# How do those hackers do it? **URL:** \ **Category:** Factual Questions\ **Created:** [September 10, 2009, 2:19am UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507 "2009-09-10T02:19:44Z")\ **Posts on this page:** 16\ **Page:** 3
**Author:** ![BorgHunter](https://avatars.discourse-cdn.com/v4/letter/b/7c8e57/32.png) [@BorgHunter](https://boards.straightdope.com/u/BorgHunter)\ **Post date:** [September 11, 2009, 1:30am UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507/41 "2009-09-11T01:30:22Z")
> [@Jragon](#): > > I still cannot even grasp why they do this at all. I guess you could sort of make a weak case for the character limit in terms of space if you get a lot of hits. But non-standard characters? It can’t make it any bit harder to check the password, it’s a stringInput.equals(stringOutput) check, are the programmers that afraid the characters won’t get escaped correctly when someone decides to reenact [xkcd](http://xkcd.com/327/)? Even the SQL injection thing doesn’t hold water, because passwords should **never** be stored as cleartext. They should be salted and hashed, and stored that way. And hashed strings don’t have any "s or 's. ---
**Author:** ![Jragon](https://avatars.discourse-cdn.com/v4/letter/j/e19b73/32.png) [@Jragon](https://boards.straightdope.com/u/Jragon)\ **Post date:** [September 11, 2009, 1:34am UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507/42 "2009-09-11T01:34:43Z")
> [@BorgHunter](#): > > Even the SQL injection thing doesn’t hold water, because passwords should **never** be stored as cleartext. They should be salted and hashed, and stored that way. And hashed strings don’t have any "s or 's. True, but then you don’t get to link to xkcd. ---
**Author:** ![sleestak](https://avatars.discourse-cdn.com/v4/letter/s/919ad9/32.png) [@sleestak](https://boards.straightdope.com/u/sleestak)\ **Post date:** [September 11, 2009, 1:44am UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507/43 "2009-09-11T01:44:05Z")
> [@RaftPeople](#): > > I am computer savvy, use strong passwords and I use AOL. I am very computer savvy (network admin), use strong passwords and used to work in network operations at AOL and still use AOL. The biggest hole for security at AOL was keyloggers and phishing sites back when I worked there. The security folks at AOL were damned good. Sadly a reasonable number of the users would fall for anything. Note, that is not just an AOL problem, it is a problem everywhere. [Kevin Mitnick](http://en.wikipedia.org/wiki/Kevin_Mitnick) claims he got into SCO, PacBell, FBI, Pentagon, Novell, CA DMV, USC and the Los Angeles Unified School District using social engineering. In other words, he talked people into giving him the passwords. I believe him. Heck, even at my present job I have people offer up their passwords to me over the phone without verifying that I am who I say I am. This is without me asking. I tell them a) I can change their password anytime I like so they don’t need to give it to me, if I need to get in I’ll change it and let them change it back\* later and b) never, ever offer anyone their password. Slee \*Of course, due to our password requirements they cannot change it back to the original password so we _rarely_ do this. ---
**Author:** ![ChrisBooth12](https://avatars.discourse-cdn.com/v4/letter/c/e95f7d/32.png) [@ChrisBooth12](https://boards.straightdope.com/u/ChrisBooth12)\ **Post date:** [September 11, 2009, 2:43am UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507/44 "2009-09-11T02:43:44Z")
> [@pulykamell](#): > > This drives me up a wall, too. I’ve been using punctuation and other non-alphanumeric characters in my passwords since 1993, and a suprisingly high percentage of sites in 2009 do not allow this. Why in the hell isn’t the entire character set available for passwords? And, like you, I’ve encountered sites that limit your password to like 6-10 characters. My bank uses very small easy passwords. My college system however has the most complex system ever for passwords. They are over extreme. Im glad sombody can take a loan out in my name but they wont be able to sign me up for classes! ---
