Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I was wondering about the following:
If someone tries to get my password with Brute Force, will a password starting with "a" guessed faster than one starting with "z" ? In this case assume the password is not salted, just hashed.
Does a Brute Force attack start with "a", try and then go on or compute all hashes first and then see if any matches?
I would say yes. Not in any meaningful way (do not base you passwords on this), but still.
First of all, if you follow this rule, your password contains a 'z' instead of an 'a'. The letter 'a' occurs a lot more frequently in English text than the letter 'z' (this is also true for the beginning of a word), and as such it will be part of words in a wordlist more frequently. Also, many cracking mechanisms (such as John the Rippers Incremental mode) will probably crack a password containing an 'a' instead of a 'z' quicker. This is only a side-effect of your rule, but it is still relevant. And it does make it more probable that passwords starting with an 'a' are cracked than passwords starting with a 'z'.
Lets say that the cracker did all the common stuff first: wordlists, etc. They where not successfull. Now they might actually try passwords systematically (note that this will generally be the very last thing they try). Starting with a,b,...,z,aa,ab,... and so on. In this case, passwords starting with a would be cracked sooner. But it is highly unlikely that the attacker would just stop at azzz and not try bzzz,...zzzz as well. It would just take a bit longer
Again, this is not in any way actually meaningful. I would say that it does have an effect, but this effect can be neglected in the real world.
No, an attacker will not first compute all hashes (all hashes is a pretty big group), and compare them only at the end. They will compute one hash, compare it, compute another hash, compare it, and so on.
In general, attackers are adaptive. They know what people think. If users tend to begin their passwords with 'z' then attackers will start their brute force with that letter.
Any specific strategy, such as choosing a 'z' as first letter, may give you an edge over the attacker only as long as the attacker does not know it; so talking about it on a public Q&A site is not the smartest move ever. Moreover, attackers always have the option to try passwords in a random order, which ensures a non-worst case for the attacker. When there are N equiprobable passwords, the average cost for the attacker is N/2 tries, and by trying the passwords in a random order, the attacker achieve that cost regardless of your choosing strategy.
The important point is that password protection is stochastic. For any specific password instance, an attacker can get lucky; he can also be especially unlucky. We thus analyse password resistance based on the password generation process, not based on a specific password instance: the generation process tells us what will be the average success rate of the attacker. "Average" is the crucial word.
Take note, too, that probabilities rule your life: whenever you get out of your home, you are taking the probabilistic bet that you will not be struck by lightning or bitten by an rampaging Rottweiler. You accept this because you instinctively perform a cost/benefit analysis and consider that such events are sufficiently improbable that they don't outweigh the benefits of being able to walk outside.
That concept just applies to passwords as well: you will rely on your password generation process having sufficiently high entropy, i.e. making attacker's success rate sufficiently low, that attackers will not even try (or won't succeed with high enough probability). In that sense, "aaaaaaaa" is not stronger or weaker than "zzzzzzzz", as long as the method you use to generate your password can produce both with equal probabilities. The strength of a password is not in what it is, but in what it could have been.
First, most tools/websites like "HowSecureIsMyPassword" do not only consider bruteforce attacks but also dictionary and rainbow attacks, as well as simple rules such as password length, character pool, use of words, etc. Hence passwords like aaaaaaa and ZZZZZZZ, will most of the time be evaluated the same way.
To the best of my knowledge, there is no "common" method of starting a bruteforce sequence apart from the simple a to ZZZZZZ (chosen to illustrate a point and not particular words/strings).
Answering your last question rises more questions: how "fast" is the bruteforce process (also depending on many things), what do you understand by "difference to calculate". In particular you can calculate the total pool of passwords and make some evaluation form there.
About the 144 quadrillion bruteforce for 1 year, I could say that this number also depends on quite a lot of factors. First, can we run unlimited bruteforce attempts? If we are submitting to a form which computes the hash, this will significantly reduce the "speed". If we are (offline/online) bruteforcing a hash, then we are talking about larger pools (128/256/512/1024 bits hashes). Second, looking into more practical aspect, is the password that "valuable" to spend 1 year on it and will it be relevant after that period.
Only depends on how well written the software is. Poorly written which starting at "a" then yes more secure.
Otherwise, parallel programming (Of course this can be programmed differently and optimised by compiler etc).
Let's not other complicate it and keep it simple and say that each core has same amount of data to process and there are no other processes going to be used by Core 0 and 1.
Reason it works down is incase Core 0 is doing work faster than Core 1 so, it can take over next processing before moving on.
So, your question should be against a software been used for brute forcing really.
Entropy matters more than starting letter. A competent brute force attack should sort guesses by frequency of use rather than alphabetically. If they are foolish and go alphabetically, then there would be an advantage, but if your passwords is zebra and my password is a#4difk*, your password is going to be guessed FAR sooner as a frequency based word list will guess zebra relatively early but will not guess my password until it starts trying every possible combination.
Even if your password is zf894SZD, it would be hard to tell which would be reached first because different crackers will use different approaches to making guesses. For truly random, they may actually decide to flip things on their head and go with least common letter choices first assuming that someone may have thought they would be extra smart instead of going truly random. You really can't tell.
The best password is one that is actually high entropy, which means there is no system an attacker could happen to match. It is simply a large amount of random data that has no quick path to guessing it because there is no pattern at all.
Given two options A**** and Z****, you can't know how the attacker works, from A to Z or from Z to A. He might even start from the end of the word: ****A or ****Z. If you want to be sure about this, add an extra character to your password, and then maybe M is the more safe choice, safe in the middle.
You cannot depend on one single character for your security. If that is the case, or if that is your concern, add one more. If you don't, remove one character when calculating the strength of it.
Brute force is an approach not a specific program. Brute force has as its goal to cover all possible passwords, but how the algorithm is implemented is specific to a programmers approach. One may start at a, others may start with the most commonly used letter. Tomorrow someone may come up with a new approach.
There are precomputed lists of hashes already available. For example the MD5 hash of zzzzz is 95ebc3c7b3b9f1d2c40fec14415d3cb8. Plug that into Reverse Hash Calculator and you get zzzzz back in 5 seconds.
You should not depend on tricks like being creative with your password, but rather use strong passwords with randomly-generated characters. Another approach is to use a sentence with several words that you can remember and then use the first letter of each. A password manager is also possible. For online passwords I prefer PwdHash with a single strong password so I can use a single password across multiple sites without worry. I now prefer this over password managers because of the simplicity, even though I still use a password manager.
No a password starting with z is not more secure. Brute force attacks often use dictionaries to iterate through a possible list of passwords. It will eventually arrive at the entries starting with z. Note that some dictionaries do not list the passwords alphabetically but according to the frequency a password can occur (based on previous experience); like password1234$ or zzzzz.
Even if the Brute Force attack calculates password permutations without a dictionary it still, in the end, arrive at the passwords starting with z.
The best way to mitigate on Brute Force attacks is to enforce complex passwords, account lock out mechanisms (although this invites DDOS) or implement strong Intrusion Detection Rules.
