Q: Many password-protected websites give you a few chances to type in your password correctly, then lock you out if you type the wrong thing. You then must type in a code or answer a "secret question" to prove who you are.
So why do I see TV shows in which smart criminals use a computer to test, say, 10,000 passwords a minute until they get the right one to break into a website? Why aren't the criminals locked out after a few wrong passwords?
JERRY ROVENTINI, Lakeland, Fla.
A: The TV shows are less far-fetched than you might think.
The scenario you're describing is called a "brute force" attack. A computer connects to a web server and rapidly tries a long list of possible passwords until it hits the right one. A real brute force attack would require about two hours to crack an eight-character password composed of letters (upper and lower case), numbers and special characters (see tinyurl.com/4r2debx3).
How would the attackers avoid being locked out during those two hours? Sophisticated hackers could disable the server's "intrusion detection system," or its automatic "password attempt limit" (which normally locks a person out after a few wrong tries).
But because brute force attacks require some expertise, they're less common than a simpler threat called a "dictionary attack." The "dictionary" is a short list of common passwords that a computer can try in much less than two hours. These attacks succeed when people use simple passwords, such as "password" and "123456," which take fractions of a second to crack.
While it's hard to believe that people still use such vulnerable passwords, here's an interesting fact: The 2019 attack on Texas IT company SolarWinds, a federal contractor, revealed that an employee used the password "solarwinds123" to access a server. A Congressional investigation criticized the use of such simple passwords, but the company determined the password was not the vehicle of the attack.
