# How do those hackers do it? **URL:** \ **Category:** Factual Questions\ **Created:** [September 10, 2009, 2:19am UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507 "2009-09-10T02:19:44Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![pulykamell](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/pulykamell/32/3166_2.png) [@pulykamell](https://boards.straightdope.com/u/pulykamell)\ **Post date:** [September 10, 2009, 5:24am UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507/21 "2009-09-10T05:24:17Z")
> [@Jragon](#): > > I’ve seen 15 minute lockouts mostly, but even then, 4 times an hour for 24 hours. Using my example above of 100 computers (which seems like a high, if reasonable number for a place dedicated to this stuff, granted having 100 unique IPs is probably trickier) I’m getting 48000 times a day, that’s 83 days to get that worst-case of 4 mill. And that assumes it controls login attempt blocks at the IP level and not the account level. I thought these accounts block the entire account, not just people trying to login from certain IP addresses. Am I incorrect in my understanding? ---
**Author:** ![BrandonR](https://avatars.discourse-cdn.com/v4/letter/b/779978/32.png) [@BrandonR](https://boards.straightdope.com/u/BrandonR)\ **Post date:** [September 10, 2009, 5:26am UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507/22 "2009-09-10T05:26:43Z")
Let’s be frank, anyone who is computer savvy and chooses good passwords to begin with doesn’t use AOL. Chances are the guy had a very easy to guess password, one that they could probably do a dictionary attack with and be in in a relatively short amount of time. I dunno if AOL has anti-brute-force measures in use, but it seems like they could alternatively get his password from AOL Instant Messenger if it lets you repeatedly log-in. Alternatively AOL could have a password reset service that asks personal questions that his girlfriend could have provided to the hackers. ---
**Author:** ![pulykamell](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/pulykamell/32/3166_2.png) [@pulykamell](https://boards.straightdope.com/u/pulykamell)\ **Post date:** [September 10, 2009, 5:31am UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507/23 "2009-09-10T05:31:40Z")
Hmmm…it seems Hotmail no longer blocks access, just makes you go through CAPTCHAs, but if you go back to the main [hotmail.com](http://hotmail.com) webpage, you can bypass the CAPTCHA (although if you get the password wrong, it’ll throw you straight to the CAPTCHA page, which you can get out of by going back to [hotmail.com](http://hotmail.com)). I swear this used to not be the case, that you were blocked out, and for more than just 15 minutes at a time. ---
**Author:** ![Jragon](https://avatars.discourse-cdn.com/v4/letter/j/e19b73/32.png) [@Jragon](https://boards.straightdope.com/u/Jragon)\ **Post date:** [September 10, 2009, 5:33am UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507/24 "2009-09-10T05:33:21Z")
> [@BrandonR](#): > > Alternatively AOL could have a password reset service that asks personal questions that his girlfriend could have provided to the hackers. Usually those send to another email defined in the profile though (either the old password or utter gibberish). > [@pulykamell](#): > > I thought these accounts block the entire account, not just people trying to login from certain IP addresses. Am I incorrect in my understanding? I’m not sure, which I stated near the end. It is a good question, one I’ve never encountered for obvious reasons, anyone have a laptop or something and live where they can pick up a public network their normal comp isn’t part of who wants to try? ---
**Author:** ![Jragon](https://avatars.discourse-cdn.com/v4/letter/j/e19b73/32.png) [@Jragon](https://boards.straightdope.com/u/Jragon)\ **Post date:** [September 10, 2009, 5:36am UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507/25 "2009-09-10T05:36:15Z")
D’oh ---
**Author:** ![pulykamell](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/pulykamell/32/3166_2.png) [@pulykamell](https://boards.straightdope.com/u/pulykamell)\ **Post date:** [September 10, 2009, 5:42am UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507/26 "2009-09-10T05:42:25Z")
> [@Jragon](#): > > I’m not sure, which I stated near the end. It is a good question, one I’ve never encountered for obvious reasons, anyone have a laptop or something and live where they can pick up a public network their normal comp isn’t part of who wants to try? Looking online, I found some posts from 2004 that indicate that Hotmail did indeed block the entire account for many hours at a time. It seems they no longer do this, as this same forum was full of complaints about Hotmail having such security procedures (and how easy it would be to screw somebody’s access up by incorrectly logging into their account multiple times.) ---
