I work for a company which has ~16,000 employees. Periodically, our VP of IT sends out a newsletter with "tech-tips" and misc IT stuff. The topic of this week's newsletter was "password security". The introductory paragraph caught my attention:
We just decrypted all user passwords in use to see if employees are using strong passwords. We used a combination of brute force,rcracki, hashcat/oclHhashcat and john-the-ripper tools to decrypt the passwords.
This was followed by a typical newsletter discussing good password practices: Don't use dictionary words; be sure to use mixed case/symbols; don't write your password on a yellow-sticky by your monitor; etc...
Now, I'm no cryptography whiz, but I was skeptical that he claimed that they had "decrypted all user passwords". I can believe that they maybe ran all the hashes through their tools and "decrypted" a large portion of them, but is it really reasonable that they would have the computing resources to claim to have cracked them all? (BTW, is "decrypted" even correct in this context?)
I emailed him asking if he meant to say that they had run all passwords THROUGH the cracking tools, and merely found a large number of weaker ones. However he replied that, no, they had indeed decrypted ALL of the user passwords.
I can appreciate the security lesson he's trying to teach here, but my password is 8 random characters, generated by KeePass. I thought it was pretty good, it's something similar to
Q6&dt>w} (obviously that's not really it, but it's similar to that).
Are modern cracking tools really that powerful? Or is this guy probably just pulling my leg in the name of a good security lesson?
P.S. I replied to his email asking if he could tell me what the last two characters of my password were. No reply yet, but I will update if he manages to produce it!
EDIT: Some answers are discussing my particular password length. Note that not only is he claiming that they cracked MY password (which is believable if they singled me out), but that he's claiming that they did this for ALL users - and we have well over 10,000 employees!! I'm not so naive as to think that that means 10,000 good, secure passwords, but if even 1% of the users have a good password, that's still 100 good secure passwords they claim to have cracked!