4 ms·

I'd really like to know if they have had any success with this. The article says they can try 4 million passwords per second, though it's not clear if that's pe

I'd really like to know if they have had any success with this. The article says they can try 4 million passwords per second, though it's not clear if that's per machine or for all 20 machines that they currently have. They also state that a six-digit password has 256^6 possible combinations, or 282 trillion. 282 trillion combinations at 4 million / second is still more than 2 years, but I'm guessing that they're smart about how they apply the algorithm since most of the characters in a password probably fall within a set of 100 more common characters. Throw 20 machines at it and get smarter about your guesses and I'm sure that gets down to maybe a few days, but what about 10 or 12 digit passwords? Just wondering if this has been at all effective.

noonespecial 17y ago
My guess is that they're actually using dictionary (or pre-generated rainbow tables with near words) attacks. Pedophiles don't tend to be the sharpest tools in the shed so I'm guessing dictionary words do the trick 90% of the time. When in doubt make your password something like j3vm#sdq-oj3ew7!d. I call it an "8 by 8" and have committed myself to memorizing a bunch of them for everyday use.
- camccann 17y ago
  Pedophiles don't tend to be the sharpest tools in the shed so I'm guessing dictionary words do the trick 90% of the time. You know, users in general don't tend to do very well at picking passwords. The great success story of educating users on password strength is that, after years of telling people to use both numbers and letters, the most popular password went from being "password" to "password1". Not to mention that it's probably unwise to assume that criminals of any sort "don't tend to be the sharpest tools in the shed". Maybe it's true, maybe not, but underestimating an adversary's competence is asking for trouble.
- NathanKP 17y ago
  Kudos to you for being able to remember an "8 by 8" password like that. I would just rely on a password key chain.
- michaelkeenan 17y ago
  Pedophiles don't tend to be the sharpest tools in the shed It feels good to say mean things about our enemies, but I find it implausible that someone's credibly found a link between pedophilia and low intelligence. (Presumably people don't admit to being pedophiles, so you can't find a random sample of them to study. You can study pedophiles who get caught, but presumably those are the least intelligent pedophiles, so you can't draw conclusions about pedophile intelligence from them. I think it's safer to assume pedophiles have a normal distribution of intelligence.)
rdtsc 17y ago
> but what about 10 or 12 digit passwords? Just wondering if this has been at all effective. Most passwords out there are very insecure because they use words that look, sound or are composed of words from dictionaries, that increases the likelihood of cracking the password quite a bit. They can essentially split the load, let some machine brute force sequentially and others perform a dictionary attack. Even better they should generate a custom dictionary by dumping the strings from any non-encrypted data from the same user. That is what I would do at least.
camccann 17y ago
I have to assume they're using some sort of extremely broad, relatively intelligent dictionary attack--a large dictionary, mixing numbers and symbols in with words, trying misspelled words using things like Levenshtein distance, phonetic spellings, etc. In other words, brute force using the sort of mnemonics and tricks that people are advised to use to help them remember a "strong" password. Password strength is a spectrum, and there's a fair difference between "strong enough to make a random criminal go find an easier target" and "strong enough to keep out a determined, funded attacker targeting you personally". Or it's possible that a lot of these suspects just used really crappy passwords. People are silly that way.
- Herring 17y ago
  They also have tools that collect strings from your HD. I can't find the source either, but this slashdot post has more details http://it.slashdot.org/comments.pl?sid=1449178&cid=30152620 http://it.slashdot.org/comments.pl?sid=1449178&cid=30152...

noonespecial 17y ago

My guess is that they're actually using dictionary (or pre-generated rainbow tables with near words) attacks. Pedophiles don't tend to be the sharpest tools in the shed so I'm guessing dictionary words do the trick 90% of the time. When in doubt make your password something like j3vm#sdq-oj3ew7!d. I call it an "8 by 8" and have committed myself to memorizing a bunch of them for everyday use.

camccann 17y ago
Pedophiles don't tend to be the sharpest tools in the shed so I'm guessing dictionary words do the trick 90% of the time. You know, users in general don't tend to do very well at picking passwords. The great success story of educating users on password strength is that, after years of telling people to use both numbers and letters, the most popular password went from being "password" to "password1". Not to mention that it's probably unwise to assume that criminals of any sort "don't tend to be the sharpest tools in the shed". Maybe it's true, maybe not, but underestimating an adversary's competence is asking for trouble.
NathanKP 17y ago
Kudos to you for being able to remember an "8 by 8" password like that. I would just rely on a password key chain.
michaelkeenan 17y ago
Pedophiles don't tend to be the sharpest tools in the shed It feels good to say mean things about our enemies, but I find it implausible that someone's credibly found a link between pedophilia and low intelligence. (Presumably people don't admit to being pedophiles, so you can't find a random sample of them to study. You can study pedophiles who get caught, but presumably those are the least intelligent pedophiles, so you can't draw conclusions about pedophile intelligence from them. I think it's safer to assume pedophiles have a normal distribution of intelligence.)

rdtsc 17y ago

> but what about 10 or 12 digit passwords? Just wondering if this has been at all effective. Most passwords out there are very insecure because they use words that look, sound or are composed of words from dictionaries, that increases the likelihood of cracking the password quite a bit. They can essentially split the load, let some machine brute force sequentially and others perform a dictionary attack. Even better they should generate a custom dictionary by dumping the strings from any non-encrypted data from the same user. That is what I would do at least.

camccann 17y ago

I have to assume they're using some sort of extremely broad, relatively intelligent dictionary attack--a large dictionary, mixing numbers and symbols in with words, trying misspelled words using things like Levenshtein distance, phonetic spellings, etc. In other words, brute force using the sort of mnemonics and tricks that people are advised to use to help them remember a "strong" password. Password strength is a spectrum, and there's a fair difference between "strong enough to make a random criminal go find an easier target" and "strong enough to keep out a determined, funded attacker targeting you personally". Or it's possible that a lot of these suspects just used really crappy passwords. People are silly that way.

Herring 17y ago
They also have tools that collect strings from your HD. I can't find the source either, but this slashdot post has more details http://it.slashdot.org/comments.pl?sid=1449178&cid=30152620 http://it.slashdot.org/comments.pl?sid=1449178&cid=30152...