The case against passwords has never been stronger.

While easily guessed passwords have made media headlines, today's password-cracking systems can make short work of passwords, even those created using seemingly complex mnemonic devices. Current cracking techniques, fueled by cheap parallel computation using off-the-shelf graphic processors, can guess trillions of combinations every hour.

The hashed password list stolen from global intelligence service Stratfor's website, for example, contained more than 630,000 passwords randomly generated by the site and consisting of eight alphanumeric characters. Cracking efforts took less than 24 hours to completely recover that portion of the 815,000 hashes in the stolen file, in part because the company had not added a random seed to the hashing algorithm known as "salt," says Steve Thomas, president of PwnedList, a subsidiary of InfoArmor that tracks compromised accounts.

"It has never been easier," Thomas says. "Being able to do 23 billion password possibilities every second ... when you get a dump of hashes, you can very quickly get most, or maybe even all, cracked in a number of hours."

During the past half-decade, three factors have fueled a renaissance in password cracking. While password-recovery programs have gained immense computational power by offloading the intensive calculations of dictionary-based and brute-force guessing to off-the-shelf graphics processors, users continue to use the same mnemonics to create passwords that seem secure while being easily memorized. Yet the insecurity of websites -- from LinkedIn to Stratfor and from RockYou to Sony -- has given researchers real-world lists of millions of hashes from which to uncover the systems that people use to create their passwords.

The result is that, at the same time that the power of cracking programs has skyrocketed, researchers are smarter at guessing the ways that users might create passwords, whittling down the lists of possible passwords. By creating better word lists and more intelligent methods of mangling real words and phrases, hackers and researchers can make an untenable computational problem much more feasible, said Olga Koksharova, spokeswoman for password-recovery firm ElcomSoft, in an e-mail interview.

... Read full story on Dark Reading


Post a comment to the original version of this story on Dark Reading