Sesi Tanya & Jawab Hari ini hadir untuk memberi kami SuperUser - subdivisi Stack Exchange, pengelompokan komunitas situs web Tanya-Jawab.
Pertanyaan
Pembaca SuperUser Michael McGowan ingin tahu sejauh mana dampak dari pelanggaran sandi tunggal itu adalah; dia menulis:
Suppose a user uses a secure password at site A and a different but similar secure password at site B. Maybe something like
mySecure12#PasswordA
di situs A dan
mySecure12#PasswordB
di situs B (jangan ragu untuk menggunakan definisi yang berbeda dari "kesamaan" jika itu masuk akal).
Anggaplah kemudian bahwa kata sandi untuk situs A entah bagaimana dikompromikan … mungkin seorang karyawan jahat situs A atau kebocoran keamanan. Apakah ini berarti bahwa kata sandi situs B secara efektif telah disusupi juga, atau apakah tidak ada yang namanya "kesamaan kata sandi" dalam konteks ini? Apakah ada bedanya apakah kompromi di situs A adalah kebocoran teks biasa atau versi berciri?
Haruskah Michael khawatir jika situasi hipotetisnya terjadi?
Jawabannya
Kontributor SuperUser membantu menjernihkan masalah untuk Michael. Kontributor superuser Queso menulis:
To answer the last part first: Yes, it would make a difference if the data disclosed were cleartext vs. hashed. In a hash, if you change a single character, the entire hash is completely different. The only way an attacker would know the password is to brute force the hash (not impossible, especially if the hash is unsalted. see rainbow tables).
As far as the similarity question, it would depend on what the attacker knows about you. If I get your password on site A and if I know you use certain patterns for creating usernames or such, I may try those same conventions on passwords on sites you use.
Alternatively, in the passwords you give above, if I as an attacker see an obvious pattern that I can use to separate a site-specific portion of the password from the generic password portion, I will definitely make that part of a custom password attack tailored to you.
As an example, say you have a super secure password like 58htg%HF!c. To use this password on different sites, you add a site-specific item to the beginning, so that you have passwords like: facebook58htg%HF!c, wellsfargo58htg%HF!c, or gmail58htg%HF!c, you can bet if I hack your facebook and get facebook58htg%HF!c I am going to see that pattern and use it on other sites I find that you may use.
It all comes down to patterns. Will the attacker see a pattern in the site-specific portion and generic portion of your password?
Kontributor Superuser lain, Michael Trausch, menjelaskan bagaimana dalam kebanyakan situasi situasi hipotetis tidak banyak menimbulkan kekhawatiran:
To answer the last part first: Yes, it would make a difference if the data disclosed were cleartext vs. hashed. In a hash, if you change a single character, the entire hash is completely different. The only way an attacker would know the password is to brute force the hash (not impossible, especially if the hash is unsalted. see rainbow tables).
As far as the similarity question, it would depend on what the attacker knows about you. If I get your password on site A and if I know you use certain patterns for creating usernames or such, I may try those same conventions on passwords on sites you use.
Alternatively, in the passwords you give above, if I as an attacker see an obvious pattern that I can use to separate a site-specific portion of the password from the generic password portion, I will definitely make that part of a custom password attack tailored to you.
As an example, say you have a super secure password like 58htg%HF!c. To use this password on different sites, you add a site-specific item to the beginning, so that you have passwords like: facebook58htg%HF!c, wellsfargo58htg%HF!c, or gmail58htg%HF!c, you can bet if I hack your facebook and get facebook58htg%HF!c I am going to see that pattern and use it on other sites I find that you may use.
It all comes down to patterns. Will the attacker see a pattern in the site-specific portion and generic portion of your password?
Jika Anda khawatir bahwa daftar kata sandi Anda saat ini tidak beragam dan cukup acak, kami sangat menyarankan untuk memeriksa panduan keamanan kata sandi lengkap kami: Cara Memulihkan Setelah Kata Sandi Email Anda Terganggu. Dengan membuat ulang daftar kata sandi Anda seolah-olah ibu dari semua kata sandi, kata sandi email Anda, telah disusupi, sangat mudah untuk cepat meningkatkan portofolio kata sandi Anda.
Memiliki sesuatu untuk ditambahkan ke penjelasan? Bicaralah di komentar. Ingin membaca lebih banyak jawaban dari pengguna Stack Exchange yang paham teknologi lainnya? Lihat diskusi lengkap di sini.