**Author:** ![Jragon](https://avatars.discourse-cdn.com/v4/letter/j/e19b73/32.png) [@Jragon](https://boards.straightdope.com/u/Jragon)\ **Post date:** [September 10, 2009, 6:22am UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507/27 "2009-09-10T06:22:25Z")
Okay, now on the exploit issue here’s one that I’m going to be very vague about. It wouldn’t work for a foreign company that does this for just anyone, but if you were knowledgeable enough you could pull it off with little more than waiting until they’re on a public network (or can get on THEIR network somehow, if they’re not tech savvy this means sitting in a car outside their house and looking for the network named “Linksys”). It basically boils down to (again, being vague) using a couple network monitoring programs to “hijack” the cookie. Once you do that you’re treated as if you’re either on the webpage logged in right now or always logged in (depending on whether they accidentally clicked that “remember me” box or not). I know this works for Gmail, and I’m sure if you knew the right names it probably works for others. This only gets you in, not the password, but if you’re in the password would probably flow pretty easily. Note that you can actually get a lot of hacking info from security sites, often of the mantra that the best way to protect yourself is to know your weak points. These have… varying degrees of believability in that mantra, but oftentimes hacks will be released soon after they’re fixed so that people can see what people are coming up with nowadays. I think there was a huge hack in Chrome a while back (something with javascript and switching IPs in the middle I think?) that a respected security guy found that didn’t really have the explicits released until it was fixed. So if you’re wondering how they used to do it it’s pretty easy to find usually. Email is probably one of the least secure of these if I had to guess. ---
**Author:** ![ChrisBooth12](https://avatars.discourse-cdn.com/v4/letter/c/e95f7d/32.png) [@ChrisBooth12](https://boards.straightdope.com/u/ChrisBooth12)\ **Post date:** [September 10, 2009, 7:25pm UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507/28 "2009-09-10T19:25:01Z")
This is why my password is 21 characters long and completely random numbers letters and symbols. Brute forcing or just guessing is easy. Not to long ago I had to work on my moms laptop she left me, she didnt tell me she had a password for it. I was able to guess the password the 2nd try. First try was right I just forgot to capitalize the first letter! If you know somebody well enough you can guess ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [September 10, 2009, 8:09pm UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507/29 "2009-09-10T20:09:55Z")
> [@](#): > > I’m not seeing brute working, even if we ONLY consider case sensitive letters and numbers that gives us 52 characters. Out of 52, we choose 8 (8 w/ a requirement of 2 numbers is a common base case, I think Google uses it for instance), order matters, repeats allowed and that gives us… On the other hand, if you ONLY consider six-letter words, all lower-case, like most people would choose, then you’re down to about 300 million. And much less than that if it’s just words. Most people don’t put any effort at all into password security. ---
**Author:** ![RaftPeople](https://avatars.discourse-cdn.com/v4/letter/r/6f9a4e/32.png) [@RaftPeople](https://boards.straightdope.com/u/RaftPeople)\ **Post date:** [September 10, 2009, 8:42pm UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507/30 "2009-09-10T20:42:29Z")
> [@BrandonR](#): > > Let’s be frank, anyone who is computer savvy and chooses good passwords to begin with doesn’t use AOL. I am computer savvy, use strong passwords and I use AOL. ---
**Author:** ![Shodan](https://avatars.discourse-cdn.com/v4/letter/s/9f8e36/32.png) [@Shodan](https://boards.straightdope.com/u/Shodan)\ **Post date:** [September 10, 2009, 9:00pm UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507/31 "2009-09-10T21:00:48Z")
Perhaps I have a criminal mind, perhaps not. If I were to try to hack an account, I would try to trigger the “Forgot Your Password?” function with the e-mail address. Or is that too simple? Regards, Shodan ---
**Author:** ![Superfluous\_Parentheses](https://avatars.discourse-cdn.com/v4/letter/s/8edcca/32.png) [@Superfluous\_Parentheses](https://boards.straightdope.com/u/Superfluous_Parentheses)\ **Post date:** [September 10, 2009, 9:37pm UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507/32 "2009-09-10T21:37:32Z")
> [@pulykamell](#): > > I thought these accounts block the entire account, not just people trying to login from certain IP addresses. Am I incorrect in my understanding? You could do that, but that would mean you could lock out anyone just by passing in a couple of wrong passwords, which would break down the system very very quickly. ---
