Editing Dictionary attack (section)

==Technique==
A dictionary attack is based on trying all the strings in a pre-arranged listing. Such attacks originally used words found in a dictionary (hence the phrase ''dictionary attack'');<ref>
Jeff Atwood.
[https://blog.codinghorror.com/dictionary-attacks-101/ "Dictionary Attacks 101"].
</ref> however, now there are much larger lists available on the open Internet containing hundreds of millions of passwords recovered from past data breaches.<ref>[https://crackstation.net/crackstation-wordlist-password-cracking-dictionary.htm CrackStation's list]. e.g., with over 1.4 billion words.</ref> There is also cracking software that can use such lists and produce common variations, such as [[leet | substituting numbers for similar-looking letters]]. A dictionary attack tries only those possibilities which are deemed most likely to succeed. Dictionary attacks often succeed because many people have a tendency to choose short passwords that are ordinary words or common passwords; or variants obtained, for example, by appending a digit or punctuation character. Dictionary attacks are often successful, since many commonly used password creation techniques are covered by the available lists, combined with cracking software pattern generation. A safer approach is to randomly generate a long password (15 letters or more) or a multiword [[passphrase]], using a [[password manager]] program or manually typing a password.

Dictionary attacks can be deterred by the server administrator by using a more computationally expensive hashing algorithm. [[Bcrypt]], [[scrypt]], and [[Argon2]] are examples of such resource intensive functions that require significant computational power to process,<ref>{{Cite web |title=Key Stretching Algorithms: Basics, Algorithms & Techniques |url=https://bootcampsecurity.com/blog/key-stretching-algorithms-basics-algorithms-techniques/ |website=Bootcamp Security|date=29 September 2024 }}</ref> allowing for large improvements in security against dictionary attacks. While other hashing functions, such as [[Secure Hash Algorithms|SHA]] and [[MD5]], are much faster and less expensive to compute, they can still be strengthened by being applied multiple times to an input string through a process called [[key stretching]]. An attacker would have to know approximately how many times the function was applied for a dictionary attack to be feasible.