Brute force attack

A brute force attack tries huge numbers of passwords or PINs one after another until one works, so short or common ones fall quickly.

Brute force attack: A brute force attack is a guessing method in which a program tries many passwords, PINs or codes in turn until it finds the right one. It works well against short, common or predictable choices, such as 1234, a birth year or a name followed by a number.

Attackers do not guess by hand. Software can try thousands of passwords a second against a login page, a router or an exposed server, often starting with the most popular choices from earlier leaks. A four digit PIN has only ten thousand possibilities, so a thief with unlimited tries would find it fast. Routers and CCTV cameras that still use their factory passwords are guessed first, because they are everywhere and rarely updated.

Defences are length and limits. Longer passwords or passphrases make guessing take far too long, and good services lock the account or add delays after wrong tries. Use a different, long password for each important account, set your phone lock to a six digit PIN or more, and turn on two-factor authentication. A little extra length does far more good than clever symbols.

Tips

• Use a long passphrase of several unrelated words rather than a name plus numbers.
• Choose a six digit PIN or longer for your phone, and avoid dates and repeating digits.
• Turn on two-factor authentication, so a guessed password alone does not open the account.

Related terms