Hacker News new | ask | show | jobs
by ryanlol 2536 days ago
I don’t see how this leads to an increased hit rate, now you’ll just be making more incorrect attempts.

Only way I see this kind of working is if you’re cracking the passwords offline.

1 comments

Yes, that’s one use case. Let’s say you have a database of actually properly hashed passwords. What passwords are you going to prioritise to try first? Every plaintext leak adds to the list of passwords you’d be sensible to try before brute forcing. Plus even for online attacks like password spraying, you’ve got to get an idea of common passwords from _somewhere_ and this leak inevitably adds to that. The only point I’m making is that humans are similar and therefore there’s always a chance they pick similar passwords. Therefore even if all LJ users have since changed their passwords, there are still many risks.