Posted by Seth on July 24th, 2006
At my last Linux User Group meeting we had a cool discussion on passwords and what makes them strong. It was sort of divided in that some thought that complexity was more important than length or vice versa. I did a little research on my own and I basically came up with the fact that length is much stronger when it comes to straight on brute force attacks and complexity works well against dictionary style attacks.
For a word list, I concocted a 500,000 word file with words from the dictionary, common slang, computer jargon, names, and common passwords. I first did a battery of tests for dictionary attacks with a few different passwords ranging from simple to complex. The password was just ‘password’ and was broken in 32 seconds. The second was ‘passw0rd’ and was broken in 47 seconds. I then used ‘my password’ with the space and it was not broken even though the words ‘my’ and ‘password’ were in the word file. It must have something to do with the algorithm with John the Ripper. The password ‘password77’ was broken in just under 3 minutes. The following were not broken with the dictionary attack; ‘passw0rd77’, ‘bjktkrqf78’, and ‘blu3sho3s’.
After using the dictionary I used a brute force approach using passwords with 8 to 11 characters. I also told the password cracker that the password was 8-11 characters to make it easier to crack. The password ‘passw0rd’ was broken in 26 seconds; ‘password77’ was broken in just under 15 minutes; ‘passw0rd77’ was broken in 54 minutes. The passwords ‘my password’, ‘my passw0rd’, and ‘blu3sho3s’ were not broken.
These are not all the passwords I tried but are the most interesting in my opinion. I though it was funny that ‘my password’ was never broken even though both words were in the wordlist and I let the brute force attack go for almost 2 weeks.
Password crackers are pretty much garbage tools except for a few cases. As long as your password has a few numbers and maybe special characters like ‘$@#$’ and is longer than 8 characters you should be fine. Also remember to change it every few weeks especially your main email account as most accounts will let you request your login information to the email address on file so this is the most important password.
/*The password cracker used was John the Ripper and the hash was a 128bit MD5 hash. Testing was done on the same box this is hosted on with is a 3Ghz P4 with 1GB of memory.*/
Linux, Interesting | 1 Comment »