Are stronger passwords safe in case of a breach?

Question

Passwords are not generally held by websites, instead, they hold hashes of your passwords. When there's a breach, these hashes are stolen and they are matched against rainbow tables of pre generated password hashes. Is it fair to say that if your password is a genuinely secure password, like xy%5-xthrs32£ that you are still safe. Far far safer than someone with a password like Princess123 or my favourite LetMeIn.

I know the answer is that in the event of a breach, you should always change your password, I'm just trying to understand the security aspect. So, when talking to to someone with a genuinely random password – eg one generated by a good password manager – is it fair to say you are probably safe?

Answer 1

A stronger password is almost always better than a weak password. In the event of a breach, the details of the hashing and salting of passwords become very important.

If the server used plain text, strong passwords and weak passwords are all equally and thoroughly.

If the server used, for example, the infamous Microsoft LAN Manager, hash string passwords won't help much, alphanumeric passwords of length (14 is the max) would be instantly broken using high coverage rainbow tables. Some really odd special characters will help some but not much.

If the site used proper security, for example salted bcrypt hash, there is currently no feasible way of inverting a reasonably strong password even with such a hash. The salting makes rainbow tables not very useful, and bcrypt is designed to be slow to brute force rather than fast to compute legitimately.

However the site.breached is obviously compromised and other sites are presumably using different passwords. If you are using random passwords, you are probably using a password manager and can give each site its own password. So if it's only changing the one compromised password, just do it.

Answer 2

When there's a breach … when talking to to someone with a genuinely random password – eg one generated by a good password manager – is it fair to say you are probably safe?

Theoretically, yes (under a truckload of assumptions).

Assuming…

• you are a private person (not representing a company, organisation, or institution)
• you only transmitted your password over a secure connection (HTTPS) each and every time,
• the breached site actually hashed your password using an according, well-vetted, unbroken, cryptographically secure slow hashing algorithm (like Argon, bcrypt, etc),
• the site only stored the password hash (and not your password in plain text),
• the server code contained no security glitches which might have leaked your password,
• no other security breaches took place and no other attack vectors were exploited successfully,
• etc.

… and, last but not least, assuming …

• the attacker is not one with unbounded memory and processing power,
• the “breach” limits itself to the attacker only grabbing a copy of the database where password hashes were stored (and not some rogue employee or something alike)

… then your question practically boils down to: “Is a random password more difficult to attack using rainbow tables et al?”

In that case and under all those assumptions, the answer is “Theoretically, yes.”

Compared to dictionary-alike passwords your password will be securer as the chances an attacker has pre-calculated dictionary passwords are higher than the chance the attacker has pre-calculated a garbled sequence of characters. If the website developers did their job correctly, they also used salts et al – which makes things even more difficult to the attacker and somewhat voids all precalculation efforts of an attacker.

Yet, if the attacker is a state or nation, those chances reduce to a near-zero level. Also, the above relies on a truckload of assumptions. A small thing like not using a salt when hashing passwords can make things more insecure than any attacker could wish for. Similar problems arise if the website backend didn’t use a slow hashing function (Argon, Bcrypt, or alike) for your password. All that can and will have an impact on the safety you expect from your random password.

Practically, no.

When a site has been breached, the breach itself mostly turns out to be merely the tip of a much bigger security-problems iceberg and such attacks rarely limit themselves to a stolen database full of password hashes.

If you have reason to believe your password has been stolen or compromised in any way, you should change it, and make sure you change it on all of your accounts where you use the same or a similar password. To simply rely on the fact that a breached website did not have other attack vectors wide open would not really be a smart move.

See… in the event of a breach, the fuse of the bomb has been lit. Just because you happen to have a longer and/or better fuse doesn’t mean you’re safer than others. It merely buys you a bit more time until things blow up. If the website developers did their job right, that detonation may take decades to come… but if someone managed to breach the website, chances are the developers did something (if not everything) wrong.

Therefore, changing your password as soon as possible is the safest/smartest thing to do in the event of a website breach. Especially, since you never know where website programmers may have dropped the ball and thereby introduced other security glitches in places that might or might not have an influence on the security of your password and/or other credentials.

Generally, a good password policy will push you towards refreshing your password(s) in case of a breach (as well as in some other situations). Besides, as part of your personal key management, you should be rotating (read: refreshing, renewing) your passwords on a regular interval anyway – as doing so can be “beneficial for reducing the impact of some password compromises” (but not all). Since you mentioned a password managing app, chances are that it contains according functionality allready. Even if it doesn’t, it’ll surely make a password change easier than constantly wondering if the attacker was able to recover your password or not.

But in the end, it’s a matter of personal opinion if it is fair to say that you are probably safe when having used a (let’s just call it) "more random password", as that strongly depends on the individual scenarion and what exactly you mean when writing probably safe.

TL;DR

So, wrapping all this up in a final, concluding answer: “A more random password could be safer compared to less random passwords used by other users when an attacker tries to reverse/break the captured password hashes, but you should definitely NOT rely on your password being safe on the long run. Change your password nevertheless when the related website was breached as it’s better to be safe than sorry!” Most of the time, websites will ask you to do so anyway after they’ve detected a breach and closed related gaps.

Related to your question, you might also be interested to check on the ftc.gov article Time to rethink mandatory password changes; especially the “When should passwords be changed?” part.