Password Security: How easily can your password be hacked?

[deleted-526910]

Hi, I have a question concerning the python program used in this experiment. when bleep 2 is used on password0 with 4 characters with just letters and numbers, the program can crack it in about a minute or two, but when I add a 5th character to the password, it takes significantly longer. Like hours longer. Is there a reason for there being such a big difference in the amount of time and how can I fix it?

[hglanz]

Hello josh2021! Thanks for your question.

It might help us more if you provided us with the two passwords (the 4 character and the 5 character) that you've tested bleep 2 out on. However, this change in the amount of time needed to crack the password is part of the project and good for you to think about! It is not necessarily indicative of an error in the program.

There are portions of code in bleep 2 that the script recommends you uncomment if you would like to see what guesses are being made and why it's taking so long. I recommend this too! For starters, how many different passwords are there that are 4 characters long when uppercase letters, lowercase letters, and numbers are all possible characters? What about 5 characters long? I will say that the latter number here is more than an order of magnitude greater then the first number (i.e. more than 10 times).

Reply here if you continue to have questions.

[deleted-526910]

The four character password is ahs2 and the five character password is ahs21. Also, when I uncomment that line and try to run the program I get the error "unindent does not match any outer indentation level"

[hglanz]

Which line, in particular, are you uncommenting?

[deleted-526910]

The portion of code that says to uncomment if I want to see the guesses the program is making.

[bfinio]

Hi Josh - as you may see if you browse some of the other recent posts about this project in the forums, we've had some weird cases where the spacing is messed up for some students when they download the code. This is problematic since Python relies on specific indentation spacing for nested code (e.g. the code inside an if/else statement or a loop). Each new level of indentation should be 4 more spaces, so ALL indentations should be multiples of 4 spaces (4, 8, 12, 16...). Check to make sure that line isn't indented a weird number of spaces (like 3 or 5) and that might fix your problem.

[deleted-512954]

Josh2021, my son is working on this too. As people have said, Science Buddies messed up the code posting so the spacing was broken, but if you take the time to line things back up it can work. My son ended up having to go through line by line almost, deleting all of the "whitespace" (they call it that on the Python sites) and then using the tab key to line it back up. It took a long time but he got the code to run. The reason that adding the extra character to your password [this is according to my genius son] is that You have to solve your 4 character password 62 times. How ever long it took for 4, it should take about 62 times as long for 5.

When you read about this you see how much better it is to use a longer password than a short one. I didn't know about this myself until I help him with his research. It also helps a lot to avoid using any common words. Hackers have techniques to look for words in passwords. My son's changes to the code are a lot better at guessing passwords with words in them.

[deleted-526910]

It looks like I've got it figured out now. Thanks for your help!

[deleted-526910]

I do have another question though, is it possible to have the program try to guess one password after another without me having to change password0 each time? This would be especially helpful since I have a long list of passwords to test for my science project.

[bfinio]

Hi josh2021 - I'd suggest you do some background research about "lists" in Python (in other programming languages sometimes they are called "arrays"). They allow you to store a bunch of different values (in this case, all your different passwords) in a list. Then you can use loops to make the program run through the list one element at a time. That way you don't have to re-run the program for each individual value of password0. I would recommend writing a few simple example programs to make sure you understand how lists and loops work before you try it with this program though. Since this one is hundreds of lines long, debugging it could be a lot harder.

[deleted-526910]

Thanks, I'll look into that. I do have what'll hopefully be my last question though. Is there any way to add the ability for bleep 2 to guess passwords with special characters in them, by adding a wheel or bleep? I know bleep 4 deals with special characters but it's only if they're in between two words that're on the dictionary list.

[bfinio]

Josh - if you look towards the beginning of the function that defines bleep 2, you will see a variable called "wheel." Right now that variable only includes a space, uppercase/lowercase letters, and numbers. You can add whatever characters you want to that.

Be careful though - I think right now that variable is 62 characters long, and 62 is hard-coded into some of the following code (further down there's a line that says "if pass_wheel_array > 62:", not sure if it appears anywhere else). It would be better to have another variable equal to the number of characters in "wheel," that way it will change automatically whenever you add more symbols. If you don't know how to do that, look up how to find the length of a string in Python.

[deleted-526910]

So I found the length of "wheel" with the special characters and came out to be 84. Do I now have to change "if pass_wheel_array > 62:", to "if pass_wheel_array > 84:", or do I create another variable like "wheel" with those 84 characters?

