This is topic How long would it take to hack your password? in forum Books, Films, Food and Culture at Hatrack River Forum.


To visit this topic, use this URL:
http://www.hatrack.com/ubb/main/ultimatebb.php?ubb=get_topic;f=2;t=044443

---

Posted by Icarus (Member # 3162) on :
 
I found this site and I thought it was interesting:

http://www.thecrypt.co.uk/lockdown/recovery_speeds.html

A class D attack on my passwords for important stuff would take at most 87 days in most cases. I reckon that's reasonably good. You could hack my Hatrack password in quite a bit less time.

One thing they didn't seem to take into account in the one-case versus mixed cases versus letters-and-umbers thing is where your numbers and case changes occur. I think if you only use upper case in your first letter, and you only use numbers at the end, that would make your account more vulnerable. (Granted, they're talking about randomized attacks, but if I were designing some random character password hacker program, I would start with upper cases first, numbers last, and proceed from there.)

How hackproof are you?
 

---

Posted by Nighthawk (Member # 4176) on :
 
My primary password doesn't even appear on the list: 96 character set, length of 10.

My forum password can be done in six days at Class D, though.
 

---

Posted by Gwen (Member # 9551) on :
 
I have eight passwords that I use for varying levels of security. The lowest is a four-digit number (stupid college site, they won't let me pick anything else), and then I also have my SSN (stupid college computers, they won't let me pick anything else). I never use either of those if I can help it.
My computer one is fifteen letters long (all lower case); another one of mine uses symbols and lowercase letters and is ten characters long (I use that one for another college site). My two shortest are five and four letters long, and I don't use those for anything important. None of them are dictionary words or phrases or pet's names or middle names or in fact guessable (by people, I mean) at all. My gmail one is a word, but it's not in most dictionaries; it's eleven letters long.
My mother, however, uses two passwords (her PIN and a name) with annoying regularity. She has different ones for things involving money which she has written down on her computer in a non-password-protected file, but I can still get into most of her password-protected things when I want to. And whenever she signs me up for something which requires a password, she uses the same seven-letter dictionary word that is fairly easily guessable to people who know me.
The scare of my life: signing up for an account with McAfee and it telling me my administrator password was "ender". I hadn't told it I wanted my password to be "ender", no one else had signed up for it, and it's easily guessable (further proof that I hadn't chosen it). How the heck did McAfee know that I was an OSC fan?
Yeah, I changed it right away.
 

---

Posted by Goody Scrivener (Member # 6742) on :
 
Forum password, class D - 4 days.
Financials password, class D - 23 years. Not too shabby

I admit, I have about 4 passwords total because I'm not so good at remembering them and I don't want to have a list somewhere that could be picked up or hacked into. But even at that, the shortest is 6 characters, mixed alphanumeric.

As I've been changing passwords on sites to the (currently) most complex of them all, I'm seeing that more and more of them are requiring 8 character minimums.
 

---

Posted by Tstorm (Member # 1871) on :
 
Yeah, this is an educational exercise for people unfamiliar with password guidelines and strengths. They classify 'attack strength' based on passwords processed per second, each level increasing by a factor of 10. Class F, the highest, processes 1 billion passwords per second.

I usually divide my passwords into 3 groups. Public passwords, easy to break of course, but only protecting unimportant items. A shared folder on a network between my friends, for example.

So, for a 7 or 8 character password like this:

code:

---

Password  	Class of Attack
Length 	Combinations 	Class A 	Class B 	Class C 	Class D 	Class E 	Class F
7  	8 Billion  	9 Days  	22 Hours  	2¼ Hours  	13 Mins  	1¼ Mins  	8 Secs
8 	200 Billion 	242 Days 	24 Days 	2½ Days 	348 Mins 	35 Mins 	3½ Mins

---

Analysis: Security's already compromised, because of sharing with other people, and I'm not sharing anything I wouldn't want everyone to have. So why bother with a long password?

My second level of passwords guards personal stuff like e-mail, forums, and some other web content. These passwords fall into the 96-character category; I mix numbers, letters (case sensitive), and symbols. Typical length: 10 characters. Hmm...funny that's not on the chart.

code:

---

Length  	Combinations  	Class A  	Class B  	Class C  	Class D  	Class E  	Class F
8  	7.2 Quadrillion  	22,875 Years  	2,287 Years  	229 Years  	23 Years  	2¼ Years  	83½ Days

---

Analysis: It looks like I'm safe from all but the distributed computing projects. I rotate passwords, periodically. (Note of pride: I designed the password generator that creates these passwords for me.)

I have a third level of passwords, but I rarely use it.
 

