Password-cracking contest results

On July 17, 2006, I challenged password-cracking readers to a contest. I was looking to support my conclusion that longer, less complex passwords provided more protection compared with everyday eight- to 10-character shorter, but more complex passwords.

Free IT resource TechNet: More ways to know it, share it, and keep it running. Sponsored by Microsoft Free IT resource Attend the SOA Executive Forum: Breaking SOA Bottlenecks SOAExecForum.com/may2007 Sponsored by InfoWorld

Conventional wisdom says that because end-users have 94 characters to choose from on a 101-key keyboard, breaking an eight-character, complex password -- out of 94^8 = 6,095,689,385,410,816 different possible passwords -- is not a trivial task.

I postulated that an eight-character, complex password was not so difficult to break, and that to withstand normal password cracking, you should increase password length to something beyond 10 characters. I issued a challenge in the form of three Windows NT password hashes:

#1: 0570B4C2CC734E230DE9B67C868FAE04
#2: 7B1FC86A9CD8955963E3930C42F4226F
#3: 4475BCB3B66320BF289D5475C7016A81

The first (and easiest) challenge was a 10-character password with normal complexity -- uppercase and lowercase letters, numbers, and containing two “license-plated” English words. The second, harder challenge was a 15-character password with no complexity -- one or more English words, all lowercase. The third, hardest challenge was a 15-character or longer password with minor complexity -- containing one or more English words. I offered prizes of books, column fame, and $100 for cracking one or more of the challenges.

It’s been several months now, and we have a winner. Well, a winner on the 10-character password-crack challenge. Anthony Adamo of Colorado took about three weeks to reveal the first challenge password of S10wDr1v3r. I sent Tony a copy of all three of my latest books for his efforts. After Tony claimed his prize, two other readers sent in the correct guesses for the 10-character password; one a day after Tony, and another just three weeks ago.

No one has cracked the two larger challenges as of press time, although I know there are several hundred computer teams -- one with over 1,000 computers --working on the challenges.

I did get dozens of bad guesses, and lots of people telling me I’m an idiot or that I’m wrong. If you're in the latter camp, I figure there is no better way to prove me wrong than to send me the plain-text passwords for the 15-character or longer passwords. 

I had several writers tell me that my $100 main prize wasn’t enough to motivate them, and if they just had enough monetary motivation they would do it. They said that $1,000 or $10,000 would better motivate them. In every case, I pledged in writing to give them the money they wanted, and still none of them delivered.

And yes, I’ll be keeping the 15-character complex and noncomplex password hashes in a contest for future awards. Good luck.

Does all this conclusively confirm that longer, noncomplex passwords will always win over short, more complex passwords? Of course not, but it adds at least some credibility to my conjecture that increased password length does have its place in boosting password strength.

Short, “complex” passwords cannot be relied on because you cannot (normally) guarantee complexity. Most end-users will not create a password that is very complex. Most of the world uses an eight-character or shorter complex password to protect their systems.

This is a really bad idea, and here’s why. First, if you require an eight-character-minimum password, most users will choose an eight-character password. If you require a capital letter, they will put it at the beginning because we are trained in writing class to do that. If you require a number, most users will put the number at the end, and the number will be 1 or 2.

The “complex” password will probably contain mostly letters. The first letter is normally not a vowel, but it is highly likely that several of the subsequent letters are. So my password hacking can continue by doing character replacement on the majority of the middle of the password using the five vowel characters (for English passwords). And because vowels don’t often appear three in a row, I can pull those five characters out when substituting multiple characters in a row.

Even though users have 94 characters to choose from on the keyboard, 80 percent of passwords will contain the same 32 characters and symbols -- as mentioned in my previous columns. Most passwords by English authors contain a root English word, many of which can be found in a password-cracking dictionary containing just 30,000 words.

Most men have a password that reflects their hobby, sport, or favorite sports team. You’d be surprised how often Goskins! works in Washington, D.C., and Gobulls! works in Chicago. Most women have a password having to do with a personal noun, like the names of children, boyfriends, husbands, dogs, travel location, or hobby. This may seem like sexiest speculation, but you can set up the John the Ripper and other password crackers, to successfully follow these “popularity” rules.

How many of you saw your own password described above? If your own password is not above, how likely is it that I described a fair amount of your end-users' passwords?

And that's the problem. Even if complexity is required, most user passwords aren’t all that hard to guess. Even extreme examples -- such as my first challenge password, which is longer and more complex than the average password, isn’t computationally as difficult to crack as longer passwords.

My advice? Realize that eight-character, complex passwords aren’t as tough as you think. Push for longer passwords, complex or not, to gain password strength.