Explain like I'm five · Security

What is a Brute-Force Attack?

Brute-force attacks and credential stuffing, told as a story about a thief who tries a thousand keys one by one.

a thousand keysour gateone by one, all nighthe tries every key until one fits

A thief tries a thousand keys, one by one.He keeps going all night until one fits. The keys are passwords.

short password'apple'→ open in a minutelong password'blue elephants dance'→ takes centuriesa short key means fewer to try — so it goes fast

A short password opens in a minute. A long one takes centuries.A shorter key means fewer to try. He starts with common words, so 'apple' opens first. With a ring instead of a key, there is nothing to try at all.

a thousand keys, one by oneour gateanother castlekeys stolen from therebrute force = a thief who tries every key until one fitshe even tries keys stolen from other castles on our door

Brute force is a thief who tries every key until one fits.He tries a thousand keys one at a time. He even tries bundles stolen from other castles on our door.

Tries them alla, b, c… to the end
Common words first'apple', '1234'
Stolen key bundlesleaked from another castle
One try per doorjust under the lockout
our castlethe shopthe bathhousesame keyleaked from the shopnames + passwordsall three doors, the same key: 'apple'if the shop's list leaks, our gate opens toonever use one key on many doors

Use one key on three doors, and the moment the shop's list leaks, our gate opens too.The thief doesn't even have to guess. He takes the key from the leaked list and puts it straight in our door. Never use one key on many doors.

three misses, door lockswait after a missa second checkthe bell ringslong password + lockout + slowdown + second checkeven with a thousand keys, he only gets three tries

Three misses and the door locks. Make him wait between tries, ask for a second check, and ring the bell.Even with a thousand keys, he gets three tries. With a second check, even the right key isn't enough. Piled-up misses ring the bell on the guard room's screen.

In one breath

Brute force = a thief who tries every key until one fits. Credential stuffing = trying key bundles stolen from other castles on our door. Stop it with long passwords, lockout, and a second check.

Trying every possible password (brute force), or replaying account credentials leaked from another service (credential stuffing). Long passwords, account lockout, rate limiting, and MFA stop it.

When grown-ups say it

Brute force
Trying all thousand keys. From a to the end. Short passwords fall fast.
Dictionary attack
Common words first. 'apple', '1234', 'password'. Not random keys — the likely ones first.
Credential stuffing
Trying stolen key bundles. A list leaked from another castle, tried on our door. It works when one key opens many doors.
Password spraying
One try per door. Not a thousand tries on one door — one try on a thousand doors, to dodge the lockout.
Lockout policy
Three misses, door locks. Locked for a while, or until the guard comes.
Rate limiting
Wait between tries. Makes a thousand keys take a thousand nights.
MFA
The second check. Even the right key isn't enough without the ring. → the gatekeeper who checks three times
Leaked credentials
A list leaked from another castle. There are places that tell you if your key has leaked. If it has, change it now. → thief lessons
Next story
The Order Hidden in a Note →
Want another term as a picture book? Request →