---

Posted by Icarus (Member # 3162) on :
 

quote:

---

Originally posted by Goody Scrivener:
I admit, I have about 4 passwords total because I'm not so good at remembering them and I don't want to have a list somewhere that could be picked up or hacked into.

---

quote:

---

Originally posted by B34N:
Anyone know how long it would take for the 56 character variety that is actually 22 characters long?

---

quote:

---

Originally posted by King of Men:

quote:

---

Originally posted by B34N:
Anyone know how long it would take for the 56 character variety that is actually 22 characters long?

---

You can calculate it from the information in the table. Start with the highest length they show; say it's ten. Then you are multiplying the number of combinations by 56 each time you add a character, which for 22 and 10 makes 56^12. So just multiply the length they show by 56^12, or about 10^21.

---

Actually, I think the answer is "long enough"...
 

---

Posted by MightyCow (Member # 9253) on :
 
I doubt that any of the sites where I use a password would have the bandwidth or server strength to accept millions of password attempts per second or better.

I think the physical limitations of my websites protects me as much or more than the strength of my passwords.
 

---

Posted by Icarus (Member # 3162) on :
 
I think there's a point of diminishing returns, though. I mean, given that you can't even see your password as you type it, I think a 22-character password or a password with characters not available on the keyboard is overkill.
 

---

Posted by Gwen (Member # 9551) on :
 

quote:

---

I use a system, such that every (important) password I have is different from all the others, but, knowing my system, I can easily deduce what it is. Basically the base password is the same for all of them, but there are additional letters/numbers appended that I associate with the site or service itself, that I can easily remember.

---

quote:

---

I think there's a point of diminishing returns, though. I mean, given that you can't even see your password as you type it, I think a 22-character password or a password with characters not available on the keyboard is overkill.

---

Ah, but you're assuming that functionality is a more important factor than braggability to one's friends. "Your password only uses characters on the keyboard? That's nothing. My password uses the trademark symbol!" meets "Oh yeah? Well my password is written in Chinese!", et cetera.
 

---

Posted by Samprimary (Member # 8561) on :
 
A special character takes all of three extra keystrokes. What's really cool about it is that it allows me to type in my password even with people standing there in view of the keyboard (which happens often, and is why I picked up the habit) and be pretty sure they ain't never catching the true character usage. That's Functional™
 

---

Posted by Icarus (Member # 3162) on :
 
You ever use a laptop?
 

---

Posted by MightyCow (Member # 9253) on :
 
If the password is even fairly strong, it's much easier to get it other ways than brute force. Looking over someone's shoulder as they type it, for example.
 

---

Posted by Demonstrocity (Member # 9579) on :
 
Really interesting numbers - thanks, Ic!
 

---

Posted by Nighthawk (Member # 4176) on :
 
My wife has a different password for each site she visits.

It takes about three visits or a week, whichever comes first, before she forgets said passwords.

It really upsets her that she can mention a password to me in passing and I'll remember it three years from now. I forget to tie my shoes, but I have yet to forget a single password that's ever been told to me.

I know Icarus' PIN number... anyone want it?
 

---

Posted by Bob_Scopatz (Member # 1227) on :
 
What's the point of this, though? I don't know of single system I interact with that would accept 1 billion attempts per second. It might generate the 1 billion combinations, but it can't possibly TRY them all going through the system login process.

If the person has hacked PAST the login process, they already know enough to get more than just passwords, no? I mean, they're going to stimulate a foreign system 1 billion times a second with "Do you know me?" queries and I'm somehow going to stop them?
 

---

Posted by Samprimary (Member # 8561) on :
 
The numbers are neat and it reminds everyone not to use 'hat' or 'sex' as a password
 

---

Posted by human_2.0 (Member # 6006) on :
 

quote:

---

Originally posted by MightyCow:
If the password is even fairly strong, it's much easier to get it other ways than brute force. Looking over someone's shoulder as they type it, for example.

---

The proliferation of cameras makes it MUCH easier to get peoples passwords. Heck, my laptop has a camera that is tiny. In a room full of people with laptops, I could easily point it at someone's keyboard and nobody would think twice.

If you use Windows you need to worry about keylogging utilities as well. They exist on Mac too, but there haven't been cases of them being bundled with spyware like they have been with Windows. But that doesn't mean it can't happen so no matter what platform you use, you have to be careful what you download.

The easiest way to get someone else's password is to pretend you are a server admin and ask the person for their password. I doubt anyone here would fall for it, but you would be surprised how many people would.

