5 ms·
Probably something like 1 in 10 of the Gmail users examined have weak / short enough passwords that by knowing the length the dictionary used becomes small enou
by Boxbot 9y ago
Probably something like 1 in 10 of the Gmail users examined have weak / short enough passwords that by knowing the length the dictionary used becomes small enough that a brute force attack becomes feasible.
- tyingq 9y agoThe other link posted here confirms they use the length to select popular passwords of that length. See "step 2": http://www.cerias.purdue.edu/site/blog/post/purdue_cerias_researchers_find_vulnerability_in_google_protocol http://www.cerias.purdue.edu/site/blog/post/purdue_cerias_re... It doesn't say how they get the Gmail address to correlate back to the known length password though. I see the "light on details" reasoning, but it doesn't go well with the sensationalist "1 in 10 Gmail users." Surely Google doesn't allow high rate guessing, they must throttle or temporarily disable targeted accounts.
- Buge 9y agoThat doesn't really make sense. Gmail has a minimum password length of 8 characters. I bet 50% of users have an 8 character password. This bug hardly gives you any information at all.
- eh78ssxv2f 9y agoSince gmail has minimum password length of 8, my random guess is that 90% of the users have passwords between 8 and 15. Does knowing the precise length of the password buys the attacker so much that they can now guess the passwords of 10% users? Also, note that they do not know the username that corresponds to the given password length. Without more details, I seriously doubt this claim.