Live autopsy of a password: lessons learnt cracking secrets
summary
Live demo uses hashcat on off‑the‑shelf GPUs performing ~13.0 ghs (billions of guesses per second) to run dictionary plus rule‑set attacks and targeted OSINT wordlists (CrackStation and GitHub lists); result: 22 of 27 hashes (81% cracked) in ~27 minutes. Analysis shows common patterns (one initial uppercase, one special, trailing digits), limited special‑char set, and that eight‑character policy space collapses dramatically; long random passphrases and unused characters like space materially increase resistance.
AI-written summary · about
chapters (19)
- 0:00Password cracking research intro
- 1:06Password construction and hardware
- 5:50How passwords work and breaches
- 7:58Humans and password complexity
- 9:04Leaked credentials scale and reuse
- 11:08How passwords are stolen and hashed
- 12:14Online cracking with precomputed hashes
- 13:41Dictionary attacks and mutations
- 15:50Personal data in passwords
- 18:22Google for personal data extraction
- 21:17Testing cracked passwords
- 22:44Underground market for accounts
- 24:10Ransomware and password targets
- 26:39Hashcat performance and guess rates
- 27:43Password length vs complexity
- 29:53Analysis of 60M passwords
- 31:43Common password patterns
- 33:51Password security summary
- 37:29Final advice and disclaimer
related talks
25m80,000 Plaintext Passwords: An Open Source Love Story in Three Acts
34m80,00 Plaintext Passwords
29m80,000 Plaintext Passwords: An Open Source Love Story in 3 Acts
59mHack Yourself First
31m680,000 Plaintext Passwords: An Open Source Love Story in Three Acts
31mBreaking Bad (Passwords)
28mSo You Cracked a Bunch of Passwords. Now What?
42mPassword Hashing