Monday, October 26, 2020
Home Industry News A computer can guess more than 100,000,000,000 passwords per second. Still think...

A computer can guess more than 100,000,000,000 passwords per second. Still think yours is secure?

Passwords have been used for thousands of years as a means of identifying ourselves to others and in more recent times, to computers. It’s a simple concept – a shared piece of information, kept secret between individuals and used to “prove” identity.

Passwords in an IT context emerged in the 1960s with mainframe computers – large centrally operated computers with remote “terminals” for user access. They’re now used for everything from the PIN we enter at an ATM, to logging in to our computers and various websites.

But why do we need to “prove” our identity to the systems we access? And why are passwords so hard to get right?


Read more: Airports, ATMs, hospitals: Microsoft Windows XP leak would be less of an issue, if so many didn’t use it


What makes a good password?

Until relatively recently, a good password might have been a word or phrase of as little as six to eight characters. But we now have minimum length guidelines. This is because of “entropy”.

When talking about passwords, entropy is the measure of predictability. The maths behind this isn’t complex, but let’s examine it with an even simpler measure: the number of possible passwords, sometimes referred to as the “password space”.

If a one-character password only contains one lowercase letter, there are only 26 possible passwords (“a” to “z”). By including uppercase letters, we increase our password space to 52 potential passwords.

The password space continues to expand as the length is increased and other character types are added.

Making a password longer or more complex greatly increases the potential ‘password space’. More password space means a more secure password.

Looking at the above figures, it’s easy to understand why we’re encouraged to use long passwords with upper and lowercase letters, numbers and symbols. The more complex the password, the more attempts needed to guess it.

However, the problem with depending on password complexity is that computers are highly efficient at repeating tasks – including guessing passwords.

Last year, a record was set for a computer trying to generate every conceivable password. It achieved a rate faster than 100,000,000,000 guesses per second.

By leveraging this computing power, cyber criminals can hack into systems by bombarding them with as many password combinations as possible, in a process called brute force attacks.

And with cloud-based technology, guessing an eight-character password can be achieved in as little as 12 minutes and cost as little as US$25.

Also, because passwords are almost always used to give access to sensitive data or important systems, this motivates cyber criminals to actively seek them out. It also drives a lucrative online market selling passwords, some of which come with email addresses and/or usernames.

You can purchase almost 600 million passwords online for just AU$14!

How are passwords stored on websites?

Website passwords are usually stored in a protected manner using a mathematical algorithm called hashing. A hashed password is unrecognisable and can’t be turned back into the password (an irreversible process).

When you try to login, the password you enter is hashed using the same process and compared to the version stored on the site. This process is repeated each time you login.

For example, the password “Pa$$w0rd” is given the value “02726d40f378e716981c4321d60ba3a325ed6a4c” when calculated using the SHA1 hashing algorithm. Try it yourself.

When faced with a file full of hashed passwords, a brute force attack can be used, trying every combination of characters for a range of password lengths. This has become such common practice that there are websites that list common passwords alongside their (calculated) hashed value. You can simply search for the hash to reveal the corresponding password.

This screenshot of a Google search result for the SHA hashed password value ‘02726d40f378e716981c4321d60ba3a325ed6a4c’ reveals the original password: ‘Pa$$w0rd’.

The theft and selling of passwords lists is now so common, a dedicated website — haveibeenpwned.com — is available to help users check if their accounts are “in the wild”. This has grown to include more than 10 billion account details.

If your email address is listed on this site you should definitely change the detected password, as well as on any other sites for which you use the same credentials.


Read more: Phishing with Worms — The Greatest Password Theft I’ve Ever Seen


Is more complexity the solution?

You would think with so many password breaches occurring daily, we would have improved our password selection practices. Unfortunately, last year’s annual SplashData password survey has shown little change over five years.

The 2019 annual SplashData password survey revealed the most common passwords from 2015 to 2019.

As computing capabilities increase, the solution would appear to be increased complexity. But as humans, we are not skilled at (nor motivated to) remember highly complex passwords.

We’ve also passed the point where we use only two or three systems needing a password. It’s now common to access numerous sites, with each requiring a password (often of varying length and complexity). A recent survey suggests there are, on average, 70-80 passwords per person.

The good news is there are tools to address these issues. Most computers now support password storage in either the operating system or the web browser, usually with the option to share stored information across multiple devices.

Examples include Apple’s iCloud Keychain and the ability to save passwords in Internet Explorer, Chrome and Firefox (although less reliable).

Password managers such as KeePassXC can help users generate long, complex passwords and store them in a secure location for when they’re needed.

While this location still needs to be protected (usually with a long “master password”), using a password manager lets you have a unique, complex password for every website you visit.

This won’t prevent a password from being stolen from a vulnerable website. But if it is stolen, you won’t have to worry about changing the same password on all your other sites.

There are of course vulnerabilities in these solutions too, but perhaps that’s a story for another day.

• Brianna O’Shea is a Lecturer in Ethical Hacking and Defense at Edith Cowan University. Co-writer Paul Haskell-Dowland is Associate Dean (Computing and Security) at Edith Cowan University. This article originally appeared at TheConversation. 

Brianna O Shea
Brianna O Shea
Brianna O’Shea is a Lecturer in Ethical Hacking and Defense, Computing and Security, within the School of Science. She is a PhD Candidate at the Tasmanian Institute of Law Enforcement Studies at the University of Tasmania.

What do you think?

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Stay Connected

Join Our Newsletter

Must Read

Neuronlike circuits bring brainlike computers a step closer

For the first time, my colleagues and I have built a single electronic device that is capable of copying the functions of neuron cells in a brain. We...

How algorithms run the world behind the scenes

The world of computing is full of buzzwords: AI, supercomputers, machine learning, the cloud, quantum computing and more. One word in particular is used...

How the needs of monks and empire builders helped mold the modern-day office

The coronavirus pandemic has forced most people to create an office space of their own – whether by devoting a room in our homes...

Could Schrödinger’s cat exist in real life? Our research may soon provide the answer

Have you ever been in more than one place at the same time? If you’re much bigger than an atom, the answer will be...

Related News

Neuronlike circuits bring brainlike computers a step closer

For the first time, my colleagues and I have built a single electronic device that is capable of copying the functions of neuron cells in a brain. We...

How algorithms run the world behind the scenes

The world of computing is full of buzzwords: AI, supercomputers, machine learning, the cloud, quantum computing and more. One word in particular is used...

How the needs of monks and empire builders helped mold the modern-day office

The coronavirus pandemic has forced most people to create an office space of their own – whether by devoting a room in our homes...

Could Schrödinger’s cat exist in real life? Our research may soon provide the answer

Have you ever been in more than one place at the same time? If you’re much bigger than an atom, the answer will be...

The fourth agricultural revolution is coming – but who will really benefit?

Depending on who you listen to, artificial intelligence may either free us from monotonous labour and unleash huge productivity gains, or create a dystopia...