**Author:** ![Jragon](https://avatars.discourse-cdn.com/v4/letter/j/e19b73/32.png) [@Jragon](https://boards.straightdope.com/u/Jragon)\ **Post date:** [September 11, 2009, 5:35am UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507/45 "2009-09-11T05:35:03Z")
> [@ChrisBooth12](#): > > My bank uses very small easy passwords. My college system however has the most complex system ever for passwords. They are over extreme. Im glad sombody can take a loan out in my name but they wont be able to sign me up for classes! Your college too? If you password isn’t something like zK7j3o274ffB on mine it will NEVER let you use it. I suppose that’s a good thing if you’re like me and others who memorize it, but it just causes most people to write it down in their notebook or something :smack:. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [September 11, 2009, 5:42am UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507/46 "2009-09-11T05:42:49Z")
> [@](#): > > I am often confronted with password-protected sites that still put a maximum length at 8 characters and don’t allow non-alpha or non-numeric characters. Banks, even. There was a memo circulating around the university a few years ago, saying that it’d come to their attention that some folks were using weak passwords for their Banner accounts, and reminding everyone to use strong passwords, with at least eight characters, including letters, numbers, and symbols, etc. All well and good, except that the only passwords Banner would allow were six-digit numbers. Letters aren’t even possible. To make matters worse, everyone has to change their Banner passwords every so often. It’s security theater, which has no effect other than to guarantee that a lot of folks will be forced to write down their passwords or choose something they can remember. Myself, I rotate between various physical constants, my birthdate, and the number of licks it takes to get to the Tootsie Roll center of a Tootsie Pop. ---
**Author:** ![Cisco](https://avatars.discourse-cdn.com/v4/letter/c/ccd318/32.png) [@Cisco](https://boards.straightdope.com/u/Cisco)\ **Post date:** [September 11, 2009, 6:21am UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507/47 "2009-09-11T06:21:25Z")
I was interested in exactly this many years ago (mid '90s.) First off, AOL **was** brute-forceable back then but they fixed that before the turn of the century. I knew a guy who wrote some software that would brute force AOL passwords. You could load a ~60,000 item list into it and it’d run through it in a couple hours. It was almost every word in the dictionary plus some common names, common word/number combinations, etc. Back then, this was sufficient to crack virtually anybody’s password. I cracked my friends, my parents, etc, just for fun. I would always tell them about it or do something dumb like write funny stuff in their profile or send silly emails to themselves so they knew it was me. But the funny thing was, I knew some shady characters who gathered random AOL names en masse to crack them and use them to send spam, and they didn’t bother with the huge password lists. They got more accounts than they could ever use just with 5 words: love, password, abc123, and 1234. That’s why they make you choose more secure passwords these days. And FTR I have NO idea how you’d do it these days and don’t care. I’m far beyond the age at which I thought it was a novelty and I have no desire to do anything nefarious with other people’s information. ---
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [September 11, 2009, 12:56pm UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507/48 "2009-09-11T12:56:10Z")
I think the limited-length, reduced-character-set password routines are leftovers from days of yore, when storage was tight, security was lax and the Internet not available to most. You know, back when men were men and sheep were nervous. ---
**Author:** ![HorseloverFat](https://avatars.discourse-cdn.com/v4/letter/h/8e8cbc/32.png) [@HorseloverFat](https://boards.straightdope.com/u/HorseloverFat)\ **Post date:** [September 11, 2009, 1:55pm UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507/49 "2009-09-11T13:55:02Z")
Easiest way would be keylogger sent via email, especially if it can be sent from the gf or someone he knows. “Hey check out this hilarious video!” Attach an .exe and off you go. This trick still works and will probably forever work. The storm botnet was built using this trick. ---
