Današnja pitanja i odgovori nam se javljaju zahvaljujući SuperUseru - podjele Stack Exchange-a, zajedničkom pogonu Q & A web stranica.
Pitanje
SuperUser čitač Michael McGowan je znatiželjan koliko dalekosežan utjecaj jednog lozinke povrede je, piše:
Suppose a user uses a secure password at site A and a different but similar secure password at site B. Maybe something like
mySecure12#PasswordA
na stranicama A i
mySecure12#PasswordB
na mjestu B (slobodno upotrijebite drugu definiciju "sličnosti" ako ima smisla).
Pretpostavimo da je lozinka za web lokaciju A na neki način ugrožena … možda zlonamjerni zaposlenik stranice A ili sigurnosni propust. Znači li to da je lozinka stranice B učinkovito ugrožena, ili u takvom kontekstu nema takve "lozinke sličnosti"? Je li bilo kakvih razlika je li kompromis na web-lokaciji A bio isprekidani tekst ili iskrivljena verzija?
Je li Michael trebao brinuti ako mu se dogodi hipotetska situacija?
Odgovor
SuperUser suradnici pomogli su razjasniti pitanje Michaela. Super pomoćnik suradnik Queso piše:
To answer the last part first: Yes, it would make a difference if the data disclosed were cleartext vs. hashed. In a hash, if you change a single character, the entire hash is completely different. The only way an attacker would know the password is to brute force the hash (not impossible, especially if the hash is unsalted. see rainbow tables).
As far as the similarity question, it would depend on what the attacker knows about you. If I get your password on site A and if I know you use certain patterns for creating usernames or such, I may try those same conventions on passwords on sites you use.
Alternatively, in the passwords you give above, if I as an attacker see an obvious pattern that I can use to separate a site-specific portion of the password from the generic password portion, I will definitely make that part of a custom password attack tailored to you.
As an example, say you have a super secure password like 58htg%HF!c. To use this password on different sites, you add a site-specific item to the beginning, so that you have passwords like: facebook58htg%HF!c, wellsfargo58htg%HF!c, or gmail58htg%HF!c, you can bet if I hack your facebook and get facebook58htg%HF!c I am going to see that pattern and use it on other sites I find that you may use.
It all comes down to patterns. Will the attacker see a pattern in the site-specific portion and generic portion of your password?
Drugi suradnik Superusera, Michael Trausch, objašnjava kako u većini situacija hipotetska situacija nije mnogo razloga za zabrinutost:
To answer the last part first: Yes, it would make a difference if the data disclosed were cleartext vs. hashed. In a hash, if you change a single character, the entire hash is completely different. The only way an attacker would know the password is to brute force the hash (not impossible, especially if the hash is unsalted. see rainbow tables).
As far as the similarity question, it would depend on what the attacker knows about you. If I get your password on site A and if I know you use certain patterns for creating usernames or such, I may try those same conventions on passwords on sites you use.
Alternatively, in the passwords you give above, if I as an attacker see an obvious pattern that I can use to separate a site-specific portion of the password from the generic password portion, I will definitely make that part of a custom password attack tailored to you.
As an example, say you have a super secure password like 58htg%HF!c. To use this password on different sites, you add a site-specific item to the beginning, so that you have passwords like: facebook58htg%HF!c, wellsfargo58htg%HF!c, or gmail58htg%HF!c, you can bet if I hack your facebook and get facebook58htg%HF!c I am going to see that pattern and use it on other sites I find that you may use.
It all comes down to patterns. Will the attacker see a pattern in the site-specific portion and generic portion of your password?
Ako ste zabrinuti da trenutni popis zaporki nije raznolik i dovoljno velik, preporučujemo da pogledate naš opsežan sigurnosni vodič za lozinku: Kako se vratiti nakon što je zaporka vaše e-pošte kompromitirana. Obradom popisa lozinke kao da je majka svih lozinki, vaša e-mail lozinka, ugrožena, lako je brzo prenesiti portfelj lozinke do brzine.
Imate li nešto za objašnjenje? Zvuči u komentarima. Želite li pročitati više odgovora od drugih tehnoloških korisnika Stack Exchangea? Pogledajte ovdje cijelu raspravu.
