Password-cracking contest results

Short, “complex” passwords cannot be relied on because you cannot (normally) guarantee complexity. Most end-users will not create a password that is very complex. Most of the world uses an eight-character or shorter complex password to protect their systems.

This is a really bad idea, and here’s why. First, if you require an eight-character-minimum password, most users will choose an eight-character password. If you require a capital letter, they will put it at the beginning because we are trained in writing class to do that. If you require a number, most users will put the number at the end, and the number will be 1 or 2.

The “complex” password will probably contain mostly letters. The first letter is normally not a vowel, but it is highly likely that several of the subsequent letters are. So my password hacking can continue by doing character replacement on the majority of the middle of the password using the five vowel characters (for English passwords). And because vowels don’t often appear three in a row, I can pull those five characters out when substituting multiple characters in a row.

Even though users have 94 characters to choose from on the keyboard, 80 percent of passwords will contain the same 32 characters and symbols -- as mentioned in my previous columns. Most passwords by English authors contain a root English word, many of which can be found in a password-cracking dictionary containing just 30,000 words.

Most men have a password that reflects their hobby, sport, or favorite sports team. You’d be surprised how often Goskins! works in Washington, D.C., and Gobulls! works in Chicago. Most women have a password having to do with a personal noun, like the names of children, boyfriends, husbands, dogs, travel location, or hobby. This may seem like sexiest speculation, but you can set up the John the Ripper and other password crackers, to successfully follow these “popularity” rules.

How many of you saw your own password described above? If your own password is not above, how likely is it that I described a fair amount of your end-users' passwords?

And that's the problem. Even if complexity is required, most user passwords aren’t all that hard to guess. Even extreme examples -- such as my first challenge password, which is longer and more complex than the average password, isn’t computationally as difficult to crack as longer passwords.

My advice? Realize that eight-character, complex passwords aren’t as tough as you think. Push for longer passwords, complex or not, to gain password strength.