Slashdot Mirror
AI Just Made Guessing Your Password a Whole Lot Easier (sciencemag.org)
sciencehabit shares a report from Science Magazine: The Equifax breach is reason for concern, of course, but if a hacker wants to access your online data by simply guessing your password, you're probably toast in less than an hour. Now, there's more bad news: Scientists have harnessed the power of artificial intelligence (AI) to create a program that, combined with existing tools, figured more than a quarter of the passwords from a set of more than 43 million LinkedIn profiles.
Researchers at Stevens Institute of Technology in Hoboken, New Jersey, started with a so-called generative adversarial network, or GAN, which comprises two artificial neural networks. A "generator" attempts to produce artificial outputs (like images) that resemble real examples (actual photos), while a "discriminator" tries to detect real from fake. They help refine each other until the generator becomes a skilled counterfeiter. The Stevens team created a GAN it called PassGAN and compared it with two versions of hashCat and one version of John the Ripper. The scientists fed each tool tens of millions of leaked passwords from a gaming site called RockYou, and asked them to generate hundreds of millions of new passwords on their own. Then they counted how many of these new passwords matched a set of leaked passwords from LinkedIn, as a measure of how successful they'd be at cracking them. On its own, PassGAN generated 12% of the passwords in the LinkedIn set, whereas its three competitors generated between 6% and 23%. But the best performance came from combining PassGAN and hashCat. Together, they were able to crack 27% of passwords in the LinkedIn set, the researchers reported this month in a draft paper posted on arXiv. Even failed passwords from PassGAN seemed pretty realistic: saddracula, santazone, coolarse18.
Researchers at Stevens Institute of Technology in Hoboken, New Jersey, started with a so-called generative adversarial network, or GAN, which comprises two artificial neural networks. A "generator" attempts to produce artificial outputs (like images) that resemble real examples (actual photos), while a "discriminator" tries to detect real from fake. They help refine each other until the generator becomes a skilled counterfeiter. The Stevens team created a GAN it called PassGAN and compared it with two versions of hashCat and one version of John the Ripper. The scientists fed each tool tens of millions of leaked passwords from a gaming site called RockYou, and asked them to generate hundreds of millions of new passwords on their own. Then they counted how many of these new passwords matched a set of leaked passwords from LinkedIn, as a measure of how successful they'd be at cracking them. On its own, PassGAN generated 12% of the passwords in the LinkedIn set, whereas its three competitors generated between 6% and 23%. But the best performance came from combining PassGAN and hashCat. Together, they were able to crack 27% of passwords in the LinkedIn set, the researchers reported this month in a draft paper posted on arXiv. Even failed passwords from PassGAN seemed pretty realistic: saddracula, santazone, coolarse18.
That is all.
Entropy is _everything_ in passwords. Use lots of it.
The inherent vulnerability of online accounts is a great reason why we shouldn't have Slashdot accounts. Having an account here, or at any other discussion site where identity is totally irrelevant, is just an unnecessarily risky thing to do.
It's not like having an account somehow magically makes somebody's comments better. Look at creimer/cdreimer or AmiMoJo or PopeRatzo or the many other registered users here who, in my opinion, routinely post idiotic shit.
There are nothing but drawbacks to having an account here. There are no benefits that I can see.
Slashdot should also go back to how it used to be and get rid of the need for an account when submitting stories. Maybe we'd actually get some good submissions on the front page again.
Maybe this is a bit better than John (or maybe not), but John also employs "Learning Heuristics" but just calls them clever code.
Teach a person to create passwords according to certain rules, and then teach a machine learning implementation those same rules, its a computer doing what it was designed to do, what it was always going to do. A human just has to teach the computer to think like a human.
Rules create structure, consistency, something which can be automated.
A lack of rules lends itself towards laziness.
So we are the problem, and we must figure out how to outsmart ourselves.
Complete words? Please.
#DeleteFacebook
"coolarse18", really?
Had a friend who never used a password on her laptops. She just got a Toshiba with Win7. This was 2010. I told her it was a good idea to use a password so only she could use it, and she agreed since she said she noticed others were using her computer before.
I told her to pick a password only she would know. To not tell me. She said okay, and I know I've told this here before, so I'll get to the chase, she picked the first digit of her house. ONE DIGIT PASSWORD! I noticed this, and told her why that's not a good idea. This mindset is normal, I think, as foreign as it is to me.
At least it would have been if AI didn't guess my password.
This is a dictionary attack, which is not the same as cracking, assuming that they can't make a few 100 million trials to crack into each account.
Not AI, since it is actually machine learning. It's really stunning how far the rebranding of machine learning as AI has progressed. Maybe even machine training is more appropriate. AI is just not.
"figured more than a quarter of the passwords from a set of more than 43 million LinkedIn profiles. "
That is not all that impressive given that most people use poor passwords.
It is easy to do good passwords but not common.
First, if your password is someone's birthday/anniversary/death day/pet name/kid name, a hacker targeting you has already tried it. Second, if you simply either A) think of a phrase and use every first letter for a password (my method); or b) think of 3-4 words and string them together (Randall Monroe's method), you ain't gonna get hacked via password guessing. Period.
