A password attack seeks to learn or guess a secret so the attacker can sign in as the rightful account holder without permission.
The goal is the secret or a successful login, which is different from bypassing a second check after a login has already finished.
How it works
Common patterns include many guesses against one account, trying a secret that leaked from a different site, and stealing a stored password file from a server.
This page names those patterns and the harm, and it does not provide guess lists, cracking steps, or commands.
People who reuse a short secret across sites make the leaked list from one breach into a key for another.
Defenses therefore favor unique secrets, a slow salted password hash on the server, limits on repeated failures, and a second check that still holds if the secret leaks.
Concrete examples
- An email account is taken over because its password was identical to one exposed in a breach of an unrelated forum.
- A login page locks a customer out after a burst of wrong guesses, which is noisy but shows the account was targeted.
- A stolen backup of a password database becomes serious because the hashes were fast and unsalted, so many secrets are recovered offline.
Protective measures
- Require long unique secrets and give people a password manager path so reuse is not the easy option.
- Store passwords only as slow salted hashes meant for passwords, and protect the database that holds them.
- Slow or stop repeated failures against one account and against one address without telling attackers your exact cutoff.
- Add a second sign in check so a leaked secret is not enough to enter mail, payments, or administration.