submitted 3 weeks ago by akunohana@piefed.blahaj.zone to c/techsupport@lemmy.world

9 comments fedilink hide all child comments

When an attacker believes that their target does not use secure passwords, they can use tools that compare the digest of the target's password to any of the precompiled lists containing the digests of the most commonly used passwords.

Question: what happens under the hood (hardware and software) when the attacker knows that their target does use secure passwords, possibly using a password manager to deploy passwords of, let's say, 30 characters, whose digests do not occur on those precompiled lists? Do they "simply" have the computer brute force every permutation? For a 30 char passwd using all the upper and lower case characters on an "English" keyboard (a-Z, 0-9, ~ - ?) (94 total), that would entail running 94ˆ30 permutations.

Am I missing something?

you are viewing a single comment's thread
view the rest of the comments

[-] IsoKiero@sopuli.xyz 2 points 3 weeks ago

You're on a right track. But there's a ton of variance, for example poorly built systems (used even today) store passwords in plaintext, so then it doesn't matter how complex your password is, it can still be used as a 'seed' to crack better protected databases. And properly salted+hashed database doesn't have any indication which password is poor and which is strong, so (at least I assume so) attackers just keep their algorithms running for however many hours they think is needed/worth the time and just stop processing once they have sufficient payout of the attack.

For example, without salting and using md5 hash 'password' gives hash '286755fad04869ca523320acce0dc6a4'. Using randomly generated 55 character password gives hash 'd1006257a2b09c76bcba82f209650056'. So, just a database with hashed passwords alone doesn't give you any information if the password is strong or weak.

[-] akunohana@piefed.blahaj.zone 2 points 3 weeks ago* (last edited 3 weeks ago)

Thanks! Great insight! Yeah, I didn't mean to say that the attacker knows the characteristics of the target's passwords. I meant to say, "let's assume that the attackers assumes..." Why any attacker every would assume anything is beyond the point, since I guess they wouldn't, haha. I'm sure seasoned hackers are methodical and empirical in their conquests.

this post was submitted on 29 Apr 2026

6 points (100.0% liked)

techsupport

3138 readers

2 users here now

The Lemmy community will help you with your tech problems and questions about anything here. Do not be shy, we will try to help you.

If something works or if you find a solution to your problem let us know it will be greatly apreciated.

Rules: instance rules + stay on topic

Partnered communities:

You Should Know

Software gore

Recommendations

founded 2 years ago

MODERATORS

GatoB@lemmy.world