Reputation
208
Top tag
Next privilege 250 Rep.
View close votes
Badges
2 6
Newest
 Yearling
Impact
~5k people reached

  • 0 posts edited
  • 0 helpful flags
  • 1 vote cast
Oct
26
awarded  Yearling
Sep
7
awarded  Supporter
Sep
7
accepted How long does it take to brute force a Wordpress password?
Sep
7
comment How long does it take to brute force a Wordpress password?
Thanks. You have been very helpful.
Sep
7
comment How long does it take to brute force a Wordpress password?
Helpful answer, thanks. Could you explain how you roughly calculate the bits/entropy and estimate the time to brute force? The passwords can be assumed to be random of the full ASCII set.
Sep
7
comment How long does it take to brute force a Wordpress password?
The question is more for me to be able to say with a strong degree of certainty to the boss that it wasn't a brute force attack anyway, and that we should look into the security and current condition of the computers used to access the blog recently, including those of the SEO agency.
Sep
7
comment How long does it take to brute force a Wordpress password?
@tylo FYI this is not my project really, I'm just trying to investigate the potential hack and see what the route of entry might have been. There is more to this story than I have included in the question anyway - for example, the MD recently gave blog access to an SEO agency, and the hack happened shortly after, so for all we know they have an infected machine or compromised the details. I would have no objection to the company paying for security audits but it's not realistic to expect them to do so. But I think there is a balance to be had between risk and real world usability.
Sep
7
comment How long does it take to brute force a Wordpress password?
@tylo It's just an unimportant blog for SEO purposes on a professional site. Honestly, paying a security consultant what is likely to be a disproportionally large amount of money for an audit on a small blog, is not a realistic expectation. As a software developer, I take your point and somewhat agree even, but the paranoia and expense of hiring security consultants for small websites is not necessary. Most software developers who are conscious of security and somewhat capable of understanding problems and solutions can take care of it to a degree that is acceptable for the business.
Sep
7
comment How long does it take to brute force a Wordpress password?
@otus The site is a default installation of WP which means it will be using the 8 x MD5 hashing. The passwords are generated completely at random and are considered strong in terms of the ASCII range used but perhaps weren't long enough at 8 characters, which I have doubled for the new password.
Sep
7
comment How long does it take to brute force a Wordpress password?
@otus Wordpress apparently adds a unique salt generated on a per-site basis to the password and hashes it with 8 passes of MD5.
Sep
7
comment How long does it take to brute force a Wordpress password?
@tylo Which exchange would you recommend I move it to?
Sep
7
asked How long does it take to brute force a Wordpress password?
Jun
23
awarded  Caucus
Mar
27
awarded  Notable Question
Apr
1
awarded  Popular Question
Aug
28
awarded  Scholar
Aug
28
comment Is truncating a SHA512 hash to the first 160 bits as secure as using SHA1?
Interesting stuff, thanks.
Aug
28
accepted Is truncating a SHA512 hash to the first 160 bits as secure as using SHA1?
Aug
21
awarded  Nice Question
Jul
26
awarded  Student