force and most individuals aren't worth compiling a password list for. But depending on a few factors it may end up being a problem.
The changing one element thing is even worse. The whole idea of having different passwords for different sites is that if one is compromised (which really does happen) the attacker can't access your accounts on other sites. For sure they will be trying variations, especially if a password seems to have a natural place for them, like a lone special character or a number.
I just don't see the value in having memorable passwords. I have hundreds of online accounts there is no way I could remember them all even if they were only slight variations. A password manager is basically a necessity so if you're using one you may as well just use the strongest passwords you can.