![[ Back to EurekAlert! ]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_tLnT28Jm2gdZpTsX-HoiXFSarwmgb9EfllWUwN2UwnQp-Kt8PnQXu8o7ExTcj6eIzo7baGnR_fqC7u09dcuRGfXxzIpT-kb2qpmb90vRw=s0-d){kind=small}
Public release date: 24-Jan-2013[ | E-mail |
Share ] Contact: Byron Spice
bspice@cs.cmu.edu
412-268-9068
Carnegie Mellon University
Carnegie Mellon researchers devise grammar-aware password cracker
PITTSBURGHWhen writing or speaking, good grammar helps people make themselves be understood. But when used to concoct a long computer password, grammar good or bad provides crucial hints that can help someone crack that password, researchers at Carnegie Mellon University have demonstrated.
A team led by Ashwini Rao, a software engineering Ph.D. student in the Institute for Software Research, developed a password-cracking algorithm that took into account grammar and tested it against 1,434 passwords containing 16 or more characters. The grammar-aware cracker surpassed other state-of-the-art password crackers when passwords had grammatical structures, with 10 percent of the dataset cracked exclusively by the team's algorithm.
"We should not blindly rely on the number of words or characters in a password as a measure of its security," Rao concluded. She will present the findings on Feb. 20 at the Association for Computing Machinery's Conference on Data and Application Security and Privacy (CODASPY 2013) in San Antonio, Texas.
Basing a password on a phrase or short sentence makes it easier for a user to remember, but the grammatical structure dramatically narrows the possible combinations and sequences of words, she noted.
Likewise, grammar, whether good or bad, necessitates using different parts of speech nouns, verbs, adjectives, pronouns that also can undermine security. That's because pronouns are far fewer in number than verbs, verbs fewer than adjectives and adjectives fewer than nouns. So a password composed of "pronoun-verb-adjective-noun," such as "Shehave3cats" is inherently easier to decode than "Andyhave3cats," which follows "noun-verb-adjective-noun." A password that incorporated more nouns would be even more secure.
"I've seen password policies that say, 'Use five words,'" Rao said. "Well, if four of those words are pronouns, they don't add much security."
For instance, the team found that the five-word passphrase "Th3r3 can only b3 #1!" was easier to guess than the three-word passphrase "Hammered asinine requirements." Neither the number of words nor the number of characters determined password strength when grammar was involved. The researchers calculated that "My passw0rd is $uper str0ng!" is 100 times stronger as a passphrase than "Superman is $uper str0ng!," which in turn is 10,000 times stronger than "Th3r3 can only b3 #1!"
The research was an outgrowth of a class project for a masters-level course at CMU, Rao said. She and Gananand Kini, a fellow CMU graduate student, and Birendra Jha, a Ph.D. student at MIT, built their password cracker by building a dictionary for each part of speech and identifying a set of grammatical sequences, such as "determiner-adjective-noun" and "noun-verb-adjective-adverb," that might be used to generate passphrases.
Rao said the grammar-aware password cracker was intended only as a proof of concept and no attempt has been made to optimize its performance. But it is only a matter of time before someone does, she predicted.
###
The Institute for Software Research is part of CMU's School of Computer Science. Follow the school on Twitter @SCSatCMU.
About Carnegie Mellon University: Carnegie Mellon (www.cmu.edu) is a private, internationally ranked research university with programs in areas ranging from science, technology and business, to public policy, the humanities and the arts. More than 11,000 students in the university's seven schools and colleges benefit from a small student-to-faculty ratio and an education characterized by its focus on creating and implementing solutions for real problems, interdisciplinary collaboration and innovation. A global university, Carnegie Mellon's main campus in the United States is in Pittsburgh, Pa. It has campuses in California's Silicon Valley and Qatar, and programs in Africa, Asia, Australia, Europe and Mexico. The university is in the midst of "Inspire Innovation: The Campaign for Carnegie Mellon University," which aims to build its endowment, support faculty, students and innovative research, and enhance the physical campus with equipment and facility improvements.
[ | E-mail | Share ] ?
AAAS and EurekAlert! are not responsible for the accuracy of news releases posted to EurekAlert! by contributing institutions or for the use of any information through the EurekAlert! system.
Public release date: 24-Jan-2013[ | E-mail |
Share ] Contact: Byron Spice
bspice@cs.cmu.edu
412-268-9068
Carnegie Mellon University
Carnegie Mellon researchers devise grammar-aware password cracker
PITTSBURGHWhen writing or speaking, good grammar helps people make themselves be understood. But when used to concoct a long computer password, grammar good or bad provides crucial hints that can help someone crack that password, researchers at Carnegie Mellon University have demonstrated.