Um, assuming the website you're using has basic security protocols in place, Which Equifax has just shown ain't the case.
AI has definitely become the new buzzword to ignore. I love how it is stated with certainty when it isn't necessarily the case. Tech journalism is really in a state these days.
So a program matches names from gaming site and linked in to see if same password is used. A simple program could do this.
Starting to think AI is worthless from all these simplistic things people make it do.
How nice that LinkedIn is handing out large lists of hashed/encrypted passwords so other people can convert them into large lists of plain-text passwords. I feel so secure now.
Yeah, true, my set has the code but does not link the code with any actual card. But, this AI thing also just guessed some possible passwords. That is all, It did not match it with any account. So, at least in that sense, I beat that thing hollow!
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
With limited attempts, you can't try that many passwords before the account is blocked.
What secure sites give you unlimited attempts to sign in?
She was like chocolate when she drank... semi-sweet at first and then increasingly bitter.
made password cracking trivial.
If password cracking can be done offline, fuggedabutit. The only defense is to limit the number of consecutive failed attempts before a lockout. Or use two-factor or some other means of authentication.
... and raise you a random number generator. Picking passwords by hand is so 1990!
A good estimator: https://www.grc.com/haystack.h...
For example: abc123ABC!1234
Search Space Depth (Alphabet): 26+26+10+33 = 95
Search Space Length (Characters): 14 characters
Exact Search Space Size (Count):
(count of all possible passwords with this alphabet size and up to this password's length) 4,928,630,108,082,482,617,642,017,120
Search Space Size (as a power of 10): 4.93 x 1027
Time Required to Exhaustively Search this Password's Space:
Online Attack Scenario: (Assuming one thousand guesses per second) 1.57 thousand trillion centuries
Offline Fast Attack Scenario: (Assuming one hundred billion guesses per second) 15.67 million centuries
Massive Cracking Array Scenario:(Assuming one hundred trillion guesses per second) 15.67 thousand centuries
4 attempts: get a timeout of 1 hour. After 7 failed attempts get a timeout of 1 day. After 9 failed attempts get a timeout of 1 year.
"The agriculture ministry is not in charge of Gundam" - Japanese ministry official.
Okay Einstein, so with a targeted attack you can compromise 1 account an hour. How in the f*ck can you even begin to conflate that with an attack that compromised the privacy 143 million people? Go be bad at maths somewhere else, idiot.
I called it 3 years ago! (Well, okay C2 called it, but I get repost cred. Biggest repost ever, believe me!)
Table-ized A.I.
I've been using 16-digit random alphanumeric passwords for about a decade now. I use a script that dds from /dev/urandom, calls base64, strips out the two non-alphanumeric values, and then truncates to 16 digits. It works everywhere except backwater websites that limit you to 8 characters or 4-digit pins.
log2(95^14) = 14 * log2(95) = 91.98 bits of entropy for 14-digit alphanumeric+symbols
log2(62^16) = 16 * log2(62) = 95.27 bits of entropy for 16-digit alphanumeric-only
Slashdot has fallen so low that its readers (nerds) make up the 25% of those with passwords easily guessed! SAD! Slashdot readers used to have at least a modicum of tech sense.
Biometrics (touch Id, face Id) reduce the body parts to numerical patterns/long passwords.
As these AI systems are guessing the passwords from the hashes that means the biometrics are just as crackable.
Ergo - FaceId and TouchId fails - worse because you can't scramble your biometric when your "password" is cracked.
Even failed passwords from PassGAN seemed pretty realistic: saddracula, santazone, coolarse18.
You know, somewhere out there a /.er is frantically trying to change their password now that /. has posted it on the front page.
Yaz
For sites I don't care about. Most people have 3 good passwords, 1 for email, 1 for banking and one they reuse everywhere. Most people use shit passwords for work because the work password rules encourage poor passwords. Sites that actually care about security will use a single sign on service like gmail or facebook.
1. Shoot at barn door
2. Proclaim "Bulls-eye!"
Passwords aren't as random as people think, which is a flaw of that context-making machine; the human brain. It's also why dictionary attacks are useful. If a dictionary attack actually works against a provider, they've got bigger problems than letting you use "coolarse18" as a password.
How about, after an arbitrary number of attempts, say 10, characters entered into the password window would only be accepted at about the typing speed of an average person. For real people, no discernible difference; for a hacking program, frustration.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
Wow. It guessed linkedin passwords.
I hope that most people have an algorithm to remember their passwords and use a simple one for non-essential sites such as LinkedIn.
There is zero chance that an AI can guess my bank or email passwords. A little thing called entropy comes into play that AI doesn't help in breaking.
*cought* *cought* clickbait.
If you're scared of your govt then you need to further restrict its powers
Vote 3rd Party in 2016 and beyond
It guessed passwords used by random accounts. Great. But how would one use this to target an individual, or even a large # of accounts?
I'm just asking for a friend. And posting to undo mis-moderation.
if applying neural networks only got you a 4% improvement over what was available before, you've done a shitty job.
Even failed passwords from PassGAN seemed pretty realistic: saddracula, santazone, coolarse18.
Dammit! Now I have to change my password. Thanks PassGAN!