Slashdot Mirror
AI Just Made Guessing Your Password a Whole Lot Easier (sciencemag.org)
sciencehabit shares a report from Science Magazine: The Equifax breach is reason for concern, of course, but if a hacker wants to access your online data by simply guessing your password, you're probably toast in less than an hour. Now, there's more bad news: Scientists have harnessed the power of artificial intelligence (AI) to create a program that, combined with existing tools, figured more than a quarter of the passwords from a set of more than 43 million LinkedIn profiles.
Researchers at Stevens Institute of Technology in Hoboken, New Jersey, started with a so-called generative adversarial network, or GAN, which comprises two artificial neural networks. A "generator" attempts to produce artificial outputs (like images) that resemble real examples (actual photos), while a "discriminator" tries to detect real from fake. They help refine each other until the generator becomes a skilled counterfeiter. The Stevens team created a GAN it called PassGAN and compared it with two versions of hashCat and one version of John the Ripper. The scientists fed each tool tens of millions of leaked passwords from a gaming site called RockYou, and asked them to generate hundreds of millions of new passwords on their own. Then they counted how many of these new passwords matched a set of leaked passwords from LinkedIn, as a measure of how successful they'd be at cracking them. On its own, PassGAN generated 12% of the passwords in the LinkedIn set, whereas its three competitors generated between 6% and 23%. But the best performance came from combining PassGAN and hashCat. Together, they were able to crack 27% of passwords in the LinkedIn set, the researchers reported this month in a draft paper posted on arXiv. Even failed passwords from PassGAN seemed pretty realistic: saddracula, santazone, coolarse18.
Researchers at Stevens Institute of Technology in Hoboken, New Jersey, started with a so-called generative adversarial network, or GAN, which comprises two artificial neural networks. A "generator" attempts to produce artificial outputs (like images) that resemble real examples (actual photos), while a "discriminator" tries to detect real from fake. They help refine each other until the generator becomes a skilled counterfeiter. The Stevens team created a GAN it called PassGAN and compared it with two versions of hashCat and one version of John the Ripper. The scientists fed each tool tens of millions of leaked passwords from a gaming site called RockYou, and asked them to generate hundreds of millions of new passwords on their own. Then they counted how many of these new passwords matched a set of leaked passwords from LinkedIn, as a measure of how successful they'd be at cracking them. On its own, PassGAN generated 12% of the passwords in the LinkedIn set, whereas its three competitors generated between 6% and 23%. But the best performance came from combining PassGAN and hashCat. Together, they were able to crack 27% of passwords in the LinkedIn set, the researchers reported this month in a draft paper posted on arXiv. Even failed passwords from PassGAN seemed pretty realistic: saddracula, santazone, coolarse18.
That is all.
Entropy is _everything_ in passwords. Use lots of it.
I disagree. Having an account aids in the conversation process. Replying to AC posts means that an AC is unlikely to receive a notice and reply.
While slashdot accounts can be hacked, nothing of value is lost. As long as the member can prove their identity via other means.
Signed, testing "Post Anonymously" checkbox.
Maybe this is a bit better than John (or maybe not), but John also employs "Learning Heuristics" but just calls them clever code.
Teach a person to create passwords according to certain rules, and then teach a machine learning implementation those same rules, its a computer doing what it was designed to do, what it was always going to do. A human just has to teach the computer to think like a human.
Rules create structure, consistency, something which can be automated.
A lack of rules lends itself towards laziness.
So we are the problem, and we must figure out how to outsmart ourselves.
Complete words? Please.
#DeleteFacebook
This is a dictionary attack, which is not the same as cracking, assuming that they can't make a few 100 million trials to crack into each account.
Not AI, since it is actually machine learning. It's really stunning how far the rebranding of machine learning as AI has progressed. Maybe even machine training is more appropriate. AI is just not.
"figured more than a quarter of the passwords from a set of more than 43 million LinkedIn profiles. "
That is not all that impressive given that most people use poor passwords.
It is easy to do good passwords but not common.
First, if your password is someone's birthday/anniversary/death day/pet name/kid name, a hacker targeting you has already tried it. Second, if you simply either A) think of a phrase and use every first letter for a password (my method); or b) think of 3-4 words and string them together (Randall Monroe's method), you ain't gonna get hacked via password guessing. Period.
Um, assuming the website you're using has basic security protocols in place, Which Equifax has just shown ain't the case.
Yeah, true, my set has the code but does not link the code with any actual card. But, this AI thing also just guessed some possible passwords. That is all, It did not match it with any account. So, at least in that sense, I beat that thing hollow!
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
With limited attempts, you can't try that many passwords before the account is blocked.
What secure sites give you unlimited attempts to sign in?
She was like chocolate when she drank... semi-sweet at first and then increasingly bitter.
The fact that you can identify bad posters and filter them out is reason enough to have an account IMO.
Wow, sent an e-mail as suggested when clicking on "use classic" banner, and got a fast response that addressed my msg
It's probably enough to stop people from casually using her computer.
If that was indeed the goal, it seems fine to me.
Wow, sent an e-mail as suggested when clicking on "use classic" banner, and got a fast response that addressed my msg
A good estimator: https://www.grc.com/haystack.h...
For example: abc123ABC!1234
Search Space Depth (Alphabet): 26+26+10+33 = 95
Search Space Length (Characters): 14 characters
Exact Search Space Size (Count):
(count of all possible passwords with this alphabet size and up to this password's length) 4,928,630,108,082,482,617,642,017,120
Search Space Size (as a power of 10): 4.93 x 1027
Time Required to Exhaustively Search this Password's Space:
Online Attack Scenario: (Assuming one thousand guesses per second) 1.57 thousand trillion centuries
Offline Fast Attack Scenario: (Assuming one hundred billion guesses per second) 15.67 million centuries
Massive Cracking Array Scenario:(Assuming one hundred trillion guesses per second) 15.67 thousand centuries
4 attempts: get a timeout of 1 hour. After 7 failed attempts get a timeout of 1 day. After 9 failed attempts get a timeout of 1 year.
"The agriculture ministry is not in charge of Gundam" - Japanese ministry official.
That's nonsense. Slashdot could easily implement a reply notification system that doesn't rely on an explicit, persistent user account here. It's trivial to do using ...
I take it you forgot about the beta debacle.
'Slashdot could easily implement' is really just crazy talk.
Faster! Faster! Faster would be better!
I called it 3 years ago! (Well, okay C2 called it, but I get repost cred. Biggest repost ever, believe me!)
Table-ized A.I.
I've been using 16-digit random alphanumeric passwords for about a decade now. I use a script that dds from /dev/urandom, calls base64, strips out the two non-alphanumeric values, and then truncates to 16 digits. It works everywhere except backwater websites that limit you to 8 characters or 4-digit pins.
log2(95^14) = 14 * log2(95) = 91.98 bits of entropy for 14-digit alphanumeric+symbols
log2(62^16) = 16 * log2(62) = 95.27 bits of entropy for 16-digit alphanumeric-only
Even failed passwords from PassGAN seemed pretty realistic: saddracula, santazone, coolarse18.
You know, somewhere out there a /.er is frantically trying to change their password now that /. has posted it on the front page.
Yaz
For sites I don't care about. Most people have 3 good passwords, 1 for email, 1 for banking and one they reuse everywhere. Most people use shit passwords for work because the work password rules encourage poor passwords. Sites that actually care about security will use a single sign on service like gmail or facebook.
Look at creimer/cdreimer or AmiMoJo or PopeRatzo or the many other registered users here who, in my opinion, routinely post idiotic shit.
Unlike Anonymous Coward, who seems to be suffering from multiple split personalities and politically can best be described as a Nazi communist anarcho-authoritarian ballsack.
Still, nice to know the Pope and I are somewhat (in)famous.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
An account is only vulnerable if people use weak passwords, or reuse them across multiple sites (some of which are probably storing them in plaintext). People should use a unique randomly generated password for each site, storing them with a password manager (and backing it up), not try to be Rain Man and remembering all of them.
An account can develop a reputation, which helps moderation. And the owner can be anonymous, so not vulnerable to retaliation.
Having said all that, I can't see any good reason for requiring an account for submitting stories. They can stand or fall on their own merit.
registered users here who, in my opinion, routinely post idiotic shit.
Having my posts against my pseudonym makes it easier for people that dislike my idiotic shit to use the Slashdot 'foe' system to auto-mod me out of their sight. I'm fine with that.
Slashdot knowing that my posts are from me means that the site can send me emails when people reply to my posts. That lets me continue a conversation.
There are nothing but drawbacks to having an account here. There are no benefits that I can see.
Slashdot should also go back to how it used to be and get rid of the need for an account when submitting stories.
Well, I've highlighted a couple of benefits. I'm with you on the story submissions though, a story either stands on its own or it doesn't. Much the same as an AC comment.
As your password, or your name?
There are benefits to having an account here and in other discussion forums, as pointed out in other answers, and the security risk comes from bad habits, not the account themselves.
How about, after an arbitrary number of attempts, say 10, characters entered into the password window would only be accepted at about the typing speed of an average person. For real people, no discernible difference; for a hacking program, frustration.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
Wow. It guessed linkedin passwords.
I hope that most people have an algorithm to remember their passwords and use a simple one for non-essential sites such as LinkedIn.
There is zero chance that an AI can guess my bank or email passwords. A little thing called entropy comes into play that AI doesn't help in breaking.
*cought* *cought* clickbait.
If you're scared of your govt then you need to further restrict its powers
Vote 3rd Party in 2016 and beyond
Simple solution. Use throwaway passwords on less important sites, and break your standards to create super secure passwords for sites that are more important.
I generally don't trust password managers. Too much power in one place. Too much of a risk if it got stolen.
Hence, I use password tiers.
A weak password for sites where it is potentially stored as plain text.
A throw-away password for various sites I'm not concerned about losing my account or access to.
A moderate password for sites I easily expire-able data, such as a credit card number.
And unique and complex passwords designed to not be guessable in any form for accounts which hold sensitive information.
I had /. email me a temporary password, but when I got to the configuring password page, no matter what I do I cannot create a new password. Constantly tells me 'current password is incorrect', and it's the temporary password /. just emailed me. Any help, eds?
I need to retract my statement above. Someone from Slashdot has just contacted me via my connected email account and has promised to investigate the matter. We are currently trying to work out this issue. I was told that whatever the reason is for my being unable to create a new password has nothing to do with a comment made by me some years ago about reddit. I may have jumped the gun on this one, and new management at slashdot is very responsive, it seems. Thank you Logan Abbot
Even failed passwords from PassGAN seemed pretty realistic: saddracula, santazone, coolarse18.
Dammit! Now I have to change my password. Thanks PassGAN!