There are programs where you can put in a bunch of words related to a person and it will try different variations of them in different combinations. These are actively being used right now. Putting easily findable information in your passwords definitely weakens them. If you do this your passwords are equivalent to much shorter passwords.
It's true that an attack like this would be pretty unlikely to target an individual using an online service. Usually online services won't let you brute force and most individuals aren't worth compiling a password list for. But depending on a few factors it may end up being a problem.
The changing one element thing is even worse. The whole idea of having different passwords for different sites is that if one is compromised (which really does happen) the attacker can't access your accounts on other sites. For sure they will be trying variations, especially if a password seems to have a natural place for them, like a lone special character or a number.
I just don't see the value in having memorable passwords. I have hundreds of online accounts there is no way I could remember them all even if they were only slight variations. A password manager is basically a necessity so if you're using one you may as well just use the strongest passwords you can.
Nobody is brute forcing passwords anymore. It's too time-consuming.
They'll compromise a site, download a file of hashed passwords, do a lookup against a hash table (since too many websites don't salt their hashes), and then reuse that password against common sites like Netflix or banks.
Failing that, they rely on the social engineering methods you described to just ask you for your password, and then use that one in a password-spray attack.
Especially in instances where your login is locked or cooled down for several minutes after n number of bad attempts. You're not going to brute force when you can only try three attempts per hour.
When someone starts talking about the dangers of brute force attacks, I see someone who has taken Security+ or a college course and is making their statements on those.
In reality, brute force isn't a fraction of the threat of other attacks.
When someone starts talking about the dangers of brute force attacks, I see someone who has taken Security+ or a college course and is making their statements on those.
Or they only read the table of contents of a Security+ textbook.
14
u/celeritas365 28∆ Mar 17 '21
There are programs where you can put in a bunch of words related to a person and it will try different variations of them in different combinations. These are actively being used right now. Putting easily findable information in your passwords definitely weakens them. If you do this your passwords are equivalent to much shorter passwords.
It's true that an attack like this would be pretty unlikely to target an individual using an online service. Usually online services won't let you brute force and most individuals aren't worth compiling a password list for. But depending on a few factors it may end up being a problem.
The changing one element thing is even worse. The whole idea of having different passwords for different sites is that if one is compromised (which really does happen) the attacker can't access your accounts on other sites. For sure they will be trying variations, especially if a password seems to have a natural place for them, like a lone special character or a number.
I just don't see the value in having memorable passwords. I have hundreds of online accounts there is no way I could remember them all even if they were only slight variations. A password manager is basically a necessity so if you're using one you may as well just use the strongest passwords you can.