| > which isn't actually that strong if the service in question has chosen a weak password hashing algorithm. That only matters if you re-use the password in multiple sites. If an attacker has access to the hash, that means they cracked the site already at the admin level and got into its user database. They don't need to crack your password to gain any more access to that same site. (And they already have all the plain text personal info from your account.) Your only additional problem now is if that password gives them access to your account on other sites that they haven't broken into yet. The ultimate protection against that is not to have reused that password. That beats the stupidity of "password strength". If a password is not reused, it has to be only strong enough to survive the five guesses before an account is locked out. Password strength matters when hashes are public (like in classic Unix non-shadowed /etc/password files). Well, that's a bad idea, which is why we have shadowed password files. Shadowed password files may as well store passwords in cleartext; if those passwords are not reused anywhere, the situation is safe. Anyone who can see the cleartext is already root. If those cleartext passwords don't work on any other system, they are worthless to the attacker. Thus password strength --- all the fussing with how we properly store passwords with a decently strong hashing function and salting --- is just a fallback strategy to protect password re-users. |
Wait, what?
If they were randomly generated and of sufficient length, yes.
If they weren't randomly generated, even if not exactly reused, they are very likely to reveal the psychology of that user's password selection habits. This is of definite value to a focused attacker. Not only could it inform guessing passwords on other systems, it could also inform guessing that user's _next_ password on _this_ system.
> They don't need to crack your password to gain any more access to that same site.
Just because they have the hashes doesn't mean that they have other access. Hash lists are bought, sold, traded, and stolen all the time. Someone who possesses that particular hash may be multiple hops away from the group that originally acquired them.
Also, just because the database layer that the passwords are stored in is owned, does not mean that a particular target level of access has been acquired. Password storage can be abstracted into an entirely standalone subsystem, for which knowing, say, an admin of that system's password would be quite valuable.