[bfinio]

Hi josh - either approach will work, but if I were you, I'd definitely create another variable that is equal to the length of "wheel." That way it will update automatically the next time you add or remove characters, and you won't have to keep remembering to change it to 62 or 84 or some other number. Say you call that variable wheel_length. Then your new line of code will be

if pass_wheel_array > wheel_length:

Not sure what prior programming experience you have, but this is a very important principle about variables that applies to programming in general. Just for the sake of argument, say you write a program that uses a person's weight for some calculations. The weight gets used in a bunch of different places in the program. You type in "180" for the weight everywhere and run the program. Now you want to run it for a person who weighs 160 pounds - it's really inconvenient to have to go change that number in multiple places, and if you forget one of them, your results will be wrong. It is MUCH more efficient and reliable to set a variable "weight = 160" at the beginning of the program, and then you only have to change it in one place. The same principle applies here - you generally want to avoid hard-coding numbers into your program.

*Just to clarify one thing - when you say you "found the length of "wheel"" - did you do that using a Python function, or did you count the characters manually?

[deleted-526910]

I copy and pasted the line into the shell and used the Len() function to count the characters.

[bfinio]

Ok - then you should be fine to use the len() function in your code, and save the result as a new variable that you can use instead of hard-coding the number.

[deleted-526910]

Ok, I'm a bit confused as I don't have a whole lot of prior programming experience.
I'm assuming I need to put len(wheel) under the line the defines the "wheel" variable, but I'm not exactly sure what I need to do after that.

[bfinio]

Josh - if you don't have a lot of prior programming experience, it might be good to take a step back and do some more basic Python tutorials that show you how to use variables and loops etc. This is kind of an advanced project if you haven't done much programming before. I can give you a really brief explanation here (but won't tell you exactly what changes to make to the code).

Here's a simple example. Let's say you want to write a program that adds two numbers and store them in a variable called "sum." If the sum is bigger than 10, then you print "Yay!". That program might look like this:

sum = 2 + 3
if sum > 10:
print("Yay!")

(note that the spacing gets messed up in the forums, that "print" statement should be indented 4 spaces).

In this program, the numbers 2, 3, and 10 are all hard-coded. That's bad if I'm going to be re-using those numbers in the rest of the program, because I'll have to change them in multiple places. I could do that using variables instead, like this:

x = 2
y = 3
z = 10
sum = x + y
if sum > z
print("Yay!")

Now - pretend that I have a longer program that uses 'z' in multiple locations - I only need to change the value of z once at the beginning.

So, given all that information - can you figure out how to save len(wheel) in a variable, and then use that variable in the if-statement instead of a hard-coded number?

[deleted-249560]

Ben (bfinio) was correct when he pointed out where you change that count, but he didn't explain why the code used a number in the first place. Python is an interpreted language, meaning that every single time the computer executes a line of your code it has to figure out what you mean The more functions you put in each line, the longer it takes. Part of the goal is to find as many passwords as you can but also to find them as fast as possible.

You can use the length 84 in one of three ways:
1) Just use the number
2) Set the number into 'wheel_length' and use that
3) Use the len() function.

Consider the following hunk of code:

Code: Select all

import time

starttime = time.time()
for i in range(1,1000000):
      pass
endtime = time.time()
emptylooptime = 1000*(endtime - starttime)
print("One million empty loops took ",emptylooptime," milliseconds")

starttime = time.time()
for i in range(1,1000000):
      a = 84
endtime = time.time()
time1 = 1000*(endtime - starttime) - emptylooptime
print("One million operations took ",time1," milliseconds")

starttime = time.time()
wheel = "123456789012345678901234567890123456789012345678901234567890123456789012345678901234"
wheel_length = len(wheel)
for i in range(1,1000000):
      a = wheel_length
endtime = time.time()
time2 = 1000*(endtime - starttime) - emptylooptime
print("Using a variable, one million operations took ",time2," milliseconds")

starttime = time.time()
wheel = "123456789012345678901234567890123456789012345678901234567890123456789012345678901234"
for i in range(1,1000000):
      a = len(wheel)
endtime = time.time()
time3 = 1000*(endtime - starttime) - emptylooptime
print("Using len(), one million operations took ",time3," milliseconds")
print("Using the variable takes ",100*((time2/time1)-1),"% more time")
print("Using len() in the loop takes ",100*((time3/time1)-1),"% more time")

When you run it, you get bleep like this:

• One million empty loops took 51.98812484741211 milliseconds
  
  One million operations took 27.846813201904297 milliseconds
  Using a variable, one million operations took 45.683860778808594 milliseconds
  Using len(), one million operations took 99.29084777832031 milliseconds
  
  Using the variable takes 64.05417900991455 % more time
  Using len() in the loop takes 256.5609000154112 % more time

What this tells you is that it is measurably faster to simply replace the 62 with the new number. If you really don't want to, at least set it in a variable since that's less of a performance penalty than "if pass_wheel_array > len(wheel):". Your testing time is going to be really long anyway with long passwords, so you might not want to make it worse than it has to be.