Dan Goodin’s Ars piece on the state of password security is a must-read overview of the way that the password cracking landscape has changed in surprising ways. It’s not just that computers have gotten faster — it’s the confluence of several factors, including: more sites that require passwords, which encourages password re-use; sites that use weak password hashing, unsalted hashing, or no hashing at all; and titanic dumps of real-world passwords that provide insight into how users choose their passwords. Put them all together and you get a situation like the LinkedIn dump, where 90 percent of the encrypted passwords were extracted in short order — and where many of those passwords could be used to take over other user accounts, thanks to password re-use.
The RockYou dump was a watershed moment, but it turned out to be only the start of what’s become a much larger cracking phenomenon. By putting 14 million of the most common passwords into the public domain, it allowed people attacking cryptographically protected password leaks to almost instantaneously crack the weakest passwords. That made it possible to devote more resources to cracking the stronger ones.
Within days of the Gawker breach, for instance, a large percentage of the password hashes had been converted to plaintext, a feat that gave crackers an even larger corpus of real-world passwords to inform future attacks. That collective body of passwords has only snowballed since then, and it grows ever larger with each passing breach. Just six days after the leak of 6.5 million LinkedIn password hashes in June, more than 90 percent of them were cracked. In the past year alone, Redman said, more than 100 million passwords have been published online, either in plaintext or in ciphertext that can be readily cracked.
“Now, it’s like once a quarter you get another RockYou,” Redman said.
In the RockYou aftermath, everything changed. Gone were word lists compiled from Webster’s and other dictionaries that were then modified in hopes of mimicking the words people actually used to access their e-mail and other online services. In their place went a single collection of letters, numbers, and symbols—including everything from pet names to cartoon characters—that would seed future password attacks.
“So it’s no longer this theoretical word list of Klingon planets and stuff like that,” Redman said of the RockYou list. “It’s literally ‘dragon’ and ‘princess’ and stuff like that, and [the list] may crack 60 percent of a newly compromised website. Now you have 60 percent of the work done and you haven’t done any thinking at all. You’ve just used your previous knowledge.”
I wrote a novella about where all this stuff ends up, called Knights of the Rainbow Table, for Intel’s Tomorrow Project. I don’t believe sf writers predict the future, but I sure feel like that one predicted the present.
Why passwords have never been weaker—and crackers have never been stronger