Brute-force attack

Description

It comes in two forms. Online, the tool hits a live login, where account lockout and rate limits slow it down. Offline, the attacker works on their own hardware against a stolen database of password hashes, with no limit at all — and that is by far the more effective use.

The strength of the defense is not in any single measure but in their sum: a long and unique password, lockout after a few misses, rate limiting, further factors. Each addition stretches the break-in from a few minutes to years, then centuries, then longer than anyone will wait.

Examples

• A company leaves an RDP server exposed to the internet with admin/admin credentials and no limit on failed logins. This happens far more often than you would think.
• Weak passwords leaked in one of the larger breaches of global internet services come back to you soon enough.
• One decent graphics card is enough for an attacker to pull the weak passwords out of a stolen database within minutes.

Notes

• Brute force cannot break a well-configured login. Lockout after failed attempts and rate limiting matter more than how complex the password is.
• Password length matters more than special characters: every additional character multiplies the time needed to break it.