From Newsgroup: alt.privacy

If a hacker hacks one's mail site and gets one's password, what
difference does it make if that password is weak or strong? Either way,
the hacker gets it from the hacked e-mail site. He then has access to
the e-mail account no matter what the strength of the password was.

What am I not understanding about the necessity for the need of a
'strong' password - or passphrase?
--- Synchronet 3.21e-Win32 NewsLink 1.2

From Newsgroup: alt.privacy

On 2025-04-22, cal@invalid.com <cal@invalid.com> wrote:

If a hacker hacks one's mail site and gets one's password, what
difference does it make if that password is weak or strong? Either way,
the hacker gets it from the hacked e-mail site. He then has access to
the e-mail account no matter what the strength of the password was.

What am I not understanding about the necessity for the need of a
'strong' password - or passphrase?

It's to help mitigate a 'brute force' attack, where the hacker tries
passwords until they git a hit. If you use a dictionary word like
"sausage", then a brute force attack which goes through the dictionary
will hit upon it pretty fast. Strong passwords are much, much harder to
get, as are combinations of words, particularly memorable ones which may
not be common, such as "Dingoes fry jelly steaks". It doesn't protect
against every kind of attack, but it certaintly prevents some.

--- Synchronet 3.21e-Win32 NewsLink 1.2

From Newsgroup: alt.privacy

cal@invalid.com wrote:

If a hacker hacks one's mail site and gets one's password, what
difference does it make if that password is weak or strong? Either way,
the hacker gets it from the hacked e-mail site. He then has access to
the e-mail account no matter what the strength of the password was.

What am I not understanding about the necessity for the need of a
'strong' password - or passphrase?

Passwords are usually hashed when stored on the server. There are big
hash tables on the Internet available and tools like hashcat or John
the Ripper try to crack those hashes. If a password is simple and
not long enough those tools do not need long to find your weak password,
due to weak entropy. Read more about password entropy and you get the
idea.

HTH

Regards
Stefan
--
Onion Courier Home Server Mon-Fri 15:00-21:00 UTC Sat-Sun 11:00-21:00 UTC ohpmsq5ypuw5nagt2jidfyq72jvgw3fdvq37txhnm5rfbhwuosftzuyd.onion:8080 inbox
--- Synchronet 3.21e-Win32 NewsLink 1.2

From Newsgroup: alt.privacy

On Tue, 22 Apr 2025 15:18:09 +0200, Stefan Claas <stefan@mailchuck.com>
wrote:

cal@invalid.com wrote:

If a hacker hacks one's mail site and gets one's password, what
difference does it make if that password is weak or strong? Either way,
the hacker gets it from the hacked e-mail site. He then has access to
the e-mail account no matter what the strength of the password was.

What am I not understanding about the necessity for the need of a
'strong' password - or passphrase?

Passwords are usually hashed when stored on the server. There are big
hash tables on the Internet available and tools like hashcat or John
the Ripper try to crack those hashes. If a password is simple and
not long enough those tools do not need long to find your weak password,
due to weak entropy. Read more about password entropy and you get the
idea.

HTH

Regards
Stefan

Okay, they do not see the password itself. They see a hashed version of
it. So, weak password = weak hash. Got it. I thought they saw the password/passphrase itself.

That Rainbow dictionary stuff is why I do misspell some words in my
passphrase. I do also use some numbers and a simple punctuation mark.
Now I now why I have to go to all that trouble.

Thanks for answering.
--- Synchronet 3.21e-Win32 NewsLink 1.2

From Newsgroup: alt.privacy

On Tue, 22 Apr 2025 12:58:59 -0000 (UTC), Borax Man
<rotflol2@hotmail.com> wrote:

On 2025-04-22, cal@invalid.com <cal@invalid.com> wrote:

If a hacker hacks one's mail site and gets one's password, what
difference does it make if that password is weak or strong? Either way,
the hacker gets it from the hacked e-mail site. He then has access to
the e-mail account no matter what the strength of the password was.

What am I not understanding about the necessity for the need of a
'strong' password - or passphrase?

It's to help mitigate a 'brute force' attack, where the hacker tries >passwords until they git a hit. If you use a dictionary word like
"sausage", then a brute force attack which goes through the dictionary
will hit upon it pretty fast. Strong passwords are much, much harder to
get, as are combinations of words, particularly memorable ones which may
not be common, such as "Dingoes fry jelly steaks". It doesn't protect >against every kind of attack, but it certaintly prevents some.

Thanks to you and Stefan I finally do understand it.

Thanks.
--- Synchronet 3.21e-Win32 NewsLink 1.2

From Newsgroup: alt.privacy

On 2025-04-22, cal@invalid.com <cal@invalid.com> wrote:

On Tue, 22 Apr 2025 15:18:09 +0200, Stefan Claas <stefan@mailchuck.com> wrote:

cal@invalid.com wrote:

If a hacker hacks one's mail site and gets one's password, what
difference does it make if that password is weak or strong? Either way, >>> the hacker gets it from the hacked e-mail site. He then has access to
the e-mail account no matter what the strength of the password was.

What am I not understanding about the necessity for the need of a
'strong' password - or passphrase?

Passwords are usually hashed when stored on the server. There are big
hash tables on the Internet available and tools like hashcat or John
the Ripper try to crack those hashes. If a password is simple and
not long enough those tools do not need long to find your weak password, >>due to weak entropy. Read more about password entropy and you get the >>idea.

HTH

Regards
Stefan

Okay, they do not see the password itself. They see a hashed version of
it. So, weak password = weak hash. Got it. I thought they saw the password/passphrase itself.

That Rainbow dictionary stuff is why I do misspell some words in my passphrase. I do also use some numbers and a simple punctuation mark.
Now I now why I have to go to all that trouble.

Thanks for answering.

There are no weak hashes per se. Each hash is in theory as secure as
any other, in that you can't reverse engineer the original password from
the hash. But if you've already hashed all the words in the the
dictionary, if someone else has just used a single dictionary word,
you'll find a match quick.

You can "salt" the hash, adding some random data to the original
data/password when you hash it, so the final hash comes out different.
This way even if two people use the same password, the random 'salt'
added means they have completely different hashes, hiding the fact their passwords are the same. I implemented this in some software I wrote a
while back.
--- Synchronet 3.21e-Win32 NewsLink 1.2