1

Let me preface this that I am having a lot of trouble wording my question. Hopefully my description will help clarify.

I have always wondered if long passwords actually provide you any more security vs. shorter ones when it comes to websites like Google, Facebook, and similar.

I have very, very basic knowledge of cryptography, but it's my understanding most websites have to store the password somewhere, and when stored they are encrypted into some sort of hexadecimal string (or similar). For example, going here and entering a string of any length will always yield a 32 character string.

Now, of course, there are several different type of encryption standards. However, it seems to me, if a user database is compromised on any website through some means, at the end of the day it didn't matter how long your password is, your credentials were still compromised and potentially made public. Your 900 character password wasn't any more secure than someone with "12345678" as their password, both of you have the username and password stolen.

I have seen questions similar to this one, none seeming to ask the same thing though. So my question is that are longer passwords safer than shorter ones even if the encryption/database security used is compromised?

Also, I seem to be assuming there are other methods of compromising user data without a brute-force type method, so please let me know if I'm making some silly assumptions.

Thanks everyone! :)

rigidmoose
  • 11
  • 1

3 Answers3

2

A few general cases for offline attacks (they steal the entire username and password hash table, including salts, peppers, etc.:

  • Weak password, ANY storage - it's broken.

  • ANY password, plaintext storage - it's broken

  • ANY password, encryption storage, keys lost or weak too - it's broken (HASH IT)

  • Moderate password, weak but correct hash storage - it's broken.

  • Moderate password, very strong and correct hash storage - it depends on the time and resources the attackers put forth

    • This includes AFTER the original attackers give up and post everything on the Internet for everyone in the world to take a crack at.

  • Extremely strong password, weak but correct hash storage - it's safe!

and so on between these.

Anti-weakpasswords
  • 9,850
  • 2
  • 24
  • 52
0

First off: My understanding is only very rough.

In most situation only the hash value of the password is stored using a hash function (md5 is not considered secure for a long time, see SHA-1 and others), though that depends on the service provider. Not speaking about the security of the password itself; your personal data (names, address, files) is probably not encrypted or at least not with your own password, except in special circumstances. To be clear: I expect the password to be used only for login/authentication on the internet not for file encryption and such.

As I understand it, you send your password via a secure channel to the website (facebook, google, etc.) and they compare it to their hashed version (by hashing the send password the same way). So the data itself could be stolen by a third party in case of a database/server compromise depending on the service provider's security mechanisms like encryption.

But finding the password itself when the attacker got your hashed version from the database is not that easy. This is a hash preimage attack and depends fully on the security of the hash algorithm used by the service provider.

Also, I assume the attacker could not read your messages to the server or a cashed password (in ram) during login.

EDIT: Even when the attacker finds a password that generates the same hash value, this may a different password than you used, since hash functions are not injective.

Araeos
  • 1
  • 1
0

For answering this question I am going to assume that the service provider stores passwords in a secure manner (hashed, with salt and pepper). Now the thing is, hash functions are not reversible. So if somebody compromises the storage where the password is stored they still do not have your actual password.

There are pretty much two possibilities to break a hash:

Brute-Force - By hashing all possible passwords until you end up with the same hash. In this case a long password is safer.

Rainbow-Tables - These are big databases of sorts that store the passwords to hash-values. The more complex and long your password is, the less likely it becomes that it will be found in a rainbow table. (For giggles you can hash a common word like Password or names like Beatrice... with SHA-1 and copy that into Google. You will get the original password immediately from a well known rainbow-table)

Patrick Braunstorfer
  • 101