Along with the benefits of emerging generative AI services come new hazards. PassGAN, a sophisticated solution to password cracking, has just emerged. Using the most recent AI, it was able to hack 51% of passwords in under a minute and crack 71% of passwords in less than a day.
Microsoft raised attention to the security problems that would accompany the rapid growth of AI last month when it announced its new Security Copilot suite, which will assist security researchers in protecting against malicious use of current technologies.
Home Security Heroes recently released a study demonstrating how frighteningly powerful the latest generative AI is at cracking passwords. The company ran a list of over 15,000,000 credentials from the Rockyou dataset through the new password cracker PassGAN (password generative adversarial network), and the results were shocking.
51% of all popular passwords were broken in under a minute, 65% in under an hour, 71% in under a day, and 81% in under a month. PassGAN is able to "autonomously learn the distribution of real passwords from actual password leaks," which is why AI is making such a difference in password cracking. Rather than having to do manual password analysis on leaked password databases, PassGAN is able to "autonomously learn the distribution of real passwords from actual password leaks."
How to Prevent AI Password Cracking
Sticking to at least 12 characters or more of capital and lowercase letters plus numbers (or symbols) distinguishes between easily or rapidly cracked passwords and difficult-to-crack passwords. For the time being, all passwords with 18 characters that include both letters and numbers are protected against AI cracking.
Seeing how powerful AI can be for password cracking is a good reminder to not only use strong passwords but also to check:
- Utilising 2FA/MFA. (non-SMS-based whenever possible)
- Avoid reusing passwords across accounts.
- When feasible, use password generators.
- Passwords should be changed on a frequent basis, especially for important accounts.
- Avoid using public WiFi, especially for banking and other similar accounts.
On the Home Security Heroes website, there is a program that allows you to test your own passwords against AI. However, it's best not to enter any of your genuine passwords if you want to check out the AI password analyser - instead, enter a random one.
