Ask Lemmy

“use a strong password” whats that gonna do if the database gets pwned, sandra?

Strong passwords aren't intended to simply protect against brute-forcing a password via trying to authenticate repeatedly, but also to help protect against brute-force attempts to obtain passwords from a compromised password database using a dictionary attack, the scenario you're describing.

Typically

if an authentication system is storing its password database competently

the password shouldn't be stored in plain text. Instead, the password will be salted (to avoid rainbow table attacks) and then hashed via a cryptographic hash. The password database entry will look something like a tuple of (username, salt, salted hashed password). If the password is a strong one, it will be computationally-hard to obtain the plaintext password, even if someone has the salt and the salted, hashed password.

Were you alive at all in the 00s?

Nice bait, dude. I hope you get something from the answers here.

For a guy with bad passwords and worse understanding of their storage, this post sure has a lot of emotions.

"use a strong password" whats that gonna do if the database gets pwned, sandra? or if you get pwned by a 0click 0day

Is that the metric you're using for what to do? If it can't stand up to a 0click 0day you don't do it? Might as well not set up an account or use any services then.

Like most things, it's defense in depth. Use a strong password to make it harder to crack. Don't use the same password on more than one site so if they do crack it your blast radius is still small (this also applies to the database getting popped.)

Use MFA so even if they do get your credentials there's another barrier. Use an app based one like Aegis and avoid SMS and email if you can (though these can be better than nothing.)

Your goal should be to not be the low hanging fruit, not necessarily to be impenetrable especially when you don't control every piece of the tech stack. A strong password is just one part of that process.

“use a strong password” whats that gonna do if the database gets pwned, sandra?

What database? And how is it pwned? And less importantly, who the hell is Sandra 😂

If you have chosen a, for lack of a better term, password database provider that stores passwords in plain text, which by the way is the only scenario in which pwning such a database would be viable, then that's on you. Otherwise, trying pwn a database that stores passwords in hashed formats following a secure hashing algorithm is not viable unless you are a nation state level actor with an unlimited amount of 5090s. Even then, if such an actor targets you, you are not like to have subscribes to an online database anyway.

The same applies for the scenario where you store your passwords locally: are they in plain text? Then thank the attacker for teaching you a lesson.* If they are hashed - or even better, since they are saved on your system, encrypted - then good luck brute forcing them.

*I do not condone this behavior

Edit: I miss the 2000's because connecting with people face to face was a thing. Because of my mental illness, I'm not capable of dating online. Our cultural (d)evolution has taken that from me. Also, Pokémon was still good instead of brain dead children's slop.

Because Pokemon was king, Social Media was MySpace, crazy frog ringtones were everywhere and 444 55566688833 99966688 meant something.

most things were sucking in the aughts but tech was still decent. that pretty much ended in the teens. you should use a strong password. Your like don't lock your door because how is that going to help you when someone breaks a window.

The early 2000s sucked. Bush, 9/11, Iraq, dj's taking over for live music. The only people nostalgic for those times weren't around before them.