9 ms·
Using Ordered Markov Chains and User Information to Speed Up Password Cracking
- Faizann20 10y agoApologies guys. The link will be up within a few minutes.
- Faizann20 10y agoHere's the updated and live link. https://medium.com/@faizann20/using-ordered-markov-chains-and-user-information-to-speed-up-password-cracking-d8b2718a502e https://medium.com/@faizann20/using-ordered-markov-chains-an...
- matrix2596 10y agoNice idea! Can anyone point the data. May be we can try RNN to generate the passwords.
- Faizann20 10y agoYes, we definitely can. The reason I didn't do this was because I did not have enough cpu/gpu power. The results will be better if RNN is applied.
- matrix2596 10y agoi have a gpu. may be i can help. let me know or point me where the whole data is available. thanks
- Faizann20 10y agoThe link is given.
- Faizann20 10y agoHere's the data. https://muslimmatch.thecthulhu.com/ https://muslimmatch.thecthulhu.com/
- matrix2596 10y agothanks
- gwern 10y agoMarkov chains can do amazing things in password cracking: https://arstechnica.com/security/2013/05/how-crackers-make-minced-meat-out-of-your-passwords/ https://arstechnica.com/security/2013/05/how-crackers-make-m... But an RNN isn't necessarily going to help as much as you think. An RNN has two problems compared to a Markov chain: 1. Markov chains memorize strings very very easily, accurately, and scalably; it's easy to memorize phrases, words, suffixes, and prefixes from the existing corpuses of billions of passwords. That's all a Markov chain does, memorize & count. On the other hand, an RNN will struggle to do so because there's no 'place' for it to put all of that, everything has to be encoded into the fixed set of neural net weights, otherwise, it just doesn't know about it; and the more you ask it to learn, the more the competing demands fight each other. RNNs augmented with external memories might help fix this but are still cutting edge research. 2. Markov chains are also very fast, far faster than an RNN. Multiple orders of magnitude difference are possible, unless you use a RNN so small as to be irrelevant (since then it can't memorize anything). For cracking hashes, a small gain in plausibility of guesses is not worth being able to make hundreds or thousands times fewer guesses (unless perhaps the hash are something proper like bcrypt/scrypt where it takes seconds to check, in which case the guessing phase takes up a much smaller fraction of runtime and better guesses may be worthwhile).
- mattcoles 10y agoSeems like randomly generated passwords kept in a password manager are the way to go then, too much risk in letting our personal details bias password choices.
- deleted 10y ago[deleted]
- throwaway729 10y agoBut single point of failure and also clipboard attacks! :(
- mattcoles 10y agoClipboard attacks are definitely concerning but with 2FA you can mitigate it being a single point of failure to some extent.
- jwilk 10y agoWhat do you mean by "clipboard attack"?
- xeroaura 10y agoFor sites/apps that can't fetch the password themselves, people usually copy paste the password. This could allow other sites/apps that have access to the clipboard to see the password.
- geezk7 10y agoAnother way is to use probabilistic graphical models. The paper "Personalized password guessing: A new security threat" addressed this threat several years ago. https://experts.illinois.edu/en/publications/personalized-password-guessing-a-new-security-threat https://experts.illinois.edu/en/publications/personalized-pa...
- gravypod 10y agoCan we make a characteristic scoring metric to help order password cracking attempts? Is there a standard distribution of characters in passwords that can be analyzed?
- Etheryte 10y agoEvery password guessing optimization is about finding logically linked character distributions in passwords.
- gravypod 10y agoI still think wordlists are the easiest generic way of brute forcing passwords en-masse since most people still don't use password generators or aren't as uniuque as they think they are. Sorting wordlists by some kind of metric should improve performance.
- ultrahate 10y agoIs there precedent that shows that adding restrictions to passwords is dangerous? For example, I use a multi word password for most things, and sometimes it makes me add uppercase or numbers. The average persons password transform just based on that information is probably vulnerable to a sophisticated attack. If I knew a certain site required a certain schema, I could more accurately guess how a user would change their password based on those requirements.