Tänane küsimuste ja vastuste seanss tuleb meile viisakalt SuperUseriga, mis on Q & A veebisaitide kogukonna juhtimisgruppide Stack Exchange osakond.
Küsimus
SuperUseri lugeja Michael McGowan on uudishimulik, kui kaugele ulatub ühe salasõna rikkumine; ta kirjutab:
Suppose a user uses a secure password at site A and a different but similar secure password at site B. Maybe something like
mySecure12#PasswordA
saidil A ja
mySecure12#PasswordB
saidil B (võite kasutada mõnda muud sarnasuse mõistet, kui see on mõttekas).
Oletame, et saidi A parool on kuidagi kahjustatud … võib-olla on saidi A pahatahtlik töötaja või turva leke. Kas see tähendab, et saidi B parool on ka tegelikult kahjustatud või kas selles kontekstis pole sellist asja nagu "paroolide sarnasus"? Kas on mingit vahet, kas kohas A sisalduv kompromiss oli tavalise teksti leke või räsitud versioon?
Kas Michael peaks muretsema, kui tema hüpoteetiline olukord läheb?
Vastus
SuperUseri toetajad aitasid Michaelil probleemi lahendada. Superuser-panustaja Queso kirjutab:
To answer the last part first: Yes, it would make a difference if the data disclosed were cleartext vs. hashed. In a hash, if you change a single character, the entire hash is completely different. The only way an attacker would know the password is to brute force the hash (not impossible, especially if the hash is unsalted. see rainbow tables).
As far as the similarity question, it would depend on what the attacker knows about you. If I get your password on site A and if I know you use certain patterns for creating usernames or such, I may try those same conventions on passwords on sites you use.
Alternatively, in the passwords you give above, if I as an attacker see an obvious pattern that I can use to separate a site-specific portion of the password from the generic password portion, I will definitely make that part of a custom password attack tailored to you.
As an example, say you have a super secure password like 58htg%HF!c. To use this password on different sites, you add a site-specific item to the beginning, so that you have passwords like: facebook58htg%HF!c, wellsfargo58htg%HF!c, or gmail58htg%HF!c, you can bet if I hack your facebook and get facebook58htg%HF!c I am going to see that pattern and use it on other sites I find that you may use.
It all comes down to patterns. Will the attacker see a pattern in the site-specific portion and generic portion of your password?
Teine Superuserite panustaja Michael Trausch selgitab, kuidas hüpoteetiline olukord enamikes olukordades ei tekita tõsist muret.
To answer the last part first: Yes, it would make a difference if the data disclosed were cleartext vs. hashed. In a hash, if you change a single character, the entire hash is completely different. The only way an attacker would know the password is to brute force the hash (not impossible, especially if the hash is unsalted. see rainbow tables).
As far as the similarity question, it would depend on what the attacker knows about you. If I get your password on site A and if I know you use certain patterns for creating usernames or such, I may try those same conventions on passwords on sites you use.
Alternatively, in the passwords you give above, if I as an attacker see an obvious pattern that I can use to separate a site-specific portion of the password from the generic password portion, I will definitely make that part of a custom password attack tailored to you.
As an example, say you have a super secure password like 58htg%HF!c. To use this password on different sites, you add a site-specific item to the beginning, so that you have passwords like: facebook58htg%HF!c, wellsfargo58htg%HF!c, or gmail58htg%HF!c, you can bet if I hack your facebook and get facebook58htg%HF!c I am going to see that pattern and use it on other sites I find that you may use.
It all comes down to patterns. Will the attacker see a pattern in the site-specific portion and generic portion of your password?
Kui olete mures, et teie praegune parooliloend ei ole mitmekesine ja piisavalt juhuslik, soovitame kindlasti kontrollida meie laiaulatuslikku parooli turvalisuse juhendit: Kuidas taastada pärast teie e-posti parooli ohtu. Parooli loendite ümbertegemine nii, nagu kõikide paroolide ema, teie e-posti parool on ohus, on lihtne oma parooliportfelli kiiresti kiirendada.
Kas teil on seletamiseks midagi lisada? Helistage kommentaarides. Kas soovite lugeda rohkem vastuseid teistelt tech-savvy Stack Exchange'i kasutajatelt? Tutvu täieliku arutelu teemaga siit.
