If i set the same password in both linux and Windows, is it easier for a hacker to break the windows password? If so why and how can i create a windows password in the same security level as Linux?
So, Windows and linux validate password based authentication attempts by hashing the submitted password, and comparing that resultant hash to the one stored (its a bit more complex, but that's the idea. lets not worry about salts at this stage).
In the case of Windows this is an LM hash, or an NT hash.
In the case of linux, it is very much operating system, and even operator dependent.
How quickly you can make guesses by comparing passwords depends on the computation expense of hashing a given password - this is defined by the hashing algorithm (DES / SHA / LM / Blowfish / MD5 etc), and how it is used - the number of rounds can be defined in some cases (more rounds, more computational expense), or salts can be used (inhibits pre-computing the total number space).
LM is generally considered bad, rainbow tables exist that cover the entire number space. However a really strong (lets say 20 random chars from uppercase, lowercase, numeric and special) NT password remains very expensive to break.
Linux depends on the algorithm used.
My graphics card can make about 6046.1 kH/s guesses against LM passwords however it can make about 2262 H/s against sha256 with 5000 rounds. note the K hashes there.
check this to try it out, and get a feel for what you are asking. (performance seciton)
I think it ultimately depends on how easy it is to access the stored password hashes.
Bruteforcing a windows login screen isn't going to get you anywhere, but getting your hands on the hash and any salts involved will allow for advanced bruteforce attacks.
The quality of the password and speed of the hash are ultimately what defends you from these bruteforce attacks.
The quality of the password is all on you, not linux or windows. And a high enough quality password can protect you even if windows/linux use fast hashes without stretching them.
So when it comes to breaking the actual password itself, you could blame windows/linux for hanging onto your hashes and not stretching them (if they aren't), but ultimately since you are given every opportunity to protect yourself, you could just as easily turn that finger around and say "Myself,
<insert name>, use passwords that are defeated by advanced dictionary attacks. Maybe I should change my strategy."