Slashdot Mirror
How Many Seconds Would It Take To Crack Your Password?
DillyTonto writes "Want to know how strong your password is? Count the number of characters and the type and calculate it yourself. Steve Gibson's Interactive Brute Force Password Search Space Calculator shows how dramatically the time-to-crack lengthens with every additional character in your password, especially if one of them is a symbol rather than a letter or number. Worst-case scenario with almost unlimited computing power for brute-forcing the decrypt: 6 alphanumeric characters takes 0.0000224 seconds to crack, 10 alpha/nums with a symbol takes 2.83 weeks."
I wonder if he's caching every string entered into a dictionary file...
That's silly. I just use my SS#. That has a LOT of digits. Who is going to guess that?
That's why you enter something lexically similar to it and not the actual password. /. password is 3 mid-length words and the number 54 added to it, you type in that many letters and the number 11.
If your
Got "trillion trillions centuries" here :)
Which really means "lasts until some idiot stores it as plain text."
My one bank does that. It irks me to no end. Kind of like an unmatched (.
by Anonymous Coward: I, for one, welcome the shift from car analogies to pizza analogies. um.. overlords?
)
You're gonna break stuff if you keep leaving unmatched (
I worked on a random desktop rollout contract that was paying stupid amounts of money, and one evening I observed one of my fellow contractors entering his password.
clickity clickity clickity clickity...
I said "wow... hardcore password", he replied "yeah, I worked on a contract before this where we had to manually put in the MS Office CD Key across a few hundred desktops, so I've memorised it. It's now my go-to password"
Must have been the only time I've seen an MS CD-Key actually being wanted.
Pasting the first CD Key I could find on serials.ws (V4933-88FR7-9P3KK-D2QF4-9M9CM) into the GRC tool produced:
Online Attack Scenario:
(Assuming one thousand guesses per second) 68.45 thousand trillion trillion trillion centuries
Offline Fast Attack Scenario:
(Assuming one hundred billion guesses per second) 6.84 hundred million trillion trillion centuries
Massive Cracking Array Scenario:
(Assuming one hundred trillion guesses per second) 6.84 hundred thousand trillion trillion centuries
Anyway, in actual practice: passphrases using 2-3 words. I've found that 4 words and above is a bit much. And writing down your password/passphrase on a post-it is not a bad thing so long as your obfuscate it!
What system would allow someone to make thousands of attempts per second to login?
That's not the problem. The problem is that the lists of user logins and corresponding hashed passwords get in the wrong hands, whether it be due to bad design and/or coding, insecure software, or unfaithful servants. When you have that list, you run brute force against it to get the actual passwords.
Breaking into servers is much more attractive than breaking individual user accounts, simply because the yield is so much higher. Make a good trojan delivered through good social engineering, and you may catch 1% of the users. Breach the server, and you get the account info of all of them, and by running a crack session, you likely have 20-50% of the passwords within hours. Choose a very hard to crack password, and they may never get it even if they have the hash.
This happens a lot more than what we think. A server breach doesn't have to leave traces that anyone actually sees. We mostly know about the cases where the culprits brag about it or publish lists, which is unlikely to be more than the tip of the iceberg.
Companies are going to insist that their data is safe until proven otherwise, but you're stupid if you believe them.
Sony, Steam, LinkedIn, eHarmony - there are hundreds of server breaches with stolen user/hash lists that we know about. And likely an enormous amount we don't know about.
)
Fucker.
I was going to post the same thing. It's not uncommon to have sites that also limit your password to letters & numbers only.
(As an aside, the most heinous are the websites where you Forgot your password? and they email it right back to you in plaintext.)
All that is useless when the server gets compromised and the username/hashed password list gets sold to the highest bidder.
c-c-c-combo breaker!)
Well I entered in "Go to my office and look at the post-it on my terminal" and it said that will take "4.97 hundred billion trillion trillion trillion trillion trillion trillion centuries"
I wrote a nice long reply rebutting every single point then lost it when I hit backspace and focus was in the wrong part of the window. Grrr.
The author gets lots of things confused:
- He seems unaware that a rainbow table is equally effective against a good password as a bad one.
- He seems to think a dictionary attack comprises wholly and exclusively of words taken from a dictionary with no added numbers, symbols or punctuation. Bruce Schneier doesn't seem to agree with this, and I'm far more inclined to believe Mr. Schneier.
- He believes that a likely avenue for attack is constantly guessing a given user's password on a website. Any half-sane web service will block you long before you've tried a few thousand passwords against one username.
- He fails to note that in the case of LinkedIn, the list of password hashes itself was leaked - and this is Bad News.
- He also fails to note that in the case of LinkedIn, the password hashes were unsalted - Much Worse News.
- He also fails to note that if an unsalted list of password hashes is leaked, then it doesn't really matter how strong your password is, it's going to get found rather quickly. There's very little you or I can do about this. You could refuse to use systems that have such terrible security, but usually you only learn their security is this bad when it's far too late.
- He tops it off by recommending 10 character passwords with symbols and/or numbers. In other words, he falls foul of the problem described by Randall Munroe in XKCD some time ago.
with almost unlimited computing power for brute-forcing the decryptt: 6 alphanumeric characters takes 0.0000224 seconds
With "almost unlimited" computing power any password will almost take "almost no time" to decrypt.
sic transit gloria mundi