For years the security industry has stressed the importance of strong passwords. Some recent research from Home Security Heroes clearly illustrates the value of that advice.

Using artificial intelligence, the crew at the Home Security Information and Reviews website cracks passwords in the four- to seven-character range either instantly or within a few minutes — even when the password contains numbers, upper and lowercase letters. Mixing happens, and symbols.

After feeding more than 15.6 million passwords into an AI-powered password cracker called PassGain, the researchers concluded that it is possible to crack 51% of common passwords in under a minute.

However, the AI ​​software faltered against longer passwords. A number-only password of 18 characters would take at least 10 months to crack, and a password that length with numbers, upper- and lower-case letters, and symbols would take six quintillion years to crack.

On the Home Security Heroes website, the researchers explain that PassGAN uses a Generative Adversarial Network (GAN) to autonomously learn the distribution of real passwords from real password leaks and generate realistic passwords that hackers can exploit.

Domingo Guerra, Executive Vice President explained, “AI algorithms are continuously A/B tested against each other millions of times to stimulate learning, allowing human knowledge with microchips up to 100,000 times faster than the human brain.” Yoga happens.” Trusted for Encode Technologies, an international identity verification and biometric authentication company.

“Compared to traditional, brute force algorithms with limited capacity, AI predicts the most likely next figure,” he told TechNewsWorld. “Instead of acquiring knowledge externally, it leans into the patterns it has built up during its training to quickly display the behavior.”

Doubt on AI

Dustin Childs, head of threat awareness at Trend Micro’s Zero Day Initiative, observed that based on what has been publicly disclosed, the AI ​​uses techniques similar to rainbow table attacks, not just brute force a password. For. Hackers use rainbow tables to translate hashed passwords into plaintext.

“Rainbow tables allow AI to perform simple search and compare operations on hashed passwords, rather than a slow, brute force attack,” he told TechNewsWorld.

“Rainbow table attacks have been accepted for years and have been shown to crack even 14-character passwords in under five minutes,” he said. “Even older hashing algorithms such as MD5 and SHA-1 are susceptible to these types of attacks.”

Robert Hughes, chief information security officer at RSA, a cybersecurity company in Bedford, Mass., explained that most password cracking is done by first finding a hashed password and comparing it against it.

“In theory,” he continued, “an AI can learn more information about a subject and use it to do so in an intelligent way, but this is not proven in practice.”

“Security teams have been battling with brute force and rainbow tables for years now,” he said. “In fact, the PassGAN AI model does not perform much faster than the others which benefits the actors.”

AI’s Limitations

Clearwater, Fla. Roger Grimes, a defense campaigner at KnowBe4, a security awareness training provider in the U.S., is also not convinced that AI can crack passwords any faster than traditional methods.

“Probably it can, and certainly it will be able to in the future,” he told TechNewsWorld, “but no one has shown me a definitive test of any AI system today that does non-AI, traditional password guessing.” And breaks passwords faster than cracking.” ways.”

“As more and more people use password managers that generate truly random passwords, AI will have zero advantage over any traditional password cracking when the passwords involved are truly random, as they should already be.” Should be,” he said.

Security experts point out some limitations of using AI to crack passwords. For example, computing power can be a challenge. “Cracking longer and more complex passwords takes a significant amount of time — even by AI,” Childs said.

“It is also unclear how AI will fare against the salting mechanism used in some hashing algorithms,” he said.

There’s a big difference between generating a huge number of password guesses and being able to input those guesses in a real-world scenario, said John Gunn, CEO of Token, a maker of biometric-based wearable authentication Ring in Rochester, NY. .

“Most apps and systems have a low number of incorrect entries before locking out a hacker, and AI doesn’t change that,” he told TechNewsWorld.

long goodbye to passwords

Of course, one wouldn’t have to worry about AI cracking passwords if there were no passwords to crack. That doesn’t seem likely, at least in the near term, despite annual predictions about the end of passwords.

Darren Guccione, CEO of Keeper Security, a password management and online storage provider, said, “Over time, we take the annoyance out of password management by removing the clunky manual process of remembering and entering long strings of numbers and letters to gain access. are likely to do.” Company in Chicago.

“But given the billions of existing devices and systems that already rely on password protection, passwords will still be with us for the foreseeable future,” he told TechNewsWorld. “We can only provide stronger security to support their safe use.”

Grimes said there has been a movement to get rid of passwords since the late 1980s. “There are thousands of articles predicting the death of the password, and yet decades later, it’s still a struggle,” he said.

“If you put all non-password authentication solutions together, they won’t work on 2% of the world’s sites and services,” he continued. “It’s a problem, and it’s preventing widespread adoption.”

“On a good note, more people today use some form of non-password authentication to log on to one or more sites and services. The percentage is higher than ever before,” he said.

“But as long as the overall percentage of sites and services remains below 2%, the ‘tipping point’ for large-scale adoption of non-password authentication is becoming difficult,” he said. “It’s a frustratingly difficult real-world chicken-and-egg problem.”

Hughes acknowledged that legacy systems, as well as trust from users and administrators, have slowed the move away from passwords. However, he added: “Ultimately, passwords will be used sparingly, and they will be used mostly where they are appropriate or where systems cannot be updated to support other methods, but instead It will still take years to lock down passwords.” Most people and companies.