Generating strong passwords and using a using a password manager are two practices that let any user notably improve their security profile. There are also resources like two-step verification, hardware solutions (e.g., YubiKey) and biometrics, but passwords still rule the world, and the interest in cracking them hasn't gone away. The PassGAN project from 2017 explores the possibility of cracking passwords with artificial intelligence but in recent weeks many sites have presented it as “a new threat”. How true is this?
Security is annoying, or at least that's what most users feel. That feeling leads them to make mistakes like reusing the same password across multiple services, “walking the keyboard” (e.g., qwertyuiop or asdfghjkl), using only digits or birth dates, and more. That's why when it comes to cracking a WiFi network password, the attacker often gets lucky trying very basic passwords, but what about the rest?
In the early days of April, Home Security Heroes portal published an article exploring the virtues of a password cracker based on artificial intelligence called PassGAN. The article indicates that a password based on eight characters combining lowercase letters and numbers can be “solved” by PassGAN in 19 minutes, or 48 minutes if we add uppercase letters. Including symbols in the password makes the clock jump to seven hours.
PassGAN: Artificial Intelligence vs. Passwords
As Home Security Heroes reveals, these numbers are not that impressive.
The great difference of PassGAN is that it does not use any of the conventional methods for cracking passwords like Markov attacks, masks, wordlists (with or without special rules) or combination attacks. In very relaxed terms, with PassGAN we are using a generative adversarial network to try to guess passwords. So, what's the problem?
That this time, enthusiasm got out of control. PassGAN's numbers are nothing surprising when compared with existing methods, and in some cases, they are inferior. At the same time, Home Security Heroes trained PassGAN with 15.68 million passwords extracted from the RockYou leak, which has been available for years. In short, the only special thing about PassGAN is its technology, but if you're thinking about cracking passwords, there are very good tools available right now.
PassGAN repository on GitHub: Click here
Sources: Ars Technica, Home Security Heroes
