Skip to main content

Harden Up: Can We Break Your Password With Our GPUs?

Need A Locksmith?

Locking your keys in the car is never fun. The last time that happened, I spent the better part of my day waiting for a locksmith. Happily, I can say that's one of those mistakes that I only made once; I haven't lost sight of my keys since.

The funny thing is that, for all of my deliberate effort, I simply cannot keep track of my digital keys (passwords) when I sit down at a computer. There are just so many of them, and we're trained to not use the same one on every site. Physical keys are just easier to keep track of. Even when you lose them, they're still somewhere. It's all a matter of retracing your steps. Besides, at least there are specialists (like locksmiths) to help lower that security barrier, if you really need them.

That's also true when it comes to passwords, at least to a certain extent. Whether it's your email or bank account, online password recovery is generally a painless process. There's usually some sort of a "Forgot Your Password?" link that allows you to reclaim access. However, the prospects for digital files are usually more forlorn. I recently discovered this while I was trying to access an old encrypted WinZip archive.

Before we dive too deep into password recovery, we should point out that there are many ways to protect your data. If you're looking for a more comprehensive solution, we would suggest something like TrueCrypt (check out Protect Your Data! TrueCrypt 7.0a's Performance, Analyzed), which is even more attractive now that it supports AES-NI instructions. Yet, archive encryption remains the most ubiquitous way to secure data. Whether you're someone in HR emailing the weekly payroll or Blake Lively trying to keep those personal iPhone photos a little more personal, encrypting an archive is fast and easy.

There is, however, a bit of a misunderstanding on just how secure your data can really be. If you're paranoid about security, you're naturally going to favor the strongest encryption scheme possible. The presumption is that a stronger encryption scheme is more difficult to break, suggesting that AES-256 is better than AES-128. That's not the whole truth. Think of encryption like a big vault. The thicker the armor, the harder it is to penetrate the safe. However, the security of a vault is only as good as the lock that secures it. That is what a password does. It's the vault's key. The longer your password, the more complicated the lock and the more secure your data is.

Most people assume that an eight-character-long password is good enough to keep hackers at bay. That's not exactly true either, and we're about to show you why.

  • jeff77789
    "While it would take a longer time to find a password made up of nine or 10 passwords, it's definitely doable between a few gaming buddies. "


    9 or 10 characters?
    Reply
  • jj463rd
    How about adding some extended ASCII codes to a password.
    Reply
  • ryandsouza
    "Think of this as generating every single combination of numbers that can be used to solve that same Sodoku puzzle, starting from an all zeros all the way through all nines. "

    Sudoku puzzles have numbers from 1 through 9!
    Reply
  • rpmrush
    This reminds me of Bitcoin GPU crunching. 6990s are favored right now. I wonder how many were sold specifically to Bitcoin miners? I tried it with my dual 6850s but the heat was rediculous. I didn't like the stress on my hardware so I gave up mining. I'm sure it's the same with password software. Maxing out your GPUs. Great for Winter, not Summer!
    Reply
  • mediv42
    I've always wondered about this: why don't they just code a delay into the decryption program, so you can't check a billion passwords a second?
    Reply
  • joshyboy82
    I like the scale, but in your small example (a,b,c) you were right and wrong at the same time. Based on your configuration 6 possibilities are correct, but because you tell someone that they can use A or B or C in the password doesn't stop them from choosing aaa, therefor the combination is 9, not 6. Otherwise, interesting article.
    Reply
  • acku
    9515787 said:
    "Think of this as generating every single combination of numbers that can be used to solve that same Sodoku puzzle, starting from an all zeros all the way through all nines. "

    Sudoku puzzles have numbers from 1 through 9!

    Fixed! Sorry. I usually play Sudoku variants. :)


    9515790 said:
    I like the scale, but in your small example (a,b,c) you were right and wrong at the same time. Based on your configuration 6 possibilities are correct, but because you tell someone that they can use A or B or C in the password doesn't stop them from choosing aaa, therefor the combination is 9, not 6. Otherwise, interesting article.

    I could understand that, but I left out that since I was trying to show a simple example of how permutations differ from combinations. As you pointed out, repetitions are allowed in passwords. I actually mention that in the sentence that follows in the next paragraph.
    Reply
  • webdev511
    Password Haystacks Yes Steve Gibson has already covered something like this. Passphrases with upper lower number and speical are the way to go. Yes, please avoid shortcuts.
    Reply
  • acku
    9515789 said:
    I've always wondered about this: why don't they just code a delay into the decryption program, so you can't check a billion passwords a second?

    It wouldn't be easy from a design standpoint, cause now you're talking about fiddling with the design of the program.

    The easiest way to slow down the verification portion of the password authentication process is increasing the number of transformation invocations for key generation. The problem is that this slows down the performance of your machine, even if you have the correct password.

    jj463rdHow about adding some extended ASCII codes to a password.
    That assumes WinZip and WinRAR supports them. To be honest, I haven't looked into that. Though, I'm inclined to believe that neither program supports them.
    Reply
  • shin0bi272
    the tables in this review are horrible... they go from lengths of time to number of passwords and theres no discernible notation when they do.
    Reply