A team led by Ashwini Rao, a software engineering Ph.D. student in the Institute for Software Research, developed a password-cracking algorithm that took into account grammar and tested it against 1,434 passwords containing 16 or more characters. The grammar-aware cracker surpassed other state-of-the-art password crackers when passwords had grammatical structures, with 10 percent of the dataset cracked exclusively by the team's algorithm.
"We should not blindly rely on the number of words or characters in a password as a measure of its security," Rao concluded. She will present the findings on Feb. 20 at the Association for Computing Machinery's Conference on Data and Application Security and Privacy (CODASPY 2013) in San Antonio, Texas.
Basing a password on a phrase or short sentence makes it easier for a user to remember, but the grammatical structure dramatically narrows the possible combinations and sequences of words, she noted.
Likewise, grammar, whether good or bad, necessitates using different parts of speech nouns, verbs, adjectives, pronouns that also can undermine security. That's because pronouns are far fewer in number than verbs, verbs fewer than adjectives and adjectives fewer than nouns. So a password composed of "pronoun-verb-adjective-noun," such as "Shehave3cats" is inherently easier to decode than "Andyhave3cats," which follows "noun-verb-adjective-noun." A password that incorporated more nouns would be even more secure.
"I've seen password policies that say, 'Use five words,'" Rao said. "Well, if four of those words are pronouns, they don't add much security."
For instance, the team found that the five-word passphrase "Th3r3 can only b3 #1!" was easier to guess than the three-word passphrase "Hammered asinine requirements." Neither the number of words nor the number of characters determined password strength when grammar was involved. The researchers calculated that "My passw0rd is $uper str0ng!" is 100 times stronger as a passphrase than "Superman is $uper str0ng!," which in turn is 10,000 times stronger than "Th3r3 can only b3 #1!"
The research was an outgrowth of a class project for a masters-level course at CMU, Rao said. She and Gananand Kini, a fellow CMU graduate student, and Birendra Jha, a Ph.D. student at MIT, built their password cracker by building a dictionary for each part of speech and identifying a set of grammatical sequences, such as "determiner-adjective-noun" and "noun-verb-adjective-adverb," that might be used to generate passphrases.
Rao said the grammar-aware password cracker was intended only as a proof of concept and no attempt has been made to optimize its performance. But it is only a matter of time before someone does, she predicted.
###
The Institute for Software Research is part of CMU's School of Computer Science. Follow the school on Twitter @SCSatCMU.
About Carnegie Mellon University: Carnegie Mellon (www.cmu.edu) is a private, internationally ranked research university with programs in areas ranging from science, technology and business, to public policy, the humanities and the arts. More than 11,000 students in the university's seven schools and colleges benefit from a small student-to-faculty ratio and an education characterized by its focus on creating and implementing solutions for real problems, interdisciplinary collaboration and innovation. A global university, Carnegie Mellon's main campus in the United States is in Pittsburgh, Pa. It has campuses in California's Silicon Valley and Qatar, and programs in Africa, Asia, Australia, Europe and Mexico. The university is in the midst of "Inspire Innovation: The Campaign for Carnegie Mellon University," which aims to build its endowment, support faculty, students and innovative research, and enhance the physical campus with equipment and facility improvements.
[ | E-mail | Share ] ?
AAAS and EurekAlert! are not responsible for the accuracy of news releases posted to EurekAlert! by contributing institutions or for the use of any information through the EurekAlert! system.
Source: http://www.eurekalert.org/pub_releases/2013-01/cmu-gus012413.php
multiple sclerosis falling skies rodney king Webb Simpson Fathers Day Quotes Stevie J mothers day 2012
The latest version of "The Ultimate Fighter" debuted on Tuesday night. For the first time in many, many seasons, I enjoyed the show. Instead of focusing on the animosity between coaches, it brought out the stories of each of the fighters. It was a welcome change. Here were the biggest moments of the two-hour premiere:
Dear Lifehacker,
Depending what type of documents you're dealing with, you need to store some of them for certain periods of time, others you can digitize, and others you can throw away. Let's start with the documents you need to keep physical copies of forever:
Everything else you have you can safely shred or throw away. You should shred anything that has personal information like your name, address, phone number, social security number, or bank account information.
suitable for investigating antiparasitological, antibacterial and anti-inflammatory activity of selected plant extracts on known orangutan parasites. Research objectives include:
Guest Blogger: Jennie Nash (@jennienash)
Jennie Nash is the author of four novels and three memoirs. She has been an instructor at the UCLA Extension Writing Program for six years and has served as a private coach to fiction and non-fiction writers ranging from a British soap opera star to a Pulitzer Prize winning journalist. Her latest novel is Perfect Red, a historical novel about passion, obsession and the perfect red lipstick. Visit her at jennienash.com.