# Can a Windows or Linux password be brute-forced on a public network?

I am at a hotel that has a public network. I have a Windows machine with a wired connection to it. "Network and Sharing" has network discovery on. No folders are shared except "Users", which is shared by default. Is it possible for someone on the same network to gain the password for an administrator account on a Windows or Linux machine through a brute-force attack? Let's assume that all users' passwords are strong.

If you assume that all passwords on the system are strong, then no.

The definition of a "strong" password is that the time to complete a guessing attack, whether brute force or with a "common passwords" list is long with respect to the exposure.

Unless you live in the hotel, you'll be gone (and the exposure will end) before an attacker could have acquired your password through a brute force attack. (Um, unless the attacker has physical access to the machine, which wasn't part of the question.) On the other hand, if your password is cracked by brute force, it wasn't "strong." There's a nasty amount of circular reasoning in there. Let me see if I can get rid some of it.

The strength of a password is measured in bits of entropy, or randomness. If your password is on the list of 500 most common passwords, you have about 9 bits of entropy because log2(500) is about 9. Put another way, 29 = 512. If you use a password that is five Dicewords, you'll have about 55 bits of entropy because each word is drawn from a list of about 2,000 words and log2(2000) is about 11. (211 is 2048.) You get eleven bits of entropy for each of the five words, total 55 bits of entropy.

If one can make G guesses per second against a password with n bits of entropy, then the average time to guess is 2n-1/G because, on the average, the attacker will "hit" about halfway through the possible values.

So, an example: a password with 28 bits of entropy and an attacker can make 210 guesses per second, assuming an online attack. (Offline attacks can be much faster.) That will take about 227 guesses, or 227-10 seconds, or about a day and a half. If you have 55 bits of entropy in the password, that's 244 seconds, or about 557,000 years.

Now you have a fairly rigorous definition of "strength" and can figure out how strong your password must be to withstand a sustained attack over a three-day hotel stay. (There's a pretty big assumption about G in there, though.)

Edit: This answer addresses a brute force attack on the operating system's login interface, which is, I think, the question. There are many other kinds of attacks.

• Three days, how did you know? Would the OS lock the account from another login attempt after many unsuccessful attempts? Dec 28, 2014 at 2:46
• @T.Webster: I made "three days" up; it's pretty much my average hotel stay. Things like locking depend on the O.S. and the configuration. One has to make worst-case assumptions if one doesn't know. I've given the worst-case assumptions, with the possible exception of G which depends very much on the circumstances. Dec 28, 2014 at 2:48
• No mention of Pass the hash attack? If any communication services are running, Windows LM/NTLM password hashes are at risk. Dec 28, 2014 at 3:12
• @BobBrown , what "strong" meant to me in writing the question was not so precisely defined as in your answer. I just meant what in many places qualifies as a "strong" password. For example, one typical password requirement is to have at least 8 characters, including at least 1 uppercase, lowercase, and numeric character. You answered my question "is it possible?" with a yes, actually. But is it feasible? No. Dec 28, 2014 at 3:21
• @T.Webster: Yup, the question I answered was for a brute force attack on the operating system's login mechanism. Attacks on password hashes are a different question, as is the "pass the hash" attack. Windows and Linux (or Mac OS) are very different when one gets to those kinds of attacks. There's an article here: arstechnica.com/security/2013/08/… Dec 28, 2014 at 12:42