**Author:** ![drachillix](https://avatars.discourse-cdn.com/v4/letter/d/48db29/32.png) [@drachillix](https://boards.straightdope.com/u/drachillix)\ **Post date:** [September 10, 2009, 10:18pm UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507/33 "2009-09-10T22:18:01Z")
It is also frightening…flat out terrifying in fact…how many people use one of a handful of passwords. Just this list: sex, god, jesus, love, password, (repeat username) Would probably crack 5-10% of the email accounts in existence. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [September 10, 2009, 10:26pm UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507/34 "2009-09-10T22:26:38Z")
Don’t forget about folks leaving the password field blank, either. ---
**Author:** ![Valgard](https://avatars.discourse-cdn.com/v4/letter/v/7feea3/32.png) [@Valgard](https://boards.straightdope.com/u/Valgard)\ **Post date:** [September 10, 2009, 11:55pm UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507/35 "2009-09-10T23:55:19Z")
> [@Shodan](#): > > Perhaps I have a criminal mind, perhaps not. If I were to try to hack an account, I would try to trigger the “Forgot Your Password?” function with the e-mail address. Or is that too simple? > > Regards, > Shodan As noted above that will generally send the reset password to said email address. Unless you can read their email to begin with you won’t get your hands on the pwd. ---
**Author:** ![Qwakkeddup](https://avatars.discourse-cdn.com/v4/letter/q/90ced4/32.png) [@Qwakkeddup](https://boards.straightdope.com/u/Qwakkeddup)\ **Post date:** [September 11, 2009, 1:05am UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507/36 "2009-09-11T01:05:10Z")
The combination is 1 2 3 4. Remind me to change the combination on my luggage. ---
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [September 11, 2009, 1:18am UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507/37 "2009-09-11T01:18:12Z")
> [@ChrisBooth12](#): > > This is why my password is 21 characters long and completely random numbers letters and symbols. Brute forcing or just guessing is easy. I am often confronted with password-protected sites that still put a _maximum_ length at 8 characters and don’t allow non-alpha or non-numeric characters. Banks, even. ---
**Author:** ![BorgHunter](https://avatars.discourse-cdn.com/v4/letter/b/7c8e57/32.png) [@BorgHunter](https://boards.straightdope.com/u/BorgHunter)\ **Post date:** [September 11, 2009, 1:25am UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507/38 "2009-09-11T01:25:23Z")
> [@Musicat](#): > > I am often confronted with password-protected sites that still put a _maximum_ length at 8 characters and don’t allow non-alpha or non-numeric characters. Banks, even. I have always found this restriction bizarre in the extreme, along with the one restricting certain characters from being used in passwords. Are these people storing passwords as filenames in a FAT16 system or something? Do their servers run MS-DOS? Their tech staff would have to be monumentally incompetent to include these kinds of restrictions in their passwords. ---
**Author:** ![pulykamell](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/pulykamell/32/3166_2.png) [@pulykamell](https://boards.straightdope.com/u/pulykamell)\ **Post date:** [September 11, 2009, 1:26am UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507/39 "2009-09-11T01:26:18Z")
> [@Musicat](#): > > I am often confronted with password-protected sites that still put a _maximum_ length at 8 characters and don’t allow non-alpha or non-numeric characters. Banks, even. This drives me up a wall, too. I’ve been using punctuation and other non-alphanumeric characters in my passwords since 1993, and a suprisingly high percentage of sites in 2009 do not allow this. Why in the hell isn’t the entire character set available for passwords? And, like you, I’ve encountered sites that limit your password to like 6-10 characters. ---
**Author:** ![Jragon](https://avatars.discourse-cdn.com/v4/letter/j/e19b73/32.png) [@Jragon](https://boards.straightdope.com/u/Jragon)\ **Post date:** [September 11, 2009, 1:27am UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507/40 "2009-09-11T01:27:33Z")
> [@Musicat](#): > > I am often confronted with password-protected sites that still put a _maximum_ length at 8 characters and don’t allow non-alpha or non-numeric characters. Banks, even. I still cannot even grasp why they do this at all. I guess you could sort of make a weak case for the character limit in terms of space if you get a lot of hits (though I think most String objects are pretty uniform in that regard nowadays, wouldn’t bet on that though). But non-standard characters? It can’t make it any bit harder to check the password, it’s a stringInput.equals(stringOutput) check, are the programmers that afraid the characters won’t get escaped correctly when someone decides to reenact [xkcd](http://xkcd.com/327/)? [Previous page](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507.md?page=1) [Next page](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507.md?page=3)