The numbers on that webpage refer to one specific kind of attack: an offline brute force attack of an encrypted password. Most Unix servers store system passwords in the file /etc/master.passwd, which is typically not readable by users. If a user can get root then they can read the contents of the file and take it offline (to some other computer) and try to brute force it with a utility like John the Ripper or Crack (which have legitimate uses by system admins to make sure users have uncrackable passwords). It is impossible to actually unencrypt the passwords. But it is possible to encrypt every known combination of passwords using the same encryption scheme (nearly all unix servers use the same method to encrypt passwords).

Other things to consider. Web apps will store passwords in some other form, which may be encrypted, and may not, depending on the author of the software. I've been emailed my passwords, so I know there are programers out there who are are storing cleartext passwords. If a cracker got root on one of those servers, they would have your password instantly, no matter how "strong" (strong refers to how long it takes to crack).

Finally, older operating systems have weaker passwords. Microsoft 95 passwords are crackable instantly I believe. Mac OS X 10.3 stored passwords securly for itself, but also stored a Windows version of the password which allowed the passwords to be cracked almost instantly because passwords longer than 8 characters were stored as 2 passwords (so a 9 character password becomes an 8 character password and a 1 character password). And there was no lower case. So I was blown away that what I thought were "strong" passwords were cracked by a desktop in oh, an hour or so.

Also, passwords that contain or are derivates of words are crackable faster because brute force cracking uses dictionaries. I cracked the password Sandra in 1 second on a G5 2.0 GHz desktop (which supposedly takes 33 minutes according to the chart).

And more info. Government security contractors have grids to crack passwords. And I believe there is an underground database of passwords with their encryptions. So all a cracker has to do is look up the encrypted password. A long time ago I tried to figure out how much hard disk space a database like that would take and it seemed to be too big for current hard disks. But I heard that one exists.

Also, one final bit of triva. The dogma that we should always change passwords is based on outdated technology and is no longer applicable. Before /etc/master.passwd, the passwords were stored in /etc/passwd and that file IS readable by everyone on the system. If you are using a unix based computer, try it by typing this in the terminal:

ls /etc/passwd

This is what I get:

nobody:*:-2:-2:Unprivileged User:/:/usr/bin/false
root:*:0:0:System Administrator:/var/root:/bin/sh
daemon:*:1:1:System Services:/var/root:/usr/bin/false
uucp:*:4:4:Unix to Unix Copy Protocol:/var/spool/uucp:/usr/sbin/uucico
lp:*:26:26:Printing Services:/var/spool/cups:/usr/bin/false
...

The * is where the password normally appears.

Anyway, back then, anyone could get the encrypted passwords of other users. So system admins used a chart just like what we have been looking at, and they figured that by current speeds, it would take about a month to crack passwords. So they said that everyone had to change passwords once a month as a protection.

Well, not only is the encrypted password harder to get now a days, but the computers are so fast that it is very likely that the password will be cracked long before you regularly change it. Even if you do change it in a month or so, the damage will already be done, so it is pointless.

Basically, the new dogma is that you should change it if you ever get the feeling that someone might have stolen it (if someone was watching over your shoulder while you typed it or if you used an unencrypted service like telnet or POP on an insecure network like unencrypted wireless). But you shouldn't change it often enough that you have to make it more insecure by having to write it down. Many IT departments have no idea why passwords were changed monthly so they will force user to do it anyway even though it is pointless and most likely makes the passwords more insecure by forcing users to write them on stickies hiding under keyboards.

Did I mention that security is kinda a hobby of mine?
 

---

Posted by human_2.0 (Member # 6006) on :
 
Oh, here are other things that slipped my mind.

I mentioned that if users got root they could get the /etc/master.passwd file. There are other ways. If a server is running the webserver (apache) or other web service as root, a cracker might be able to hack the service and get it to show the master.passwd file. So obtaining root isn't a prerequisite to getting the password file. In fact, usually crackers obtain the password file in an effort to get someone else's password, then they login as that person and then attack the root acount. Many systems are unpatched. An expereinced cracker (most likely a programmer) can obtain root on unpatched systems in no time if they are logged in as a legitimate user. Once they have root they install backdoors so passwords are no longer needed (which is why changing passwords once you are hacked is pointless).

This is all regarding unix servers. I don't know much about Windows servers except that the Unix server admins I know have a very low opinion of Windows servers. The Windows server admins I know are not programmers and are very intimidated by Unix.

And one last bit of triva. Mac OS X 10.3 actually showed the password hashes even if the user wasn't root. It took Apple to 10.4 before it got a clue.
 

---

Posted by Tstorm (Member # 1871) on :
 

quote:

---

The dogma that we should always change passwords is based on outdated technology and is no longer applicable.

---

quote:

---

ls /etc/passwd

---

quote:

---

Originally posted by BannaOj:
Would this actually make it safer? If the computer is looking for something with more digits and you don't have that number it seems like it would make things more difficult.

---