**Author:** ![JSexton](https://avatars.discourse-cdn.com/v4/letter/j/96bed5/32.png) [@JSexton](https://boards.straightdope.com/u/JSexton)\ **Post date:** [September 11, 2009, 3:58pm UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507/50 "2009-09-11T15:58:53Z")
There was a very interesting segment on NPR just a couple days ago on this. Link here: [Hackers Have It Easy : NPR](http://www.npr.org/templates/story/story.php?storyId=112679747&ft=1&f=5) Short version: The password recovery is the first and easiest step. That’s how Sarah Palin’s Yahoo account was hacked last year. If that doesn’t work, brute force to a POP or IMAP account might work, or attempt to get a keylogger installed. The interesting thing here is that having a strong password only helps in one of those three attacks. ---
**Author:** ![gazpacho](https://avatars.discourse-cdn.com/v4/letter/g/6f9a4e/32.png) [@gazpacho](https://boards.straightdope.com/u/gazpacho)\ **Post date:** [September 11, 2009, 4:05pm UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507/51 "2009-09-11T16:05:12Z")
> [@Jragon](#): > > Your college too? If you password isn’t something like zK7j3o274ffB on mine it will NEVER let you use it. I suppose that’s a good thing if you’re like me and others who memorize it, but it just causes most people to write it down in their notebook or something :smack:. A good password written down is much much much better than a week password memorized. The big risk for banks and school etc. is that someone away from you will log into your accounts and mess with them. ---
**Author:** ![Cisco](https://avatars.discourse-cdn.com/v4/letter/c/ccd318/32.png) [@Cisco](https://boards.straightdope.com/u/Cisco)\ **Post date:** [September 11, 2009, 4:10pm UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507/52 "2009-09-11T16:10:50Z")
> [@JSexton](#): > > Short version: The password recovery is the first and easiest step. That’s how Sarah Palin’s Yahoo account was hacked last year. But when you do password recovery it just sends the password to a different email account. How did they get into that one? ---
**Author:** ![pulykamell](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/pulykamell/32/3166_2.png) [@pulykamell](https://boards.straightdope.com/u/pulykamell)\ **Post date:** [September 11, 2009, 4:23pm UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507/53 "2009-09-11T16:23:15Z")
> [@Cisco](#): > > But when you do password recovery it just sends the password to a different email account. How did they get into that one? Not always. Sometimes it asks you for the answer to the secret question and lets you reset the password right there. That’s how Hotmail used to do it (or may very well still do it, for all I know.) ---
**Author:** ![HorseloverFat](https://avatars.discourse-cdn.com/v4/letter/h/8e8cbc/32.png) [@HorseloverFat](https://boards.straightdope.com/u/HorseloverFat)\ **Post date:** [September 11, 2009, 5:46pm UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507/54 "2009-09-11T17:46:16Z")
Right, it asks you stuff like “what high school did you go to.” For someone like Sarah Palin, thats public information. If its someone you know then its just as easy. ---
**Author:** ![Sinaijon](https://avatars.discourse-cdn.com/v4/letter/s/dc4da7/32.png) [@Sinaijon](https://boards.straightdope.com/u/Sinaijon)\ **Post date:** [September 11, 2009, 6:09pm UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507/55 "2009-09-11T18:09:14Z")
Another form of social hacking is to setup a questionnaire site, IQ site, ‘If you were a car, you’d be a xyz!’ type site, and send them a link. Make them register to get the results (Email, username, password, etc). You’d be suprised how often people use the same password over and over at different sites. If they create a password at your site and you have an email address, you’ve got a good shot they match up. ---
**Author:** ![BigT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bigt/32/12044_2.png) [@BigT](https://boards.straightdope.com/u/BigT)\ **Post date:** [September 15, 2009, 10:37pm UTC](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507/56 "2009-09-15T22:37:58Z")
> [@gazpacho](#): > > A good password written down is much much much better than a week password memorized. The big risk for banks and school etc. is that someone away from you will log into your accounts and mess with them. But it’s much easier to lose something that’s written down. And if I’ve ever seen you log in, I probably know where you keep it. I agree with you on a bank account. But a school account? How often would that be just some random person? Perhaps more common than I realize? [Previous page](https://boards.straightdope.com/t/how-do-those-hackers-do-it/509507.md?page=2)