4

The below table is making its way around linkedin and I've seen similar before.

Assuming this table is accurate enough I'd like to understand the economics of cracking the passwords.

For example, if an organisation has stolen a database of 20000 record what would it cost them to get the passwords out. I initially thought time would be a good metric but thinking about it I realised that this would be easy to run in parallel.

So what I would like to know is for a table like below what is the assumed computing power required to run this crack. Is there a spec I can reference a specific GPU or server spec. From that the cost could be calculated and a likely stop point worked out where a hacker would not bother going further.

Table of times to break a password

4
  • 1
    What's the source of the image? Whenever citing something, always make sure to include where you grabbed it from.
    – schroeder
    Commented Jan 29, 2022 at 14:58
  • 1
    So, this image is from Hive compiled from howsecureismypassword.net which is now run by security.org/how-secure-is-my-password. You can simply ask them what computational power they assumed.
    – schroeder
    Commented Jan 29, 2022 at 15:03
  • @schroeder: The link you provided gives numbers from this table ;-)
    – mentallurg
    Commented Jan 29, 2022 at 17:52
  • @mentallurg ... yes, the link is the source
    – schroeder
    Commented Jan 29, 2022 at 20:28

1 Answer 1

4

It is not clear what assumptions the authors of this table made.

Suppose administrators of the system have chosen such hashing parameters that computing of a single hash takes 1s on a single Core of a usual 3GHz CPU.

How much time is needed to brute-force a password that consists of 5 characters (digits, upper and lower case letters)? There are 625 = 916 132 832 passwords possible. It means, with a single Core one would need 916 132 832 seconds for brute-forcing. With a 12-Core CPU, one would need 76 344 403 seconds = 884 days = 2.5 years. Even if the attacker uses a GPU that is 10 000 times faster than this CPU, it would take 7634 seconds = 2.1 hours to brute-force it. This is far from the "immediately" statement in the table.

For a 10-char password, it would take 8 x 1017 seconds = 2 217 834 025 years on a 12-Core CPU or 221 783 years on a 10 000 times faster GPU. Compare it to the table that says it would need 7 months only. Obviously, some other assumptions were used for this table.

What if MD5 or SHA-256 is used for hashing? Some GPUs can compute 1011 such hashes per second. Then brute-forcing of 10-char password would take 8 x 106 seconds = 93 days. This has the same order of magnitude as the data in the table. But this just confirms that this table is applicable for cases when insecure hashing methods are used.

It is impossible to define a rule for password length when brute-forcing makes sense. If knowing the password gives the attacker 5 USD, but brute-forcing costs 10 USD, then obviously even a weak password will be sufficient, and brute-forcing will make no sense. If knowing a password gives 1 000 000 USD, and costs for brute-forcing are 900 000 USD, then brute-forcing obviously makes sense and an even longer password might be insufficient. You should calculate the costs for your specific case.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .