You know the drill: use a long and varied password, don’t use the same password twice, use a different password for every site. Is using a short password really that dangerous? Today’s Question & Answer session comes to us courtesy of SuperUser—a subdivision of Stack Exchange, a community-driven grouping of Q&A web sites.

问题

超级用户读者user31073很好奇他是否真的应该注意那些简短的密码警告：

Using systems like TrueCrypt, when I have to define a new password I am often informed that using a short password is insecure and “very easy” to break by brute-force.

I always use passwords of 8 characters in length, which are not based on dictionary words, which c***ists of characters from the set A-Z, a-z, 0-9

I.e. I use password like sDvE98f1

How easy is it to crack such a password by brute-force? I.e. how fast.

I know it heavily depends on the hardware but maybe someone could give me an estimate how long it would take to do this on a dual core with 2GHZ or whatever to have a frame of reference for the hardware.

To brute-force attack such a password one needs not only to cycle through all combinati*** but also try to decrypt with each guessed password which also needs some time.

Also, is there some software to brute-force hack TrueCrypt because I want to try to brute-force crack my own password to see how long it takes if it is really that “very easy”.

短随机字符密码真的有风险吗？

答案

超级用户贡献者Josh K.强调了攻击者需要什么：

If the attacker can gain access to the password hash it is often very easy to brute force since it simply entails hashing passwords until the hashes match.

The hash “strength” is dependent on how the password is stored. A MD5 hash might take less time to generate then a SHA-512 hash.

Windows used to (and may still, I don’t know) store passwords in a LM hash format, which uppercased the password and split it into two 7 character chunks which were then hashed. If you had a 15 character password it wouldn’t matter because it only stored the first 14 characters, and it was easy to brute force because you weren’t brute forcing a 14 character password, you were brute forcing two 7 character passwords.

If you feel the need, download a program such as John The Ripper or Cain & Abel (links withheld) and test it.

I recall being able to generate 200,000 hashes a second for an LM hash. Depending on how Truecrypt stores the hash, and if it can be retrieved from a locked volume, it could take more or less time.

Brute force attacks are often used when the attacker has a large number of hashes to go through. After running through a common dictionary they will often start weeding passwords out with common brute force attacks. Numbered passwords up to ten, extended alpha and numeric, alphanumeric and common symbols, alphanumeric and extended symbols. Depending on the goal of the attack it can lead with varying success rates. Attempting to compromise the security of one account in particular is often not the goal.

另一位撰稿人Phoshi进一步阐述了这一观点：

Brute-Force is not a viable attack, pretty much ever. If the attacker knows nothing about your password, he isn’t getting it through brute-force this side of 2020. This may change in the future, as hardware advances (For example, one could use all however-many-it-has-now cores on an i7, massively speeding up the process (Still talking years, though))

If you want to be -super- secure, stick an extended-ascii symbol in there (Hold alt, use the numpad to type in a number larger than 255). Doing that pretty much assures that a plain brute-force is useless.

You should be concerned about potential flaws in truecrypt’s encryption algorithm, which could make finding a password much easier, and of course, the most complex password in the world is useless if the machine you’re using it on is compromised.

我们可以将Phoshi的回答解释为“暴力不是一个可行的攻击，当使用复杂的当前一代加密时，几乎从来没有”。

正如我们在最近的文章中强调的，暴力攻击解释了：所有的加密都是易受攻击的，加密方案老化，硬件能力增加，所以过去的硬目标（如微软的NTLM密码加密算法）在几个小时内就可以被击败只是时间问题。

有什么要补充的解释吗？在评论中发出声音。想从其他精通技术的Stack Exchange用户那里了解更多答案吗？在这里查看完整的讨论主题。