Q: How can hackers try millions of passwords at a time when I will get locked out after three failed attempts?
Passwords continue to be the primary target of cybercriminals because they represent the “keys to your kingdom,” especially when it comes to your email account.
Online security tools such as Gibson Research’s Haystack tool show you just how quickly any short password can be cracked, but it’s based on billions and trillions of guesses per second.
Tools such as this are showing how fast a “brute force” attack can break shorter passwords, which typically will occur offline.
Offline password cracking
Your question is a common one because most people assume that password hacking is done through the same interface as we all use to log into our accounts, but that’s not the typical approach.
All of the websites that require you to enter a password store those passwords using some form of what’s known as “hashing.” This means that your password is converted into a random string of characters that looks nothing like your actual password before it gets stored on their servers.
As an example, the common password “monkey” in MD5 Hashing will always be stored as “d0763edaa9d9bd2a9516280e9044d885,” which is child’s play for a computer to convert back to the original word.
Most offline cracking activity begins after a breach has occurred and the database of “hashed” passwords are stolen and saved elsewhere to be worked on.
Think of it as a bank robber stealing the vault and cracking it somewhere else vs. trying to crack open the vault at the bank itself.
Brute force attacks are essentially a guessing game that pits computing power against the length of your password, which is why creating a longer password is always better.
It’s simple math as every combination of letters, numbers and special characters can be tried in milliseconds if there is enough computing power available.
In the Haystack tool, you will see that any eight-character password can be broken in just over one minute.
As you add additional characters, the time to crack them goes up because each additional character exponentially increases the number of guesses required.
Given enough time, all passwords can be cracked, so what you want to do is create long enough passwords that aren’t worth the time to crack.
Other password cracking techniques
Brute force is just one of many methods hackers use to crack passwords, which is why it’s so important to use a different long password for each of your online accounts.
There are “Dictionary attacks,” which use every word and any combination of those words that can be found in a dictionary.
“Rainbow table attacks” use a form of known password databases because they’ve pre-computed all of the possible password combinations for all of the most common hashing techniques in one big table. This greatly reduces the time it takes to crack a password because it becomes a simple lookup exercise.
Although these attacks have been around since the beginning, sophisticated phishing and social engineering schemes are a faster way to get real passwords that can be exploited, which is why they continue to grow and evolve.
Ken Colburn is founder and CEO of Data Doctors Computer Services. Ask any tech question on Facebook or Twitter.
