Re: Have I been hacked?
On 1/9/2015 10:24 PM, scott wrote:
> On 01/09/2015 09:19 PM, Jerry Stuckle wrote:
>> On 1/9/2015 8:49 PM, Joel Rees wrote:
>>> On Fri, Jan 9, 2015 at 6:25 PM, Martin Steigerwald <Martin@lichtvoll.de> wrote:
>>>> Am Freitag, 9. Januar 2015, 00:24:06 schrieb Brian:
>>>>> On Thu 08 Jan 2015 at 22:36:46 +0100, Martin Steigerwald wrote:
>>>>>> Am Donnerstag, 8. Januar 2015, 14:20:27 schrieb Jerry Stuckle:
>>>>>>> Just ensure you're using good security practices - don't allow root
>>>>>>> login, use long, random passwords, etc. I also use a random character
>>>>>>> strings for the login ids, as well as passwords - just one more thing
>>>>>>> for the hackers to have to figure out how to get around.
>>>>>>
>>>>>> Only allow SSH key based logins. Of course, only after you copied a public
>>>>>> key onto the machine with ssh-copy-id.
>>>>>>
>>>>>> And have SSH keys with *strong* passphrases, to protect against someone
>>>>>> stealing your key. Use ssh-agent wisely only on trusted machines.
>>>>>
>>>>> SSH password logins are just as safe. 20 characters gives a strong
>>>>> password for use on trusted machines. There is no need to worry about
>>>>> it being stolen because it is in your memory,
>>>>
>>>> I think SSH keys are safer, cause there is no password at all that can be
>>>> brute forced.
>>>
>>> What do you mean by that?
>>>
>>>> Okay, one can try to guess the key, but try that with a 4096 bit
>>>> key.
>>>
>>> Hmm.
>>>
>>> 10 characters, 6 to 7 bits per character, that's 60 bits.
>>>
>>> If the bits are truly random, straight brute-force will take, on
>>> average, half of 2^60 attempts.
>>>
>>> We can hold the integer 2^59 in a C variable on most recent desktops,
>>> but if we have bc (dc if you like post-fix), we can do this on even 32
>>> bit CPUs:
>>>
>>> 576460752303423488 (base ten)
>>>
>>> At one milion attempts per second, that's 5764607523034 seconds, or
>>> 182678 CPU-years.
>>>
>>> There's no way that's going to happen on-line, if the password is
>>> truly random, and not randomly a password that's a quick permutation
>>> of common memes or of entries in rainbow tables.
>>>
>>
>> Actually, 62 possible characters (upper case, lower case and digits), 10
>> positions is 62^10 or 839,299,365,868,340,224 possible combinations.
>>
>> Adding in special characters obviously would increase that.
>>
>> But there is no way you'll hit a server 1,000,000 times a second trying
>> to brute force a password.
>>
>>
>>> I currently use sixteen or more letters in my passwords, don't use
>>> simple permutations or common phrases (as for the first leter trick),
>>> use disconnected words from multiple languages. Or use 16 character
>>> true random passwords for the important stuff.
>>>
>>
>> All good suggestions.
>>
>>> SSH keys are useful, but you have to keep them somewhere. The real
>>> danger to good passwords is the off-line attempts, and the passphrase
>>> you use for your private keystore is potentially subject to off-line
>>> if your password is.
>>>
>>
>> Yes, keys may actually be less secure than passwords.
>>
>> Jerry
>>
>>
> If you have a dedicated hacker, or hackers, time is on their side. I
> would much rather use a key with a passphrase.
>
>
That's fine, if you don't care about security. Lose your laptop and
your pass phrase can be broken at a rate of 1 billion attempts per
second, since it is local to your machine.
There is no way you're going to get even 100 attempts per second into an
SSH server. And since the hacker doesn't have direct access to the
encrypted password on the server, he can't break it on a local machine.
Using the same password/pass phrase for both systems, it would take
10,000,000 times longer to hack the SSH password than your local pass
phrase.
And then there's the problem you can only access the server from a
system with the key file. And the more computers the key file resides
on, the less secure it is.
Since a password is not stored on any machine (except the server), there
is nothing to break.
Jerry
Reply to: