Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

25-GPU cluster cracks every standard Windows password in less than 6 hours

arstechnica.com

Post reply on HN
Print view View original

61–70 of 77 posts

Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours

#61

Post by ccheney »

sunraa wrote: post #59
phpnode wrote: post #49

Earlier quoted context omitted.

or you can literally write the whole sentence, which is even more secure and you don't have to remember any special rules, just the sentence itself. Of course it's more typing: Guess what? Back in 2009 I saw a uniquely attired man traipsing round local places with a high number of legs, necks and shirt collars. 136 characters or 14 Gigayears to crack. Wow today I learnt that there's such a thing as a Gigayear.

I just went through the process of changing passwords to sentences. You'd be surprised at how many sites do not allow sentences.

What irks me is when they reject special characters like ?!#$@", etc.

Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours

#62

Post by nodata »

mikeash wrote: post #60
joshmaker wrote: post #55

Earlier quoted context omitted.

- 8 chars: 84 minutes - 6 chars: 1.2 seconds All of which demonstrates the importance of requiring longer passwords. Also, keep in mind that these are maximum times required to crack a password and not the average times.

The average time to crack will just be half of the maximum, so it's not a big difference (compared to order of magnitude errors, anyway). Still good to point out, though.

Sure? Wouldn't you optimise the attack to try words or wordlike c0mb1n4t1ons first?

Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours

#63

Post by modoc »

Symmetry wrote: post #58
ramidarigaz wrote: post #18

Earlier quoted context omitted.

On my webserver, you get 3 chances and then a 24 hour ip ban. I think that comes out to 0.00003 passwords per second :) The particularly persistent IPs get a special iptables rule.

That's why an attacker will try three common passwords against every possible login name.

I doubt the IP ban is per account. Mine is a 5 failure within 1 hour rule, and if you get more than 4 of those ever you're perm-banned.

Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours

#64

Post by stephengillie »

nodata wrote: post #62
mikeash wrote: post #60

Earlier quoted context omitted.

The average time to crack will just be half of the maximum, so it's not a big difference (compared to order of magnitude errors, anyway). Still good to point out, though.

Sure? Wouldn't you optimise the attack to try words or wordlike c0mb1n4t1ons first?

That's a good idea if the password was human-generated. With computer-generated random passwords, like gH8r;2CpyyK!a, you might want to optimize differently.

Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours

#65

Post by [deleted] »

nodata wrote: post #62
mikeash wrote: post #60

Earlier quoted context omitted.

The average time to crack will just be half of the maximum, so it's not a big difference (compared to order of magnitude errors, anyway). Still good to point out, though.

Sure? Wouldn't you optimise the attack to try words or wordlike c0mb1n4t1ons first?

[deleted]

Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours

#66

Post by apawloski »

phpnode wrote: post #49
ChrisNorstrom wrote: post #47

Guess what? Back in 2009, I started using a method to remember long passwords with a huge # of letters, numbers, & special characters. Gw?Bi2009Isuamtrlpwah#ol,n,&sc. (31 characters) Create memorable sentences and create a password using the first letter of each word & all the numbers and punctuation. After entering it 10 or so times you'll get used to it pretty quickly.

or you can literally write the whole sentence, which is even more secure and you don't have to remember any special rules, just the sentence itself. Of course it's more typing: Guess what? Back in 2009 I saw a uniquely attired man traipsing round local places with a high number of legs, necks and shirt collars. 136 characters or 14 Gigayears to crack. Wow today I learnt that there's such a thing as a Gigayear.

Well, to be fair, 14 Gigayears in terms of an attack geared towards a totally different case. I wonder if we can optimize an attack on sentence passwords using hidden markov modeling, or other natural language processing methods. The entropy at the character level decreases if we assume the password is an english sentence [1], and my gut feeling is that we can apply this same thinking at the word level as well (this may very well have been demonstrated already in research).

[1] http://www.nd.edu/~busiforc/handouts/cryptography/cryptograp...

Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours

#67

Post by phpnode »

apawloski wrote: post #66
phpnode wrote: post #49

Earlier quoted context omitted.

or you can literally write the whole sentence, which is even more secure and you don't have to remember any special rules, just the sentence itself. Of course it's more typing: Guess what? Back in 2009 I saw a uniquely attired man traipsing round local places with a high number of legs, necks and shirt collars. 136 characters or 14 Gigayears to crack. Wow today I learnt that there's such a thing as a Gigayear.

Well, to be fair, 14 Gigayears in terms of an attack geared towards a totally different case. I wonder if we can optimize an attack on sentence passwords using hidden markov modeling, or other natural language processing methods. The entropy at the character level decreases if we assume the password is an english sentence [1], and my gut feeling is that we can apply this same thinking at the word level as well (this…

I thought about that, but presumably since so very few people use sentence based passwords, crackers don't optimize for this use case yet. Regardless it's quite a long sentence and that should afford some additional protection against this kind of attack, i can imagine 3 or 4 word sentences being defeated by this kind of technique, 30 words seems a lot more difficult

Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours

#68

Post by dj_sa »

My password is 24 chracters long, and fully random. I don't memorise it. I use Aladdin to type it for me. http://igg.me/aladdin-key

Aladdin is trying to improve the current situation of people using simple or identical passwords everywhere by removing the need to memorise passwords. Aladdin works with Windows, Mac, Linux as well as Android and iPad.

Aladdin is a USB key(board). No software needed.

Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours

#69

Post by apawloski »

phpnode wrote: post #67
apawloski wrote: post #66

Earlier quoted context omitted.

Well, to be fair, 14 Gigayears in terms of an attack geared towards a totally different case. I wonder if we can optimize an attack on sentence passwords using hidden markov modeling, or other natural language processing methods. The entropy at the character level decreases if we assume the password is an english sentence [1], and my gut feeling is that we can apply this same thinking at the word level as well (this…

I thought about that, but presumably since so very few people use sentence based passwords, crackers don't optimize for this use case yet. Regardless it's quite a long sentence and that should afford some additional protection against this kind of attack, i can imagine 3 or 4 word sentences being defeated by this kind of technique, 30 words seems a lot more difficult

This is purely a thought experiment at this point, but it would actually be a pretty interesting project. I wonder if it's true that longer sentences would be more secure -- or perhaps entropy decreases with larger inputs that give more data to analyze. In the cipher world this would be true, but for O(1) hashes, I'm curious how this could be tested.

Edit Ultimately security from these types of attack would be with unusual/non-sensical adject/noun, adverb/verb pairs etc -- which your example does reasonably well. Picking a bible verse (for example) would be bad, though.

Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours

#70

Post by phpnode »

apawloski wrote: post #69
phpnode wrote: post #67

Earlier quoted context omitted.

I thought about that, but presumably since so very few people use sentence based passwords, crackers don't optimize for this use case yet. Regardless it's quite a long sentence and that should afford some additional protection against this kind of attack, i can imagine 3 or 4 word sentences being defeated by this kind of technique, 30 words seems a lot more difficult

This is purely a thought experiment at this point, but it would actually be a pretty interesting project. I wonder if it's true that longer sentences would be more secure -- or perhaps entropy decreases with larger inputs that give more data to analyze. In the cipher world this would be true, but for O(1) hashes, I'm curious how this could be tested. Edit Ultimately security from these types of attack would be with u…

The problem is that you have no hints about what is correct or not because presumably a one way hash is being used, so even if you get the first 29 words right, you don't know that.

Assuming the cracker just uses a wordlist containing 200,000 terms and unsophisticated brute force, this thing could crack a 3 word password in a day and a 4 word password in 800 years[1]. It would certainly be an interesting project, but I honestly think this is a safe approach for now.

[1] http://www.wolframalpha.com/input/?i=%28200000**4+%2F+63+bil...

Post reply on HN