Re: Password Cracking

From: DaveK (
Date: 01/22/03

From: "DaveK" <>
Date: Wed, 22 Jan 2003 05:38:19 -0000

"Lohkee" <> wrote in message
> "DaveK" <>
> wrote in message news:n3bX9.119$
> > "Lohkee" <> wrote in message
> > news:2PEW9.3154$
> >
> > ---snip---
> > >The goal, and sole justification for password cracking exercises, is to
> > >reduce risk by enforcing the use of strong passwords via the
> identification
> > >and subsequent elimination of those that are weak.
> > ---snip---
> >
> > Well, I would have said "The goal for password cracking exercises is
> > reduce risk by reducing the use of weak passwords through identifying as
> > many of them as possible". Then I would have gone on to raise all the
> good
> > points that you make about security in depth, and using lockouts and all
> the
> > other options available to you, rather than go on about the inability of
> > one single security tool to perform a task that it isn't actually meant
> > be able to do.
> The problem is that cracking passwords does not reduce risk.

  That is your assertion, but since it stands or falls by your claim that an
exhaustive brute force search is only slightly more difficult than a
dictionary attack, I am justified in claiming that cracking passwords *does*
reduce risk IF it turns out that BF is in fact MUCH MUCH MUCH harder than a
dictionary attack. We shall return to this at the end of the post and find
out whether you're right or wrong.

> > I think you misunderstand what password crackers are about. They
> > prove a password to be weak. But they cannot prove it to be strong.
> > password crackers I've seen don't make any attempt to 'categorize'
> > passwords: that's a false inference that *you* have made based on *your*
> > misunderstandings. They simply reveal the ones they can uncover, in the
> > order in which they uncover them.
> Which are by inference "weak."

  Yes, that's what I said. An easily cracked password is weak. It can be
proven weak.

  You, on the other hand, are insisting that, therefore, the passwords not
easily cracked must be regarded as strong.

  That is a logic error of the form:

   p => q therefore ~p => ~q

where p = "the password is easily cracked", q = "the password is weak". As
anyone with the least knowledge of logical reasoning will tell you, the only
valid inference you can really make here is

   p => q therefore ~q => ~p

or in other words, if a password is not weak, that implies it will not
easily be cracked.

> I would also suggest looking a some PW
> cracking vendors websites, and the verbiage they use.

  So what? Adverts are full of lies and bullshit. You really can't quote
them in the effort to sustain a logical argument. You have committed the
most elementary fallacy in the entire universe of logic. The fact that some
marketing idiot in a suit has made the same error does not suddenly
invalidate everything the human race has ever known about logical reasoning.

> > You cannot draw *any* conclusion if the password cracker fails to
> uncover
> > a password, you can only draw a conclusion when it succeeds.
> Specifically,
> > you can deduce that there is at least one setup (combinations of
> > power and dictionary wordlist size) under which the password is easily
> > cracked. However, you cannot prove a negative so easily if it fails to
> > crack the password.
> Aren't you simply repeating the point made in the paper?

  I am indeed repeating one of your points, since I don't disagree with
everything you say, but I'm not drawing the same false inferences from it
that you did.

> > ---snip---
> > The point here is that it is a given any password of eight characters or
> > less can be cracked within a very reasonable amount of time. A
> > attack might do it in nine minutes but is unpredictable. A brute force
> > attack might take nine days but is completely predictable.
> > ---snip---
> >
> > You just made those figures up, didn't you? Have you ever tried to
> a
> > *real* brute force search to completion? Here, let me give you some
> *REAL*
> > numbers rather than guesses you just pulled out of thin air:
> >
> > JtR running on a 1 Ghz athlon based machine cracking ntlm passwords
> achieves
> > about 880,000 keys tested per second.
> >
> > An 8-char password based on upper/lower case characters, numerics, and
> > symbols (let's say 95 possible chars, as you have in your other post)
> >
> > 95^8 = 6634204312890625
> >
> > 6634204312890625 / 880000 = 7538868537
> >
> > 7538868537 / (60 * 60 * 24) = 87255.4
> >
> > That's NOT nine days, that's ninety thousand days. That's five orders
> > magnitude away from nine days. You have overexaggerated the ease of a
> brute
> > force attack by a factor of roughly a hundred thousand. If you have to
> use
> > such faked statistics to make your case, I say you haven't made it.
> I have exaggerated nothing.

  Yes, you did. You said an exhaustive bf-search of an 8 char keyspace
might take nine days instead of nine minutes. That's an exaggeration of how
relatively easy it is, by a factor of about a hundred thousand, as I showed.
You haven't done any calculations or mathematics or measurements to justify
those numbers. You just made them up out of your imagination.

> In fact, I may have *understated* the case.
> You statements are driven by your equipment and *very* limited view of the
> world.

  My statements are driven by what is known as "empirical measurements".
Yours are driven by what is known as "made up bullshit". If you didn't just
invent those figures, tell us where they came from. My figures come from a
very run-of-the mill system, but now we have some figures to play with, we
can say things like "Well, we'd need to have ten thousand of these systems,
and they'd each need to be running at 10 gigs instead of one, and then we'd
be on target for nine days". You just assume that such a target is possible
and practical without even attempting to estimate the requirements that
would need to be met for it to be possible. It's not a "limited" view of
the world to only pay attention to things that really exist. Hell, there
*might* be a computer out there on an alien UFO that could do it in a
nanosecond. But it has nothing to do with our discussion. Please refer
only to real things, not imaginary ones.

> Before making such claims it would be wise to think about the
> possibilities. You might do a search on DESCHALL and see what they were
> to accomplish using much older equipment years ago.

  Woah, stop the fscking presses, 56-bit DES no longer considered
uncrackable! That would be why most modern password schemes use something
vastly more difficult to crack.

> Also, I would suspect a
> 1Ghz Athlon pales in comaprison to a system with multiple processors,

  You don't do maths any better than you do logic, do you? You can't climb
an exponential hill by linear increments. Sure, get a system with two or
four processors: it'll run not quite twice or four times as fast. You
haven't even made a dent in a factor of a hundred thousand yet, though.
Remember, we're talking about making passwords that are secure in the real
world against real threats, not against imaginary uberhackers with brains
the size of a planet. Precisely how many hackers in history so far have had
multi-thousand workstation networks devoted 100% to cracking passwords?

Answer: None.

> particularly one that is running an operating system that does not eat up
> most of the system resources. Just a guess though.

  Well, that's where you and I differ. I'm a scientist and engineer by
training, and I believe in making real world measurements of real systems,
which can then be extrapolated to theoretical systems. I test and measure.
You just make stuff up out of your imagination and assume it has to be true
because you want it to be. That's the dictionary definition of
"self-delusion", you know. What on earth is wrong with you, that you just
come up with a guess for how long a bruteforce attack ought to take based on
no evidence and no tests, and have such certainty of your own baseless
assertion that you fail to perceive the very plain mathematical facts I have
laid out for you ?


moderator of
Burn your ID card!
Help support the campaign, copy this into your .sig!
Proud Member of the Exclusive "I have been plonked by Davee because he
thinks I'm interesting" List Member #<insert number here>
Master of Many Meowing Minions
Holder of the exhalted PF Chang's Crab Wonton Award for kook spankage above
and beyond the call of hilarity.
PGP Key-ID: 0x0FB504D1 Fingerprint 04B7 2E8C 0245 680E  6484 C441 CEC7 D2BD