4 ms·
I think brute force password crackers could be made much more efficient by using machine learning or manually written rules to exploit how people choose passwor
by TorKlingberg 10y ago
I think brute force password crackers could be made much more efficient by using machine learning or manually written rules to exploit how people choose passwords.
Even if you force users to pick a password of at least 8 characters with upper and lower case letter, numbers and special characters, I suspect the real entropy is much lower than the theoretical.
- andromeduck 10y agoThat had been done for more than a decade now.
- e12e 10y agoThere were a couple of talks about this at password^12: Like: http://passwords12.at.ifi.uio.no/Kirsi_Helkala/ http://passwords12.at.ifi.uio.no/Kirsi_Helkala/ http://passwords12.at.ifi.uio.no/Markus_Duermuth_Password_Security_and_Markov_Models/ http://passwords12.at.ifi.uio.no/Markus_Duermuth_Password_Se... But it's a whole conference about passwords... so not sure if I found the presentation I had in mind...: http://passwords12.at.ifi.uio.no/ http://passwords12.at.ifi.uio.no/ And btw, registration is now open for password^16 in Germany in December: https://passwordscon.org/ https://passwordscon.org/
- PwdRsch 10y agoSome of the latest research on this technique: Fast, Lean, and Accurate: Modeling Password Guessability Using Neural Networks https://www.ece.cmu.edu/~lbauer/papers/2016/usenixsec2016-neural-passwords.pdf https://www.ece.cmu.edu/~lbauer/papers/2016/usenixsec2016-ne...