What is a brute force attack and how to protect your passwords?

Published on 2026-10-20 by frfrand

Fuerza bruta, password spraying y credential stuffing: diferencias, defensas con MFA, límites de intentos y seguridad de inicios de sesión.

A brute force attack against an account consists of trying many passwords until finding one that works. It is a simple concept, but it is often confused with other attacks that also seek to gain access through credentials.

It does not mean that someone necessarily tries all possible combinations. In real attacks, frequent passwords, leaks, and automations are exploited.

The lock example

Imagine a door that allows entering a numeric code. If you can try thousands of combinations without anyone stopping you, sooner or later you could guess a weak key.

In a web application something similar happens when a login accepts unlimited attempts and does not apply protection mechanisms.

Defense does not consist only of asking for complicated passwords; it also matters to control how a person authenticates and how abuse is detected.

Brute force, dictionary, and reuse: they are not the same

Brute force: trying numerous possibilities against an account.

Dictionary attack: using a list of predictable or common passwords, instead of generating completely random combinations.

Password spraying: trying a frequent password on many accounts, which may attempt to avoid certain per-user limits.

Credential stuffing: using leaked username and password combinations from other services, hoping that some people reuse their credentials.

These differences matter because a measure designed solely to block many attempts on a single account may not detect well attempts distributed across many accounts.

What makes a password more resistant?

Length and unpredictability are usually more useful than adding random symbols to a common word. A password manager can generate long and different keys for each service.

Reusing the same password is especially dangerous: a breach on a small site can affect much more important accounts.

Modern policies also consider blocking passwords known from breaches and avoiding composition rules that only manage to make people invent predictable patterns.

What defenses can an application apply?

Attempt limits: reduce the rate of abusive authentication requests.

Risk controls: detect unusual patterns without arbitrarily blocking legitimate users.

Multi-factor authentication: require an additional check when the password alone is not enough.

Useful alerts: inform about suspicious activity and allow reviewing sessions or devices.

These measures must be designed carefully. An attacker could try to abuse the locks to prevent legitimate users from accessing their accounts.

Does hiding the login page help?

Changing the access path can reduce noise from very simple tools, but it should not be considered a real defense.

If authentication accepts weak passwords or does not limit abuse, changing /login to a rare URL does not fix the underlying problem.

Nor is it enough to change SSH to another port: it may reduce certain automated attempts, but keys, permissions, updates, and network rules are still necessary.

What about passkeys?

Authentication mechanisms based on public-key cryptography, such as FIDO2/WebAuthn-compatible passkeys, offer different security properties than traditional passwords, including resistance to certain forms of phishing.

This does not mean you can forget about account recovery or controlling lost devices. Security also depends on how those processes are managed.

How to defensively review a server?

Check which services expose authentication, whether passwords or keys are used, what alerts exist, and whether remote accesses are restricted to those who need them.

You do not need to try to break into other people's accounts to learn about the problem. You can review the configuration of your own services and study your provider's documentation.

What does this have to do with ArduMaker?

When managing VPS, repositories, and platform accounts, as happens in ArduMaker, using unique credentials, limited permissions, and available authentication mechanisms reduces risks. It is also important to control which services allow access attempts from the Internet.

In short: brute force is repeatedly trying keys. Real protection combines unique passwords, abuse limits, additional authentication, and good access design.

Sources: OWASP: defense against credential stuffing and related attacks · Authenticators according to NIST.