An investigation of the effectiveness and security of pwds
summary
Collected 2614 LM hashes, 170,000 NTLM hashes from seven South African organisations; 19 common weak English passwords are converted into eight Southern African languages (Afrikaans excluded), lowercased, sometimes capitalized differently, hashed (LM/NTLM/MD5) and uploaded to online crackers. After one month 48% cracked, most successes on eight-character variants; Zulu conversions are frequently cracked, while Venda/Xitsonga-style words resist cracking more. Conclusion: language conversion alone gives only modest extra protection and depends strongly on which language and length are used.
AI-written summary · about
chapters (5)
- 0:00Introduction to passwords in Africa
- 2:11Password analysis in South African organizations
- 6:24Converting passwords to African languages
- 16:38Cracking results of African language passwords
- 21:58Conclusion and recommendations
related talks
30mThe Domain Password Audit Tool
28mSo You Cracked a Bunch of Passwords. Now What?
47mYour Password Complexity Requirements are Worthless
29m80,000 Plaintext Passwords: An Open Source Love Story in 3 Acts
40mFantastic Passwords and Where to Find Them
40mLive autopsy of a password: lessons learnt cracking secrets
31mBreaking Bad (Passwords)
25m80,000 Plaintext Passwords: An Open Source Love Story in Three Acts